Provisioning infra and deploying aspire app with VNET's

[wolkowsky]

Hi,
Sorry if this isn't correct repo to ask these questions.

I'd like to build an application using aspire, I got certain requirements and one of them is to hide all the resources like KeyVault or Storage in Azure VNET.

Is it achievable to create all these resources without running azd infra synth to generate the bicep for me and then add the missing bits like VNET? Or this is the only way I can achieve it (obviously other than crafting the entire bicep by myself:))?

Also, another question:
How should I approach things that could easily be shared like Azure App Configuration or things that do not relate directly to the application eg Azure Front Door?

[rajeshkamal5050]

Currently azd infra synth and modifications for adding VNET's is how you can achieve this. I believe there is an issue under Aspire https://github.com/dotnet/aspire/issues/ for the same.

cc @davidfowl @mitchdenny @vhvb1989 @ellismg

[davidfowl]

It is not right now. It's an area we plan to tackle in the future, but there are some other platform level work we need to address before we can make this possible.

[DiaAWAY]

While that works, is there a way that I can use custom bicep templates to sort of "append" the vnet configuration to the container app environment?
The AddBicepTemplate would have to modify resources.bicep in infra folder, since currently you cannot attach an existing container app environment to vnet (apparently that is being worked on, see; microsoft/azure-container-apps#851).

It would be nice to be able to run azd infra synth and not have to go through main.bicep, main.parameters.json and resources.bicep and ensure that my custom modifications do not get overwritten.

Its not a big deal since this is something we would do rarely, but would be nice.

[davidfowl]

We don't have a story for this yet and we've been trying to avoid hacking too many short term solutions (AKA hacks 😄) to unblock people. We want to enable what you want but it will take some time to get there. We're still trying to fully model and represent what we expose today let alone supporting new constructs.

[AishRoy-gif]

It's possible to create those resources without relying entirely on azd infra synth to generate Bicep templates. However, at the moment, modifying the auto-generated templates to append VNET configurations seems to be the most practical approach, especially if you're looking to integrate Key Vault, Storage, or other services into a VNET. While crafting the entire Bicep from scratch is an option, using azd infra synth and adding the necessary VNET configuration is generally quicker.
That said, a feature to directly integrate custom Bicep templates is still in development, as there’s ongoing work to improve the flexibility of adding VNETs and other configurations without altering existing resources.bicep files manually. It's something Azure plans to tackle in future updates.
For shared services like Azure App Configuration or Azure Front Door, it’s best to keep them outside the specific VNET setup since they often need broader access and could be shared across multiple applications. You can segregate these resources logically by using resource groups or tags to differentiate application-specific resources from shared services.
If you're running into specific configuration challenges, I'd recommend reaching out to Azure Support. They can provide technical guidance on integrating VNETs into your environment and ensure that your modifications don’t impact your infrastructure’s stability. Plus, they can offer proactive support on best practices for managing shared resources across multiple environments.