fix(azure): revert to using connection string for IDistributedCache Redis (#526)

arealmaas · web-flow · commit d19350d6b3f0 · 2024-03-11T09:56:30.000+01:00
It seems like we need to use a connection string to connect to the Redis library used by IDistributedCache. Until we can use managed identity, that is the case. dotnet/aspnetcore#54414
diff --git a/.azure/applications/web-api-eu/main.bicep b/.azure/applications/web-api-eu/main.bicep
@@ -14,9 +14,6 @@ param apimIp string
 param containerAppEnvironmentName string
 @minLength(3)
 @secure()
-param redisName string
-@minLength(3)
-@secure()
 param appInsightConnectionString string
 @minLength(5)
 @secure()
@@ -36,10 +33,6 @@ resource containerAppEnvironment 'Microsoft.App/managedEnvironments@2023-05-01'
   name: containerAppEnvironmentName
 }
 
-resource redis 'Microsoft.Cache/redis@2023-08-01' existing = {
-  name: redisName
-}
-
 var containerAppEnvVars = [
   {
     name: 'ASPNETCORE_ENVIRONMENT'
@@ -77,16 +70,6 @@ module containerApp '../../modules/containerApp/main.bicep' = {
   }
 }
 
-resource redisAccessPolicyAssignment 'Microsoft.Cache/redis/accessPolicyAssignments@2023-08-01' = {
-  parent: redis
-  name: containerAppName
-  properties: {
-    accessPolicyName: 'Data Contributor'
-    objectId: containerApp.outputs.identityPrincipalId
-    objectIdAlias: '${containerAppName}-access-policy-redis'
-  }
-}
-
 module keyVaultReaderAccessPolicy '../../modules/keyvault/addReaderRoles.bicep' = {
   name: 'keyVaultReaderAccessPolicy-${containerAppName}'
   params: {
diff --git a/.azure/applications/web-api-eu/staging.bicepparam b/.azure/applications/web-api-eu/staging.bicepparam
@@ -10,4 +10,3 @@ param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_N
 param containerAppEnvironmentName = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_NAME')
 param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING')
 param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME')
-param redisName = readEnvironmentVariable('REDIS_NAME')
diff --git a/.azure/applications/web-api-eu/test.bicepparam b/.azure/applications/web-api-eu/test.bicepparam
@@ -10,4 +10,3 @@ param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_N
 param containerAppEnvironmentName = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_NAME')
 param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING')
 param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME')
-param redisName = readEnvironmentVariable('REDIS_NAME')
diff --git a/.azure/applications/web-api-so/main.bicep b/.azure/applications/web-api-so/main.bicep
@@ -14,9 +14,6 @@ param apimIp string
 param containerAppEnvironmentName string
 @minLength(3)
 @secure()
-param redisName string
-@minLength(3)
-@secure()
 param appInsightConnectionString string
 @minLength(5)
 @secure()
@@ -36,10 +33,6 @@ resource containerAppEnvironment 'Microsoft.App/managedEnvironments@2023-05-01'
   name: containerAppEnvironmentName
 }
 
-resource redis 'Microsoft.Cache/redis@2023-08-01' existing = {
-  name: redisName
-}
-
 var containerAppEnvVars = [
   {
     name: 'ASPNETCORE_ENVIRONMENT'
@@ -81,16 +74,6 @@ module containerApp '../../modules/containerApp/main.bicep' = {
   }
 }
 
-resource redisAccessPolicyAssignment 'Microsoft.Cache/redis/accessPolicyAssignments@2023-08-01' = {
-  parent: redis
-  name: containerAppName
-  properties: {
-    accessPolicyName: 'Data Contributor'
-    objectId: containerApp.outputs.identityPrincipalId
-    objectIdAlias: '${containerAppName}-access-policy-redis'
-  }
-}
-
 module keyVaultReaderAccessPolicy '../../modules/keyvault/addReaderRoles.bicep' = {
   name: 'keyVaultReaderAccessPolicy-${containerAppName}'
   params: {
diff --git a/.azure/applications/web-api-so/staging.bicepparam b/.azure/applications/web-api-so/staging.bicepparam
@@ -10,4 +10,3 @@ param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_N
 param containerAppEnvironmentName = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_NAME')
 param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING')
 param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME')
-param redisName = readEnvironmentVariable('REDIS_NAME')
diff --git a/.azure/applications/web-api-so/test.bicepparam b/.azure/applications/web-api-so/test.bicepparam
@@ -10,4 +10,3 @@ param environmentKeyVaultName = readEnvironmentVariable('ENVIRONMENT_KEY_VAULT_N
 param containerAppEnvironmentName = readEnvironmentVariable('CONTAINER_APP_ENVIRONMENT_NAME')
 param appInsightConnectionString = readEnvironmentVariable('APP_INSIGHTS_CONNECTION_STRING')
 param appConfigurationName = readEnvironmentVariable('APP_CONFIGURATION_NAME')
-param redisName = readEnvironmentVariable('REDIS_NAME')
diff --git a/.azure/infrastructure/main.bicep b/.azure/infrastructure/main.bicep
@@ -196,13 +196,13 @@ module postgresConnectionStringAppConfig '../modules/appConfiguration/upsertKeyV
   }
 }
 
