Skip to content

Commit 00a3917

Browse files
Avijit-MicrosoftAvijit-Microsoft
authored
fix: MACAE v4 post-deployment script network access restoration
2 parents 4b2e0bd + 1b1feb9 commit 00a3917

File tree

5 files changed

+480
-94
lines changed

5 files changed

+480
-94
lines changed

‎infra/main.bicep‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,7 @@ resource resourceGroupTags 'Microsoft.Resources/tags@2021-04-01' = {
241241
Type: enablePrivateNetworking ? 'WAF' : 'Non-WAF'
242242
CreatedBy: createdBy
243243
DeploymentName: deployment().name
244+
SolutionSuffix: solutionSuffix
244245
}
245246
}
246247
}

‎infra/main_custom.bicep‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,7 @@ resource resourceGroupTags 'Microsoft.Resources/tags@2021-04-01' = {
239239
Type: enablePrivateNetworking ? 'WAF' : 'Non-WAF'
240240
CreatedBy: createdBy
241241
DeploymentName: deployment().name
242+
SolutionSuffix: solutionSuffix
242243
}
243244
}
244245
}

‎infra/scripts/Selecting-Team-Config-And-Data.ps1‎

Lines changed: 232 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,72 @@ $aiSearchIndexForContractSummary = ""
2626
$aiSearchIndexForContractRisk = ""
2727
$aiSearchIndexForContractCompliance = ""
2828
$azSubscriptionId = ""
29+
$stIsPublicAccessDisabled = $false
30+
$srchIsPublicAccessDisabled = $false
31+
32+
# Cleanup function to restore network access
33+
function Restore-NetworkAccess {
34+
if ($script:ResourceGroup -and $script:storageAccount -and $script:aiSearch) {
35+
# Check resource group tag
36+
$rgTypeTag = (az group show --name $script:ResourceGroup --query "tags.Type" -o tsv 2>$null)
37+
38+
if ($rgTypeTag -eq "WAF") {
39+
if ($script:stIsPublicAccessDisabled -eq $true -or $script:srchIsPublicAccessDisabled -eq $true) {
40+
Write-Host "=== Restoring network access settings ==="
41+
}
42+
43+
if ($script:stIsPublicAccessDisabled -eq $true) {
44+
$currentAccess = $(az storage account show --name $script:storageAccount --resource-group $script:ResourceGroup --query "publicNetworkAccess" -o tsv 2>$null)
45+
if ($currentAccess -eq "Enabled") {
46+
Write-Host "Disabling public access for Storage Account: $($script:storageAccount)"
47+
az storage account update --name $script:storageAccount --public-network-access disabled --default-action Deny --output none 2>$null
48+
Write-Host "✓ Storage Account public access disabled"
49+
} else {
50+
Write-Host "✓ Storage Account access unchanged (already at desired state)"
51+
}
52+
} else {
53+
if ($script:ResourceGroup) {
54+
$checkTag = (az group show --name $script:ResourceGroup --query "tags.Type" -o tsv 2>$null)
55+
if ($checkTag -eq "WAF") {
56+
if ($script:stIsPublicAccessDisabled -eq $false -and $script:srchIsPublicAccessDisabled -eq $false) {
57+
Write-Host "=== Restoring network access settings ==="
58+
}
59+
Write-Host "✓ Storage Account access unchanged (already at desired state)"
60+
}
61+
}
62+
}
63+
64+
if ($script:srchIsPublicAccessDisabled -eq $true) {
65+
$currentAccess = $(az search service show --name $script:aiSearch --resource-group $script:ResourceGroup --query "publicNetworkAccess" -o tsv 2>$null)
66+
if ($currentAccess -eq "Enabled") {
67+
Write-Host "Disabling public access for AI Search Service: $($script:aiSearch)"
68+
az search service update --name $script:aiSearch --resource-group $script:ResourceGroup --public-network-access disabled --output none 2>$null
69+
Write-Host "✓ AI Search Service public access disabled"
70+
} else {
71+
Write-Host "✓ AI Search Service access unchanged (already at desired state)"
72+
}
73+
} else {
74+
if ($script:ResourceGroup) {
75+
$checkTag = (az group show --name $script:ResourceGroup --query "tags.Type" -o tsv 2>$null)
76+
if ($checkTag -eq "WAF") {
77+
Write-Host "✓ AI Search Service access unchanged (already at desired state)"
78+
}
79+
}
80+
}
81+
82+
if ($script:stIsPublicAccessDisabled -eq $true -or $script:srchIsPublicAccessDisabled -eq $true) {
83+
Write-Host "=========================================="
84+
} else {
85+
if ($script:ResourceGroup) {
86+
$checkTag = (az group show --name $script:ResourceGroup --query "tags.Type" -o tsv 2>$null)
87+
if ($checkTag -eq "WAF") {
88+
Write-Host "=========================================="
89+
}
90+
}
91+
}
92+
}
93+
}
94+
}
2995

