From b86fbae03112ca5d50b7cd44953e2e45ee368c02 Mon Sep 17 00:00:00 2001 From: chaudhariniraj Date: Mon, 6 Jul 2026 12:19:05 +0530 Subject: [PATCH 1/4] Update acr script to handle WAF deployment --- infra/scripts/acr_build_push.ps1 | 66 ++++++++++++++++++++++++++++++++ infra/scripts/acr_build_push.sh | 57 +++++++++++++++++++++++++++ 2 files changed, 123 insertions(+) diff --git a/infra/scripts/acr_build_push.ps1 b/infra/scripts/acr_build_push.ps1 index 71b21dcc..54cd0509 100644 --- a/infra/scripts/acr_build_push.ps1 +++ b/infra/scripts/acr_build_push.ps1 @@ -83,6 +83,45 @@ else { } $IMAGE_TAG = "latest" +$DeploymentType = az group show ` + --name $RESOURCE_GROUP ` + --query "tags.Type" ` + -o tsv + if ($DeploymentType -eq "WAF") { + + Write-Host "" + Write-Host "WAF deployment detected. Temporarily relaxing ACR restrictions..." + + $acrAllowExport = az acr update ` + --name $ACR_NAME ` + --resource-group $RESOURCE_GROUP ` + --allow-exports true + + if ($LASTEXITCODE -ne 0) { + throw "Failed to enable ACR exports." + } + + $acrPublicNetwork = az acr update ` + --name $ACR_NAME ` + --resource-group $RESOURCE_GROUP ` + --public-network-enabled true + + if ($LASTEXITCODE -ne 0) { + throw "Failed to enable ACR public network access." + } + + $acrDefaultAction = az acr update ` + --name $ACR_NAME ` + --resource-group $RESOURCE_GROUP ` + --default-action Allow + + if ($LASTEXITCODE -ne 0) { + throw "Failed to set ACR default action to Allow." + } + + Write-Host "ACR restrictions temporarily relaxed." +} + # Get the script directory and navigate to repo root $ScriptDir = $PSScriptRoot @@ -95,6 +134,7 @@ Write-Host " Resource Group: $RESOURCE_GROUP" Write-Host " Image Tag: $IMAGE_TAG" Write-Host "" +try { # ============================================================================= # Step 1: Build and push images to ACR using az acr build # ============================================================================= @@ -214,3 +254,29 @@ Write-Host "" Write-Host "============================================================" Write-Host "ACR Build and Push - Completed Successfully!" Write-Host "============================================================" +} +finally { + + if ($DeploymentType -eq "WAF") { + + Write-Host "" + Write-Host "Restoring WAF ACR configuration..." + + $acrDefailtAction = az acr update ` + --name $ACR_NAME ` + --resource-group $RESOURCE_GROUP ` + --default-action Deny + + $acrPublicNetwork = az acr update ` + --name $ACR_NAME ` + --resource-group $RESOURCE_GROUP ` + --public-network-enabled false + + $acrAllowExport = az acr update ` + --name $ACR_NAME ` + --resource-group $RESOURCE_GROUP ` + --allow-exports false + + Write-Host "ACR configuration restored." + } +} \ No newline at end of file diff --git a/infra/scripts/acr_build_push.sh b/infra/scripts/acr_build_push.sh index 0fdc1143..7828e4b7 100644 --- a/infra/scripts/acr_build_push.sh +++ b/infra/scripts/acr_build_push.sh @@ -76,6 +76,34 @@ else fi IMAGE_TAG="latest" +DEPLOYMENT_TYPE=$(az group show \ + --name "$RESOURCE_GROUP" \ + --query "tags.Type" \ + -o tsv) + +if [ "$DEPLOYMENT_TYPE" = "WAF" ]; then + + echo "" + echo "WAF deployment detected. Temporarily relaxing ACR restrictions..." + + az acr update \ + --name "$ACR_NAME" \ + --resource-group "$RESOURCE_GROUP" \ + --allow-exports true + + az acr update \ + --name "$ACR_NAME" \ + --resource-group "$RESOURCE_GROUP" \ + --public-network-enabled true + + az acr update \ + --name "$ACR_NAME" \ + --resource-group "$RESOURCE_GROUP" \ + --default-action Allow + + echo "ACR restrictions temporarily relaxed." + +fi # Get the directory where this script is located SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" @@ -89,6 +117,35 @@ echo " Resource