Merged
Conversation
uses the correct api version and removed openai support for gov
…plechat into deployment-updates
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the repo’s deployment tooling and documentation across AZD/Bicep, Azure CLI/PowerShell, and Terraform—mainly to improve private networking parity, make deployments more repeatable (especially under MFA/claims challenges), and reduce reliance on Key Vault for “core service” key-auth configuration.
Changes:
- Expanded deployment docs (main README, Bicep, Azure CLI, Terraform) with clearer shell/platform guidance, private networking runner connectivity guidance, and OpenAI deployment-type notes.
- Added multiple functional regression tests that assert key deployment behaviors by scanning deployer scripts/templates.
- Refactored deployment-time configuration to retrieve core keys directly from Azure resources / Azure CLI and added Terraform private networking support (VNets, private endpoints, private DNS handling).
Reviewed changes
Copilot reviewed 68 out of 71 changed files in this pull request and generated 13 comments.
Show a summary per file
| File | Description |
|---|---|
| README.md | Adds Azure CLI deployer reference + PowerShell-first quickstart and prerequisites guidance. |
| deployers/azure.yaml | Adds/updates AZD hooks (preprovision validation, postprovision behavior, Windows hook coverage). |
| functional_tests/test_postprovision_python_dependency_install.py | Regression test for venv-aware pip install logic in postprovision hook. |
| functional_tests/test_postconfig_azurecli_credential.py | Regression test ensuring postconfig uses AzureCliCredential and Cosmos key fallback. |
| functional_tests/test_enhanced_citations_storage_deployment_fix.py | Regression test ensuring storage connection string population for enhanced citations + version check. |
| functional_tests/test_core_service_key_deployment_path.py | Regression test for “core service keys from Azure resources (not KV)” + version check. |
| functional_tests/test_azurecli_aoai_model_deployments.py | Regression test for Azure CLI deployer AOAI model deployment support and docs. |
| functional_tests/test_azd_windows_hooks.py | Regression test for required Windows AZD hook behavior and Cosmos/ACR handling. |
| functional_tests/test_azd_prerequisites_allowed_ip_auto_merge.py | Regression test for auto-merging runner public IP into AZD env before provisioning. |
| functional_tests/test_acr_trusted_services_bypass.py | Regression test for ACR trusted services bypass + build/run polling behavior. |
| docs/how-to/enterprise_networking.md | Adds “deployment runner connectivity” guidance for private endpoint reachability. |
| docs/explanation/fixes/v0.237.064/POSTPROVISION_VENV_PIP_USER_FIX.md | Fix doc for avoiding pip --user inside venv during postprovision. |
| docs/explanation/fixes/v0.237.063/WINDOWS_ACR_LOG_STREAM_ENCODING_FIX.md | Fix doc for Windows ACR log streaming Unicode encode failures. |
| docs/explanation/fixes/v0.237.062/ACR_DEPLOYMENT_TIME_PUBLIC_ACCESS_FIX.md | Fix doc for allowing ACR access during build until final lockdown. |
| docs/explanation/fixes/v0.237.061/ACR_PREDEPLOY_TEMPORARY_FIREWALL_OPEN_FIX.md | Fix doc for temporary ACR firewall changes during predeploy (historical). |
| docs/explanation/fixes/v0.237.060/COSMOS_FIREWALL_MFA_FALLBACK_ACCESS_CHECK_FIX.md | Fix doc for Cosmos firewall MFA fallback access probing. |
| docs/explanation/fixes/v0.237.059/COSMOS_FIREWALL_CIDR_PROPAGATION_FIX.md | Fix doc for CIDR matching + propagation wait behavior. |
| docs/explanation/fixes/v0.237.058/ACR_TASKS_TRUSTED_AZURE_SERVICES_FIX.md | Fix doc for ACR Tasks access via trusted Azure services bypass. |