3096
function Test-AzdInstalled {
3197
try {
@@ -148,6 +214,72 @@ function Get-ValuesFromAzDeployment {
148214
return $true
149215
}
150216

217+
function Get-ValuesUsingSolutionSuffix {
218+
Write-Host "Getting values from resource naming convention using solution suffix..."
219+
220+
# Get the solution suffix from resource group tags
221+
$solutionSuffix = az group show --name $ResourceGroup --query "tags.SolutionSuffix" -o tsv
222+
if (-not $solutionSuffix) {
223+
Write-Host "Error: Could not find SolutionSuffix tag in resource group."
224+
return $false
225+
}
226+
227+
Write-Host "Found solution suffix: $solutionSuffix"
228+
229+
# Reconstruct resource names using same naming convention as Bicep
230+
$script:storageAccount = "st$solutionSuffix" -replace '-', '' # Remove dashes like Bicep does
231+
$script:aiSearch = "srch-$solutionSuffix"
232+
$containerAppName = "ca-$solutionSuffix"
233+
234+
# Query dynamic value (backend URL) from Container App
235+
Write-Host "Querying backend URL from Container App..."
236+
$backendFqdn = az containerapp show `
237+
--name $containerAppName `
238+
--resource-group $ResourceGroup `
239+
--query "properties.configuration.ingress.fqdn" `
240+
-o tsv 2>$null
241+
242+
if (-not $backendFqdn) {
243+
Write-Host "Error: Could not get Container App FQDN. Container App may not be deployed yet."
244+
return $false
245+
}
246+
247+
$script:backendUrl = "https://$backendFqdn"
248+
249+
# Hardcoded container names (These don't follow the suffix pattern in Bicep, hence need to be changed here if changed in Bicep)
250+
$script:blobContainerForRetailCustomer = "retail-dataset-customer"
251+
$script:blobContainerForRetailOrder = "retail-dataset-order"
252+
$script:blobContainerForRFPSummary = "rfp-summary-dataset"
253+
$script:blobContainerForRFPRisk = "rfp-risk-dataset"
254+
$script:blobContainerForRFPCompliance = "rfp-compliance-dataset"
255+
$script:blobContainerForContractSummary = "contract-summary-dataset"
256+
$script:blobContainerForContractRisk = "contract-risk-dataset"
257+
$script:blobContainerForContractCompliance = "contract-compliance-dataset"
258+
259+
# Hardcoded index names (These don't follow the suffix pattern in Bicep, hence need to be changed here if changed in Bicep)
260+
$script:aiSearchIndexForRetailCustomer = "macae-retail-customer-index"
261+
$script:aiSearchIndexForRetailOrder = "macae-retail-order-index"
262+
$script:aiSearchIndexForRFPSummary = "macae-rfp-summary-index"
263+
$script:aiSearchIndexForRFPRisk = "macae-rfp-risk-index"
264+
$script:aiSearchIndexForRFPCompliance = "macae-rfp-compliance-index"
265+
$script:aiSearchIndexForContractSummary = "contract-summary-doc-index"
266+
$script:aiSearchIndexForContractRisk = "contract-risk-doc-index"
267+
$script:aiSearchIndexForContractCompliance = "contract-compliance-doc-index"
268+
269+
$script:directoryPath = "data/agent_teams"
270+
271+
# Validate that we got all critical values
272+
if (-not $script:storageAccount -or -not $script:aiSearch -or -not $script:backendUrl) {
273+
Write-Host "Error: Failed to reconstruct all required resource names."
274+
return $false
275+
}
276+
277+
Write-Host "Successfully reconstructed values from resource naming convention."
278+
return $true
279+
}
280+
281+
# Main script execution with cleanup handling
282+
try {
151283
# Authenticate with Azure
152284
try {
153285
$null = az account show 2>$null
@@ -233,12 +365,23 @@ if (-not $ResourceGroup) {
233365
exit 1
234366
}
235367
} else {
236-
# Resource group provided - use deployment outputs
368+
# Resource group provided - try deployment outputs first, then fallback to naming convention
237369
Write-Host "Resource group provided: $ResourceGroup"
238370