-module redisHostNameAppConfig '../modules/appConfiguration/upsertKeyValue.bicep' = {
+module redisConnectionStringAppConfig '../modules/appConfiguration/upsertKeyValue.bicep' = {
   scope: resourceGroup
-  name: 'AppConfig_Add_RedisHostName'
+  name: 'AppConfig_Add_DialogRedisConnectionString'
   params: {
     configStoreName: appConfiguration.outputs.name
-    key: 'Infrastructure:RedisHostName'
-    value: redis.outputs.hostNameKeyVaultUri
+    key: 'Infrastructure:DialogRedisConnectionString'
+    value: redis.outputs.connectionStringSecretUri
     keyValueType: 'keyVaultReference'
   }
 }
diff --git a/.azure/modules/redis/main.bicep b/.azure/modules/redis/main.bicep
@@ -32,14 +32,16 @@ resource redis 'Microsoft.Cache/Redis@2023-08-01' = {
   }
 }
 
-module redisHostName '../keyvault/upsertSecret.bicep' = {
-  name: 'redisHostName'
+// Until managed identity is supported in the Redis for IDistributedCache, we need to use a connection string
+// https://github.com/dotnet/aspnetcore/issues/54414
+module redisConnectionString '../keyvault/upsertSecret.bicep' = {
+  name: 'redisConnectionString'
   params: {
     destKeyVaultName: environmentKeyVaultName
-    secretName: 'dialogportenRedisHostName'
+    secretName: 'dialogportenRedisConnectionString'
     // disable public access? Use vnet here maybe?
-    secretValue: redis.properties.hostName
+    secretValue: 'redis://${redis.properties.hostName}:${redis.properties.port},password=${redis.properties.accessKeys.primaryKey},ssl=True,abortConnect=False'
   }
 }
 
-output hostNameKeyVaultUri string = redisHostName.outputs.secretUri
+output connectionStringSecretUri string = redisConnectionString.outputs.secretUri
diff --git a/.github/workflows/action-deploy-apps.yml b/.github/workflows/action-deploy-apps.yml
@@ -22,8 +22,6 @@ on:
         required: true
       AZURE_ADO_CONNECTION_STRING_SECRET_URI:
         required: true
-      AZURE_REDIS_NAME:
-        required: true
 