| docs/explanation/fixes/v0.237.057/AZD_POSTPROVISION_COSMOS_ACCESS_PROBE_FIX.md | Fix doc for Cosmos data-plane probe short-circuiting. |
| docs/explanation/fixes/v0.237.056/AZD_PRIVATE_NETWORK_RUNNER_IP_PRIMING_FIX.md | Fix doc for runner IP priming before provisioning. |
| docs/explanation/fixes/v0.237.055/AZD_POSTPROVISION_MFA_COSMOS_GUIDANCE_FIX.md | Fix doc for surfacing MFA-specific Cosmos guidance. |
| docs/explanation/fixes/v0.237.054/AZD_POSTPROVISION_COSMOS_FIREWALL_RUNNER_ACCESS_FIX.md | Fix doc for adding runner IP to Cosmos firewall during hook execution. |
| docs/explanation/fixes/v0.237.053/AZD_POSTPROVISION_COSMOS_KEY_FALLBACK_FIX.md | Fix doc for Cosmos key fallback to avoid RBAC propagation timing. |
| docs/explanation/fixes/v0.237.052/POSTCONFIG_AZURECLI_CREDENTIAL_FIX.md | Fix doc for switching postconfig to AzureCliCredential. |
| docs/explanation/fixes/v0.237.051/AZD_WINDOWS_SUBSCRIPTION_TARGETING_FIX.md | Fix doc for subscription-pinned Azure CLI calls on Windows hooks. |
| docs/explanation/fixes/v0.237.050/AZD_WINDOWS_RGNAME_RESOLUTION_FIX.md | Fix doc for Windows resource group name resolution fallback. |
| docs/explanation/fixes/v0.237.049/AZD_WINDOWS_POSTPROVISION_HOOK_FIX.md | Fix doc for missing Windows hook definitions. |
| docs/explanation/fixes/ENHANCED_CITATIONS_STORAGE_CONNECTION_STRING_FIX.md | Fix doc for ensuring enhanced citations storage connection string persistence. |
| docs/explanation/fixes/CORE_SERVICE_KEY_DEPLOYMENT_FIX.md | Fix doc for core-service key retrieval directly from Azure resources. |
| docs/explanation/features/v0.237.001/PRIVATE_NETWORKING_SUPPORT.md | Adds “deployment runner access” guidance to private networking feature doc. |
| docs/explanation/features/TERRAFORM_PRIVATE_NETWORKING_PARITY.md | Feature doc describing Terraform private networking parity scope. |
| docs/explanation/features/AZURECLI_PRIVATE_NETWORKING_PARITY.md | Feature doc describing Azure CLI deployer private networking parity scope. |
| docs/explanation/features/AZURECLI_AOAI_MODEL_DEPLOYMENTS.md | Feature doc describing AOAI model deployment creation via Azure CLI deployer. |
| docs/explanation/features/ACR_BUILD_WORKFLOW_FOR_DEPLOYERS.md | Feature doc describing ACR Tasks-based build workflow across deployers. |
| deployers/terraform/ReadMe.md | Updates Terraform deployer docs (private networking notes, OpenAI reuse, image build guidance). |
| deployers/terraform/private_networking.tf | Adds Terraform resources/logic for VNets, subnets, private endpoints, and private DNS zone reuse/linking. |
| deployers/terraform/.terraform.lock.hcl | Updates provider locks (adds azapi and bumps provider versions). |
| deployers/Initialize-EntraApplication.ps1 | Adds cloud selection/auth improvements + permission grant handling + interactive input validation. |
| deployers/Initialize-AzureEnvironment.ps1 | Adds existing OpenAI reuse options + cloud selection/auth + outputs ACR build guidance. |
| deployers/bicep/validate_azd_prerequisites.py | New preprovision script to validate private networking prerequisites and persist runner IP to AZD env. |
| deployers/bicep/README.md | Updates Bicep deployer docs (shell correctness, ACR build, private DNS + existing VNet guidance, OpenAI deployment type). |
| deployers/bicep/postconfig.py | Refactors postconfig to use Azure CLI + direct resource key retrieval, plus enhanced citations storage connection string handling. |
| deployers/bicep/OneClickDeploy.md | Adds upfront private networking/existing VNet prerequisite warnings for one-click deployments. |
| deployers/bicep/modules/videoIndexer.bicep | Adds selectable Video Indexer ARM API version path (legacy vs current). |
