Add a Subnet to a App Service App?

[Lindsay Mathieson (Lindsay-Mathieson)]

Using aspire for setting up my subnets, works fin for my ACA containers.

var vnet = builder.AddAzureVirtualNetwork("aca-vnet");
var acaSubnet = vnet.AddSubnet("aca-subnet", "10.0.1.0/24");
var appSvcSubnet = vnet.AddSubnet("appsvc-subnet", "10.0.0.0/24");

var acaEnv = builder.AddAzureContainerAppEnvironment("dc-aca-env")
    .WithDelegatedSubnet(acaSubnet);

var appServiceEnv = builder.AddAzureAppServiceEnvironment("rc-app-service-env")
   .ConfigureInfrastructure(infra =>
   {
       var resources = infra.GetProvisionableResources();
       var plan = resources.OfType<AppServicePlan>().Single();

       plan.Sku = new AppServiceSkuDescription
       {
           Name = "B3",
           Tier = "Basic"
       };

       plan.Tags.Add("Environment", "Test");
       plan.Tags.Add("CostCenter", "Engineering");
   });

Can't figure out how to do the same for App Services :(

nb. Plan can be upgraded to Premium if needed, this is just testing for now.

[David Fowler (davidfowl)]

You configure this on each App Service website, rather than on AddAzureAppServiceEnvironment.

Delegate the subnet to Microsoft.Web/serverFarms, then use PublishAsAzureAppServiceWebsite to set WebSite.VirtualNetworkSubnetId:

#pragma warning disable ASPIREAZURE003

using Aspire.Hosting.Azure;

var vnet = builder.AddAzureVirtualNetwork("app-vnet");
var subnet = vnet.AddSubnet("appservice-subnet", "10.0.0.0/24");

subnet.WithAnnotation(new AzureSubnetServiceDelegationAnnotation(
    "appservice-delegation",
    "Microsoft.Web/serverFarms"));

builder.AddAzureAppServiceEnvironment("appservice");

builder.AddProject<Projects.Web>("web")
    .WithExternalHttpEndpoints()
    .PublishAsAzureAppServiceWebsite((infrastructure, site) =>
    {
        site.VirtualNetworkSubnetId =
            subnet.Resource.Id.AsProvisioningParameter(infrastructure);
    });

I tested this end to end with Aspire 13.4.6 using aspire deploy. The deployed endpoint returned HTTP 200, Azure reported the expected virtualNetworkSubnetId, the subnet had the Microsoft.Web/serverFarms delegation, and Azure created the AppServiceLink service association link.

One additional caveat for the B3 configuration in your example: Aspire's default Premium configuration sets each website's NumberOfWorkers to 30. Azure rejects that value when the plan is changed to Basic. For B3, also configure the website with:

site.SiteConfig.NumberOfWorkers = 3;

Alternatively, keep the default Premium plan and omit that setting.

App Service VNet integration controls outbound access from the app into the virtual network. If you also need private inbound access to the app, that is configured separately with a private endpoint.

[Lindsay Mathieson (Lindsay-Mathieson)]

It defaulted some to valid details, but I had no idea where it got them from, which was uncomfortable.

What do you mean? The parameters?

Off the top of my head, it filled the Default_Connection db conn string with the parameter I was using in my azd deployment - was experimenting with using aspire rather than azd.

[Lindsay Mathieson (Lindsay-Mathieson)]

It defaulted some to valid details, but I had no idea where it got them from, which was uncomfortable.

What do you mean? The parameters?

Ok, figured it out - it seems to be using the App Host user secrets.

How are you meant to set different value for different environments?

[David Fowler (davidfowl)]

It shouldn't be using user secrets in deployment mode, that sounds like a bug. User secrets are for the dev environment only. There's a gap #17184

[David Fowler (davidfowl)]

BTW #18738 was merged and will be in 13.5

[Lindsay Mathieson (Lindsay-Mathieson)]

BTW #18738 was merged and will be in 13.5

Oh awesome, thank you. Will try it out once availble.