feat: Restrict backend Container App to private access in WAF deployment#904
Open
Prajwal-Microsoft wants to merge 11 commits intodev-v4from
Open
feat: Restrict backend Container App to private access in WAF deployment#904Prajwal-Microsoft wants to merge 11 commits intodev-v4from
Prajwal-Microsoft wants to merge 11 commits intodev-v4from
Conversation
ci: refactor notification email templates
ci: update email subjects to include status icons
test: updated the testcases to the latest agent framework. Dev v4 to main
fix: Dev v4 to main merge
When enablePrivateNetworking (WAF mode) is active: - Set Container App Environment to internal with public access disabled - Set Container App ingress to internal (not externally accessible) - Frontend Python server proxies /api/* requests to backend over VNet - /config endpoint returns same-origin /api URL in WAF mode - Non-WAF deployments remain unchanged (direct public API access) Resolves AB#39249 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Prajwal-Microsoft
requested review from
Avijit-Microsoft,
Fr4nc3,
Roopan-Microsoft,
Vinay-Microsoft,
aniaroramsft,
dgp10801,
marktayl1,
nchandhi and
toherman-msft
as code owners
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
When
enablePrivateNetworking(WAF mode) is active, the backend Container App was still publicly accessible via external ingress. This PR restricts the backend to internal-only access while keeping the frontend Web App publicly reachable.Changes
Infrastructure (
infra/main.bicep&infra/main_custom.bicep):internal: trueandpublicNetworkAccess: 'Disabled'in WAF modeingressExternal: falsein WAF mode (internal-only)PROXY_API_REQUESTSenv var to enable server-side proxyingFrontend (
src/frontend/):frontend_server.py: Addedhttpx-based reverse proxy for/api/*routes in WAF mode./configendpoint returns same-origin/apiURL so browser calls frontend instead of backend directlyrequirements.txt: AddedhttpxdependencyArchitecture (WAF mode)
Non-WAF deployments are unchanged.
Resolves AB#39249
Does this introduce a breaking change?
How to Test
# Copy WAF params and deploy cp infra/main.waf.parameters.json infra/main.parameters.json azd upVerify:
https://app-{suffix}.azurewebsites.net-> 200 OK/configendpoint returns/api(same-origin) in WAF modeWhat to Check
Other Information
Related PRs: microsoft/customer-chatbot-solution-accelerator#173