239371
if (-not (Get-ValuesFromAzDeployment)) {
240-
Write-Host "Failed to get values from deployment outputs."
241-
exit 1
372+
Write-Host ""
373+
Write-Host "Warning: Could not retrieve values from deployment outputs (deployment may be deleted)."
374+
Write-Host "Attempting fallback method: reconstructing values from resource naming convention..."
375+
Write-Host ""
376+
377+
if (-not (Get-ValuesUsingSolutionSuffix)) {
378+
Write-Host ""
379+
Write-Host "Error: Both methods failed to retrieve configuration values."
380+
Write-Host "Please ensure:"
381+
Write-Host " 1. The deployment exists and has a DeploymentName tag, OR"
382+
Write-Host " 2. The resource group has a SolutionSuffix tag"
383+
exit 1
384+
}
242385
}
243386
}
244387

@@ -425,32 +568,90 @@ $srchIsPublicAccessDisabled = $false
425568
# Enable public access for resources
426569
if($useCaseSelection -eq "1"-or $useCaseSelection -eq "2" -or $useCaseSelection -eq "5" -or $useCaseSelection -eq "all" -or $useCaseSelection -eq "6"){
427570
if ($ResourceGroup) {
428-
$stPublicAccess = $(az storage account show --name $storageAccount --resource-group $ResourceGroup --query "publicNetworkAccess" -o tsv)
429-
if ($stPublicAccess -eq "Disabled") {
430-
$stIsPublicAccessDisabled = $true
431-
Write-Host "Enabling public access for storage account: $storageAccount"
432-
az storage account update --name $storageAccount --public-network-access enabled --default-action Allow --output none
433-
if ($LASTEXITCODE -ne 0) {
434-
Write-Host "Error: Failed to enable public access for storage account."
435-
exit 1
571+
# Check if resource group has Type=WAF tag
572+
$rgTypeTag = (az group show --name $ResourceGroup --query "tags.Type" -o tsv 2>$null)
573+
574+
if ($rgTypeTag -eq "WAF") {
575+
Write-Host ""
576+
Write-Host "=== Temporarily enabling public network access for services ==="
577+
$stPublicAccess = $(az storage account show --name $storageAccount --resource-group $ResourceGroup --query "publicNetworkAccess" -o tsv)
578+
if ($stPublicAccess -eq "Disabled") {
579+
$stIsPublicAccessDisabled = $true
580+
Write-Host "Enabling public access for Storage Account: $storageAccount"
581+
az storage account update --name $storageAccount --public-network-access enabled --default-action Allow --output none
582+
if ($LASTEXITCODE -ne 0) {
583+
Write-Host "Error: Failed to enable public access for storage account."
584+
exit 1
585+
}
586+
587+
# Wait 30 seconds for the change to propagate
588+
Write-Host "Waiting 30 seconds for public access to be enabled..."
589+
Start-Sleep -Seconds 30
590+
591+
# Verify public access is enabled in a loop
592+
Write-Host "Verifying public access is enabled..."
593+
$maxRetries = 10
594+
$retryCount = 0
595+
while ($retryCount -lt $maxRetries) {
596+
$currentAccess = $(az storage account show --name $storageAccount --resource-group $ResourceGroup --query "publicNetworkAccess" -o tsv)
597+
if ($currentAccess -eq "Enabled") {
598+
Write-Host "✓ Storage Account public access enabled successfully"
599+
break
600+
} else {
601+
Write-Host "Public access not yet enabled (attempt $($retryCount + 1)/$maxRetries). Waiting 5 seconds..."
602+
Start-Sleep -Seconds 5
603+
$retryCount++
604+
}
605+
}
606+
607+
if ($retryCount -eq $maxRetries) {
608+
Write-Host "Warning: Public access verification timed out for storage account."
609+
}
610+
} else {
611+
Write-Host "✓ Storage Account public access already enabled"
436612
}
437613
}
438-
else {
439-
Write-Host "Public access is already enabled for storage account: $storageAccount"
440-
}
441614