     inputs:
       region:
@@ -119,8 +117,6 @@ jobs:
     # needs: deploy-migration-job
     strategy:
       fail-fast: true
-      # to ensure that the bicep commands doesn't conflict with eachother, we need to set the max-parallel to 1
-      max-parallel: 1
       matrix:
         include:
           - name: web-api-eu
@@ -151,7 +147,6 @@ jobs:
           APP_INSIGHTS_CONNECTION_STRING: ${{ secrets.AZURE_APP_INSIGHTS_CONNECTION_STRING }}
           APP_CONFIGURATION_NAME: ${{ secrets.AZURE_APP_CONFIGURATION_NAME }}
           ENVIRONMENT_KEY_VAULT_NAME: ${{ secrets.AZURE_ENVIRONMENT_KEY_VAULT_NAME }}
-          REDIS_NAME: ${{ secrets.AZURE_REDIS_NAME }}
         with:
           scope: resourcegroup
           template: ./.azure/applications/${{ matrix.name }}/main.bicep
diff --git a/.github/workflows/ci-cd-main.yml b/.github/workflows/ci-cd-main.yml
@@ -103,7 +103,6 @@ jobs:
       AZURE_CONTAINER_APP_ENVIRONMENT_NAME: ${{ secrets.AZURE_CONTAINER_APP_ENVIRONMENT_NAME }}
       AZURE_APP_INSIGHTS_CONNECTION_STRING: ${{ secrets.AZURE_APP_INSIGHTS_CONNECTION_STRING }}
       AZURE_APP_CONFIGURATION_NAME: ${{ secrets.AZURE_APP_CONFIGURATION_NAME }}
-      AZURE_REDIS_NAME: ${{ secrets.AZURE_REDIS_NAME }}
     with:
       environment: test
       region: norwayeast
diff --git a/.github/workflows/ci-cd-pull-request-release-please.yml b/.github/workflows/ci-cd-pull-request-release-please.yml
@@ -58,7 +58,6 @@ jobs:
       AZURE_CONTAINER_APP_ENVIRONMENT_NAME: ${{ secrets.AZURE_CONTAINER_APP_ENVIRONMENT_NAME }}
       AZURE_APP_INSIGHTS_CONNECTION_STRING: ${{ secrets.AZURE_APP_INSIGHTS_CONNECTION_STRING }}
       AZURE_APP_CONFIGURATION_NAME: ${{ secrets.AZURE_APP_CONFIGURATION_NAME }}
-      AZURE_REDIS_NAME: ${{ secrets.AZURE_REDIS_NAME }}
     with:
       environment: staging
       region: norwayeast
diff --git a/.github/workflows/ci-cd-staging.yml b/.github/workflows/ci-cd-staging.yml
@@ -64,7 +64,6 @@ jobs:
       AZURE_CONTAINER_APP_ENVIRONMENT_NAME: ${{ secrets.AZURE_CONTAINER_APP_ENVIRONMENT_NAME }}
       AZURE_APP_INSIGHTS_CONNECTION_STRING: ${{ secrets.AZURE_APP_INSIGHTS_CONNECTION_STRING }}
       AZURE_APP_CONFIGURATION_NAME: ${{ secrets.AZURE_APP_CONFIGURATION_NAME }}
-      AZURE_REDIS_NAME: ${{ secrets.AZURE_REDIS_NAME }}
     with:
       environment: staging
       region: norwayeast

Original file line number	Diff line number	Diff line change
`@@ -196,13 +196,13 @@ module postgresConnectionStringAppConfig '../modules/appConfiguration/upsertKeyV`
`196`	`196`	`}`
`197`	`197`	`}`
`198`	`198`
`199`		`-module redisHostNameAppConfig '../modules/appConfiguration/upsertKeyValue.bicep' = {`
	`199`	`+module redisConnectionStringAppConfig '../modules/appConfiguration/upsertKeyValue.bicep' = {`
`200`	`200`	`scope: resourceGroup`
`201`		`- name: 'AppConfig_Add_RedisHostName'`
	`201`	`+ name: 'AppConfig_Add_DialogRedisConnectionString'`
`202`	`202`	`params: {`
`203`	`203`	`configStoreName: appConfiguration.outputs.name`
`204`		`- key: 'Infrastructure:RedisHostName'`
`205`		`- value: redis.outputs.hostNameKeyVaultUri`
	`204`	`+ key: 'Infrastructure:DialogRedisConnectionString'`
	`205`	`+ value: redis.outputs.connectionStringSecretUri`
`206`	`206`	`keyValueType: 'keyVaultReference'`
`207`	`207`	`}`
`208`	`208`	`}`
Original file line number	Diff line number	Diff line change
`@@ -32,14 +32,16 @@ resource redis 'Microsoft.Cache/Redis@2023-08-01' = {`
`32`	`32`	`}`
`33`	`33`	`}`
`34`	`34`
`35`		`-module redisHostName '../keyvault/upsertSecret.bicep' = {`
`36`		`- name: 'redisHostName'`
	`35`	`+// Until managed identity is supported in the Redis for IDistributedCache, we need to use a connection string`
	`36`	`+// https://github.com/dotnet/aspnetcore/issues/54414`
	`37`	`+module redisConnectionString '../keyvault/upsertSecret.bicep' = {`
	`38`	`+ name: 'redisConnectionString'`
`37`	`39`	`params: {`
`38`	`40`	`destKeyVaultName: environmentKeyVaultName`
`39`		`- secretName: 'dialogportenRedisHostName'`
	`41`	`+ secretName: 'dialogportenRedisConnectionString'`
`40`	`42`	`// disable public access? Use vnet here maybe?`
`41`		`- secretValue: redis.properties.hostName`
	`43`	`+ secretValue: 'redis://${redis.properties.hostName}:${redis.properties.port},password=${redis.properties.accessKeys.primaryKey},ssl=True,abortConnect=False'`
`42`	`44`	`}`
`43`	`45`	`}`
`44`	`46`
`45`		`-output hostNameKeyVaultUri string = redisHostName.outputs.secretUri`
	`47`	`+output connectionStringSecretUri string = redisConnectionString.outputs.secretUri`