Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Harden deployer private networking and add optional AMPLS for Commercial and Government

Aperta
  • Qualcosa non va?
#1,765 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@paullizer ci sta già lavorando.

Dal 14/10/2026.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

bug enhancement P1 security_improvement

Summary

Close private-networking gaps in SimpleChat deployers and provide an administrator opt-in for Azure Monitor Private Link Scope (AMPLS) in Azure Commercial and Azure Government.

Original Gaps

  • Redis deployment does not create a private endpoint; Azure Managed Redis is explicitly left public even with private networking enabled.
  • Video Indexer private endpoints are associated with the generic Cognitive Services DNS zone instead of privatelink.api.videoindexer.ai in Commercial.
  • Application Insights and Log Analytics do not have an opt-in AMPLS deployment path.
  • Government Key Vault uses privatelink.vaultcore.azure.us instead of privatelink.vaultcore.usgovcloudapi.net.

Implemented Behavior

  • Create Redis private endpoints and correct cloud/offering-specific DNS when private networking is enabled. Preserve bootstrap access needed for deployment configuration, then close public access only after private connectivity is available.
  • Use a dedicated Video Indexer DNS zone only in clouds/API profiles that support its private endpoint.
  • Add a default-off deployment option for AMPLS, requiring private networking. Connect deployed Application Insights and Log Analytics, create one AMPLS private endpoint, and configure Commercial or Government DNS zones with existing-zone reuse support.
  • Document subnet sizing, DNS forwarding, deployment-runner connectivity, and the effect of private-only monitoring on other resources sharing DNS.

Acceptance Criteria

  • Managed and classic Redis private endpoints use the correct resource type, group ID, and DNS zones; public deployments remain unchanged.
  • Commercial Video Indexer uses privatelink.api.videoindexer.ai; unsupported Government private-endpoint creation remains disabled.
  • Government Key Vault DNS is corrected in each supported deployer.
  • Administrators can opt into AMPLS in either cloud; default-off and invalid combinations are covered.
  • AMPLS connects Application Insights and Log Analytics, supports correct cloud DNS and existing-zone reuse, and accounts for multiple private IPs.
  • Focused regression tests and IaC validation pass; docs and deployer version are updated.

Notes

Primary areas: deployers/bicep/main.bicep, modules/privateNetworking.bicep, modules/privateDNSZones.json, modules/redisCache.bicep, AZD parameter and lifecycle wiring; equivalent Terraform/Azure CLI surfaces as applicable.
Microsoft DNS reference: https://learn.microsoft.com/azure/private-link/private-endpoint-dns
AMPLS reference: https://learn.microsoft.com/azure/azure-monitor/fundamentals/private-link-configure
Priority: P1. Size: L. Assignee: paullizer.

Implementation Update

Implementation is committed and ready for review in PR #1767: https://github.com/microsoft/simplechat/pull/1767

  • Head: paullizer/private-networking-ampls-1765; base: paullizer-react-v2-ui. Only the feature branch was pushed. The base branch was not directly pushed or merged.
  • Commit: https://github.com/microsoft/simplechat/commit/62d4b0210c2e052d7903c8f56e2ef3685e1bdc1c
  • Application version 0.261.333; deployer 1.0.34.
  • Redis private endpoints and final AZD lockdown implemented, Commercial Video Indexer DNS corrected, and Government Key Vault DNS corrected across deployers.
  • Optional AMPLS added for both clouds in Bicep/AZD, Terraform, and CLI. Default off, with private-only monitoring, per-zone reuse, shared Blob DNS, and separate Government overflow-zone handling.
  • Updated both Visio files in artifacts/, covering ACR, Key Vault, platform subnet, compact subnet sizing, monitoring DNS, and cloud-specific service/Redis labels. Added a diagram companion and Commercial/Government fresh deployment versus compact existing-network tables.
  • Release notes include the implementation and the wider Visio updates. Regenerated previously stale release pages without losing any of the 304 historical version sections.
Validation
  • 19 focused tests passed across private DNS/AMPLS wiring, Video Indexer region/permissions, and AZD runner-IP prerequisites.
  • Bicep compiles and both generated ARM templates match fresh builds.
  • Terraform 1.12.2 validation and networking formatting passed using locked providers and no backend.
  • CLI and all four Windows AZD hooks parse; mocked CLI tests cover failure/success sequencing and existing endpoint DNS reconciliation.
  • Documentation coverage 7/7 and site-quality checks 6/6 passed.
  • Release-note integrity confirms all 304 sections; generator freshness and staged whitespace checks passed.
Remaining Review And Deployment Checks
  • No live Azure deployment was performed. Validate private DNS, Redis connectivity, monitoring ingestion, and queries in the intended cloud.
  • Government's Visio page still contains the Commercial Video Indexer private-zone label. Review/correct that diagram label; the Government API profile intentionally does not provision a Video Indexer PE.
  • Separate azd provision / azd deploy workflows require equivalent final Redis lockdown because they do not run postup; reprovisioning reopens Managed Redis bootstrap access until lockdown runs again.
  • The compact five-subnet enterprise reference requires explicit endpoint placement/customization; existing-VNet reuse still supplies one shared PE subnet.

This issue remains open pending PR review and deployment validation.

Lingua principale
Python
Stelle
155
Fork
116
Merge medio
5h 3m
PR unite (30g)
206

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoft/simplechat

Tutte le issue di microsoft/simplechat

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.