442-
$srchPublicAccess = $(az search service show --name $aiSearch --resource-group $ResourceGroup --query "publicNetworkAccess" -o tsv)
443-
if ($srchPublicAccess -eq "Disabled") {
444-
$srchIsPublicAccessDisabled = $true
445-
Write-Host "Enabling public access for search service: $aiSearch"
446-
az search service update --name $aiSearch --resource-group $ResourceGroup --public-network-access enabled --output none
447-
if ($LASTEXITCODE -ne 0) {
448-
Write-Host "Error: Failed to enable public access for search service."
449-
exit 1
615+
if ($rgTypeTag -eq "WAF") {
616+
$srchPublicAccess = $(az search service show --name $aiSearch --resource-group $ResourceGroup --query "publicNetworkAccess" -o tsv)
617+
if ($srchPublicAccess -eq "Disabled") {
618+
$srchIsPublicAccessDisabled = $true
619+
Write-Host "Enabling public access for AI Search Service: $aiSearch"
620+
az search service update --name $aiSearch --resource-group $ResourceGroup --public-network-access enabled --output none
621+
if ($LASTEXITCODE -ne 0) {
622+
Write-Host "Error: Failed to enable public access for search service."
623+
exit 1
624+
}
625+
Write-Host "Public access enabled"
626+
627+
# Wait 30 seconds for the change to propagate
628+
Write-Host "Waiting 30 seconds for public access to be enabled..."
629+
Start-Sleep -Seconds 30
630+
631+
# Verify public access is enabled in a loop
632+
Write-Host "Verifying public access is enabled..."
633+
$maxRetries = 10
634+
$retryCount = 0
635+
while ($retryCount -lt $maxRetries) {
636+
$currentAccess = $(az search service show --name $aiSearch --resource-group $ResourceGroup --query "publicNetworkAccess" -o tsv)
637+
if ($currentAccess -eq "Enabled") {
638+
Write-Host "✓ AI Search Service public access enabled successfully"
639+
break
640+
} else {
641+
Write-Host "Public access not yet enabled (attempt $($retryCount + 1)/$maxRetries). Waiting 5 seconds..."
642+
Start-Sleep -Seconds 5
643+
$retryCount++
644+
}
645+
}
646+
647+
if ($retryCount -eq $maxRetries) {
648+
Write-Host "Warning: Public access verification timed out for search service."
649+
}
650+
} else {
651+
Write-Host "✓ AI Search Service public access already enabled"
450652
}
451-
}
452-
else {
453-
Write-Host "Public access is already enabled for search service: $AiSearch"
653+
Write-Host "==========================================================="
654+
Write-Host ""
454655
}
455656
}
456657
}
@@ -661,28 +862,6 @@ if($useCaseSelection -eq "2" -or $useCaseSelection -eq "all" -or $useCaseSelecti
661862
Write-Host "Python script to index data for Retail Customer Satisfaction successfully executed."
662863
}
663864

664-
665-
#disable public access for resources
666-
if ($stIsPublicAccessDisabled) {
667-
Write-Host "Disabling public access for storage account: $StorageAccount"
668-
az storage account update --name $StorageAccount --public-network-access disabled --default-action Deny --output none
669-
if ($LASTEXITCODE -ne 0) {
670-
Write-Host "Error: Failed to disable public access for storage account."
671-
exit 1
672-
}
673-
}
674-
675-
if ($srchIsPublicAccessDisabled) {
676-
Write-Host "Disabling public access for search service: $AiSearch"
677-
az search service update --name $AiSearch --resource-group $ResourceGroup --public-network-access disabled --output none
678-
if ($LASTEXITCODE -ne 0) {
679-
Write-Host "Error: Failed to disable public access for search service."
680-
exit 1
681-
}
682-
}
683-
684-
Write-Host "Script executed successfully. Sample Data Processed Successfully."
685-
686865
if ($isTeamConfigFailed -or $isSampleDataFailed) {
687866
Write-Host "`nOne or more tasks failed. Please check the error messages above."
688867
exit 1
@@ -694,3 +873,9 @@ if ($isTeamConfigFailed -or $isSampleDataFailed) {
694873
}
695874

696875
}
876+
877+
} finally {
878+
# Cleanup: Restore network access
879+
Write-Host ""
880+
Restore-NetworkAccess
881+
}

0 commit comments

Comments
 (0)