Group: $RESOURCE_GROUP" echo " Image Tag: $IMAGE_TAG" echo "" +cleanup() { + + if [ "$DEPLOYMENT_TYPE" = "WAF" ]; then + + echo "" + echo "Restoring WAF ACR configuration..." + + az acr update \ + --name "$ACR_NAME" \ + --resource-group "$RESOURCE_GROUP" \ + --default-action Deny + + az acr update \ + --name "$ACR_NAME" \ + --resource-group "$RESOURCE_GROUP" \ + --public-network-enabled false + + az acr update \ + --name "$ACR_NAME" \ + --resource-group "$RESOURCE_GROUP" \ + --allow-exports false + + echo "ACR configuration restored." + + fi +} + +trap cleanup EXIT + # ============================================================================= # Step 1: Build and push images to ACR using az acr build # ============================================================================= From dc9941eec543578c155125bd902594e4d5a8f956 Mon Sep 17 00:00:00 2001 From: chaudhariniraj Date: Mon, 6 Jul 2026 12:42:16 +0530 Subject: [PATCH 2/4] resolve copilot comment --- infra/scripts/acr_build_push.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/scripts/acr_build_push.ps1 b/infra/scripts/acr_build_push.ps1 index 54cd0509..862ed4d7 100644 --- a/infra/scripts/acr_build_push.ps1 +++ b/infra/scripts/acr_build_push.ps1 @@ -262,7 +262,7 @@ finally { Write-Host "" Write-Host "Restoring WAF ACR configuration..." - $acrDefailtAction = az acr update ` + $acrDefaultAction = az acr update ` --name $ACR_NAME ` --resource-group $RESOURCE_GROUP ` --default-action Deny From 113ef2a6848848b4635907b9bdc0aa4e165f3500 Mon Sep 17 00:00:00 2001 From: chaudhariniraj Date: Wed, 8 Jul 2026 11:38:48 +0530 Subject: [PATCH 3/4] Update container registry code --- infra/modules/container-registry.bicep | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/modules/container-registry.bicep b/infra/modules/container-registry.bicep index 52ee5c2b..76fd1e37 100644 --- a/infra/modules/container-registry.bicep +++ b/infra/modules/container-registry.bicep @@ -10,9 +10,6 @@ param location string @description('Optional. SKU for the Azure Container Registry.') param acrSku string = 'Basic' -@description('Optional. Public network access setting for the Azure Container Registry.') -param publicNetworkAccess string = 'Enabled' - @description('Optional. Zone redundancy setting for the Azure Container Registry.') param zoneRedundancy string = 'Disabled' @@ -41,6 +38,9 @@ param backendSubnetResourceId string = '' @description('Optional. Private DNS zone resource ID for Container Registry.') param privateDnsZoneResourceId string = '' +@description('Optional. Public network access setting for the Azure Container Registry.') +param publicNetworkAccess string = enablePrivateNetworking? 'Disabled' : 'Enabled' + module avmContainerRegistry 'br/public:avm/res/container-registry/registry:0.12.1' = { name: acrName params: { From 88918f8fc9a69ec4eefdc407cebe00738c466fd7 Mon Sep 17 00:00:00 2001 From: chaudhariniraj Date: Wed, 8 Jul 2026 11:50:01 +0530 Subject: [PATCH 4/4] Resolve Copilot comment --- infra/modules/container-registry.bicep | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/modules/container-registry.bicep b/infra/modules/container-registry.bicep index 76fd1e37..55aa357c 100644 --- a/infra/modules/container-registry.bicep +++ b/infra/modules/container-registry.bicep @@ -39,7 +39,7 @@ param backendSubnetResourceId string = '' param privateDnsZoneResourceId string = '' @description('Optional. Public network access setting for the Azure Container Registry.') -param publicNetworkAccess string = enablePrivateNetworking? 'Disabled' : 'Enabled' +param publicNetworkAccess string = enablePrivateNetworking ? 'Disabled' : 'Enabled' module avmContainerRegistry 'br/public:avm/res/container-registry/registry:0.12.1' = { name: acrName