| deployers/bicep/modules/speechService.bicep | Removes deployment-time Key Vault secret storage for speech keys. |
| deployers/bicep/modules/setPermissions.bicep | Adds cross-RG/sub OpenAI permission path and conditional Video Indexer/OpenAI integration behavior. |
| deployers/bicep/modules/setPermissions-openAIExternal.bicep | New module to assign OpenAI roles when OpenAI is in a different RG/subscription. |
| deployers/bicep/modules/search.bicep | Removes deployment-time Key Vault secret storage for search key. |
| deployers/bicep/modules/redisCache.bicep | Removes deployment-time Key Vault secret storage for Redis key. |
| deployers/bicep/modules/privateNetworking.bicep | Adds private DNS zone reuse and optional VNet link creation; supports external OpenAI resource scoping. |
| deployers/bicep/modules/privateDNSLink.bicep | New module to create VNet links in an existing private DNS zone scope. |
| deployers/bicep/modules/privateDNS.bicep | Adds support for existing private DNS zone reuse and optional link creation. |
| deployers/bicep/modules/openAI.bicep | Adds “existing OpenAI endpoint/resource metadata” flow; skips provisioning/models when reusing endpoint. |
| deployers/bicep/modules/documentIntelligence.bicep | Removes deployment-time Key Vault secret storage for doc intel keys. |
| deployers/bicep/modules/cosmosDb.bicep | Removes deployment-time Key Vault secret storage for Cosmos key. |
| deployers/bicep/modules/contentSafety.bicep | Removes deployment-time Key Vault secret storage for content safety key. |
| deployers/bicep/modules/azureContainerRegistry.bicep | Adjusts ACR networking defaults and enables trusted Azure services bypass; removes KV secret storage. |
| deployers/bicep/modules/appService.bicep | Switches key-auth settings to direct listKeys/listCredentials values; adds Video Indexer env settings. |
| deployers/bicep/main.parameters.json | Adds new parameters for existing VNet/subnets, OpenAI reuse, OpenAI deployment type, Video Indexer overrides. |
| deployers/bicep/main.bicep | Adds new private networking reuse params, private DNS configs, OpenAI reuse options, default model logic, and default imageName. |
| deployers/bicep/cosmosDb-postDeployPerms.sh | Adds MFA/“already exists” detection to role assignment flows. |
| deployers/azurecli/README.md | Major expansion of Azure CLI deployer documentation (features, prerequisites, private networking, AOAI models, ACR build). |
| deployers/azurecli/destroy-simplechat.ps1 | Adds cloud-aware token refresh targets + cleanup scope notes + new security group coverage. |
| application/single_app/route_backend_models.py | Returns configured models for Foundry endpoints / missing resource metadata instead of hard failing. |
| application/single_app/functions_settings.py | Makes default Video Indexer ARM API version environment/cloud-aware. |
| application/single_app/config.py | Bumps application version to 0.240.004. |
Files not reviewed (1)
- deployers/terraform/.terraform.lock.hcl: Language not supported
Comments suppressed due to low confidence (1)
deployers/azure.yaml:223
- The postprovision hook runs postconfig via
.venv/bin/python3, but this workflow doesn’t create a.venv(and dependencies were installed viapython3 -m pip ..., not into.venv). This will fail on fresh deployments. Consider invoking postconfig with the same interpreter used for the pip install step (or explicitly create/activate a venv before installing and running postconfig).
echo ""
echo "[3/4] Running post-deployment configuration..."
if .venv/bin/python3 ./bicep/postconfig.py; then
echo "✓ Post-deployment configuration completed"
else
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.