Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

Harden deployer private networking and add optional AMPLS for Commercial and Government

Đang mở
  • Có gì không ổn?
#1,765 0 bình luận 0 reaction 1 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

@paullizer đang làm issue này rồi.

Từ ngày 14/10/2026.

Đánh giá

Issue này chưa được đánh giá.

Mô tả

bug enhancement P1 security_improvement

Summary

Close private-networking gaps in SimpleChat deployers and provide an administrator opt-in for Azure Monitor Private Link Scope (AMPLS) in Azure Commercial and Azure Government.

Original Gaps

  • Redis deployment does not create a private endpoint; Azure Managed Redis is explicitly left public even with private networking enabled.
  • Video Indexer private endpoints are associated with the generic Cognitive Services DNS zone instead of privatelink.api.videoindexer.ai in Commercial.
  • Application Insights and Log Analytics do not have an opt-in AMPLS deployment path.
  • Government Key Vault uses privatelink.vaultcore.azure.us instead of privatelink.vaultcore.usgovcloudapi.net.

Implemented Behavior

  • Create Redis private endpoints and correct cloud/offering-specific DNS when private networking is enabled. Preserve bootstrap access needed for deployment configuration, then close public access only after private connectivity is available.
  • Use a dedicated Video Indexer DNS zone only in clouds/API profiles that support its private endpoint.
  • Add a default-off deployment option for AMPLS, requiring private networking. Connect deployed Application Insights and Log Analytics, create one AMPLS private endpoint, and configure Commercial or Government DNS zones with existing-zone reuse support.
  • Document subnet sizing, DNS forwarding, deployment-runner connectivity, and the effect of private-only monitoring on other resources sharing DNS.

Acceptance Criteria

  • Managed and classic Redis private endpoints use the correct resource type, group ID, and DNS zones; public deployments remain unchanged.
  • Commercial Video Indexer uses privatelink.api.videoindexer.ai; unsupported Government private-endpoint creation remains disabled.
  • Government Key Vault DNS is corrected in each supported deployer.
  • Administrators can opt into AMPLS in either cloud; default-off and invalid combinations are covered.
  • AMPLS connects Application Insights and Log Analytics, supports correct cloud DNS and existing-zone reuse, and accounts for multiple private IPs.
  • Focused regression tests and IaC validation pass; docs and deployer version are updated.

Notes

Primary areas: deployers/bicep/main.bicep, modules/privateNetworking.bicep, modules/privateDNSZones.json, modules/redisCache.bicep, AZD parameter and lifecycle wiring; equivalent Terraform/Azure CLI surfaces as applicable.
Microsoft DNS reference: https://learn.microsoft.com/azure/private-link/private-endpoint-dns
AMPLS reference: https://learn.microsoft.com/azure/azure-monitor/fundamentals/private-link-configure
Priority: P1. Size: L. Assignee: paullizer.

Implementation Update

Implementation is committed and ready for review in PR #1767: https://github.com/microsoft/simplechat/pull/1767

  • Head: paullizer/private-networking-ampls-1765; base: paullizer-react-v2-ui. Only the feature branch was pushed. The base branch was not directly pushed or merged.
  • Commit: https://github.com/microsoft/simplechat/commit/62d4b0210c2e052d7903c8f56e2ef3685e1bdc1c
  • Application version 0.261.333; deployer 1.0.34.
  • Redis private endpoints and final AZD lockdown implemented, Commercial Video Indexer DNS corrected, and Government Key Vault DNS corrected across deployers.
  • Optional AMPLS added for both clouds in Bicep/AZD, Terraform, and CLI. Default off, with private-only monitoring, per-zone reuse, shared Blob DNS, and separate Government overflow-zone handling.
  • Updated both Visio files in artifacts/, covering ACR, Key Vault, platform subnet, compact subnet sizing, monitoring DNS, and cloud-specific service/Redis labels. Added a diagram companion and Commercial/Government fresh deployment versus compact existing-network tables.
  • Release notes include the implementation and the wider Visio updates. Regenerated previously stale release pages without losing any of the 304 historical version sections.
Validation
  • 19 focused tests passed across private DNS/AMPLS wiring, Video Indexer region/permissions, and AZD runner-IP prerequisites.
  • Bicep compiles and both generated ARM templates match fresh builds.
  • Terraform 1.12.2 validation and networking formatting passed using locked providers and no backend.
  • CLI and all four Windows AZD hooks parse; mocked CLI tests cover failure/success sequencing and existing endpoint DNS reconciliation.
  • Documentation coverage 7/7 and site-quality checks 6/6 passed.
  • Release-note integrity confirms all 304 sections; generator freshness and staged whitespace checks passed.
Remaining Review And Deployment Checks
  • No live Azure deployment was performed. Validate private DNS, Redis connectivity, monitoring ingestion, and queries in the intended cloud.
  • Government's Visio page still contains the Commercial Video Indexer private-zone label. Review/correct that diagram label; the Government API profile intentionally does not provision a Video Indexer PE.
  • Separate azd provision / azd deploy workflows require equivalent final Redis lockdown because they do not run postup; reprovisioning reopens Managed Redis bootstrap access until lockdown runs again.
  • The compact five-subnet enterprise reference requires explicit endpoint placement/customization; existing-VNet reuse still supplies one shared PE subnet.

This issue remains open pending PR review and deployment validation.

Ngôn ngữ chính
Python
Star
157
Fork
117
Merge trung bình
3 giờ 31 phút
Pull request đã merge (30 ngày)
226

Chuẩn bị môi trường

Mở trong Codespaces

Khởi chạy dev container của dự án ngay trên trình duyệt, bằng tài khoản GitHub của bạn.

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của microsoft/simplechat

Tất cả issue của microsoft/simplechat

Issue tương tự

Thêm issue về Python

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.