@@ -112,7 +112,7 @@ param backendContainerRegistryHostname string = 'kmcontainerreg.azurecr.io'
112112param backendContainerImageName string = 'km-api'
113113
114114@description ('Optional. The Container Image Tag to deploy on the backend.' )
115- param backendContainerImageTag string = 'latest_waf_2025-09-18_898 '
115+ param backendContainerImageTag string = 'latest_waf_2025-12-02_1084 '
116116
117117@description ('Optional. The Container Registry hostname where the docker images for the frontend are located.' )
118118param frontendContainerRegistryHostname string = 'kmcontainerreg.azurecr.io'
@@ -121,7 +121,7 @@ param frontendContainerRegistryHostname string = 'kmcontainerreg.azurecr.io'
121121param frontendContainerImageName string = 'km-app'
122122
123123@description ('Optional. The Container Image Tag to deploy on the frontend.' )
124- param frontendContainerImageTag string = 'latest_waf_2025-09-18_898 '
124+ param frontendContainerImageTag string = 'latest_waf_2025-12-02_1084 '
125125
126126@description ('Optional. The tags to apply to all deployed Azure resources.' )
127127param tags resourceInput <'Microsoft.Resources/resourceGroups@2025-04-01' >.tags = {}
@@ -217,25 +217,21 @@ var logAnalyticsWorkspaceResourceId = useExistingLogAnalytics
217217resource resourceGroupTags 'Microsoft.Resources/tags@2025-04-01' = {
218218 name : 'default'
219219 properties : {
220- tags : union (
221- reference (
222- resourceGroup ().id ,
223- '2021-04-01' ,
224- 'Full'
225- ).tags ?? {},
226- {
227- TemplateName : 'KM-Generic'
228- Type : enablePrivateNetworking ? 'WAF' : 'Non-WAF'
229- CreatedBy : createdBy
230- },
231- tags
232- )
220+ tags :{
221+ ...resourceGroup ().tags
222+ TemplateName : 'KM-Generic'
223+ Type : enablePrivateNetworking ? 'WAF' : 'Non-WAF'
224+ CreatedBy : createdBy
225+ DeploymentName : deployment ().name
226+ UseCase : usecase
227+ ...tags
228+ }
233229 }
234230}
235231
236232#disable-next-line no-deployments-resources
237233resource avmTelemetry 'Microsoft.Resources/deployments@2024-03-01' = if (enableTelemetry ) {
238- name : '46d3xbcp.ptn.sa-multiagentcustauteng .${replace ('-..--..-' , '.' , '-' )}.${substring (uniqueString (deployment ().name , location ), 0 , 4 )}'
234+ name : '46d3xbcp.ptn.sa-convknowledgemining .${replace ('-..--..-' , '.' , '-' )}.${substring (uniqueString (deployment ().name , location ), 0 , 4 )}'
239235 properties : {
240236 mode : 'Incremental'
241237 template : {
@@ -392,9 +388,9 @@ module jumpboxVM 'br/public:avm/res/compute/virtual-machine:0.21.0' = if (enable
392388 tags : tags
393389 availabilityZone : -1
394390 imageReference : {
395- offer : 'WindowsServer '
396- publisher : 'MicrosoftWindowsServer '
397- sku : '2019-datacenter '
391+ publisher : 'microsoft-dsvm '
392+ offer : 'dsvm-win-2022 '
393+ sku : 'winserver-2022 '
398394 version : 'latest'
399395 }
400396 osType : 'Windows'
@@ -748,6 +744,7 @@ module searchSearchServices 'br/public:avm/res/search/search-service:0.12.0' = {
748744 params : {
749745 // Required parameters
750746 name : aiSearchName
747+ enableTelemetry : enableTelemetry
751748 diagnosticSettings : enableMonitoring ? [
752749 {
753750 workspaceResourceId : logAnalyticsWorkspaceResourceId
@@ -848,10 +845,6 @@ resource projectAISearchConnection 'Microsoft.CognitiveServices/accounts/project
848845 location : searchSearchServices .outputs .location
849846 }
850847 }
851- dependsOn : [
852- aiFoundryAiServices
853- searchSearchServices
854- ]
855848}
856849
857850module existing_AIProject_SearchConnectionModule 'modules/deploy_aifp_aisearch_connection.bicep' = if (useExistingAiFoundryAiProject ) {
@@ -914,11 +907,11 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.31.0' = {
914907 ]
915908 networkAcls : {
916909 bypass : 'AzureServices, Logging, Metrics'
917- defaultAction : 'Allow'
910+ defaultAction : enablePrivateNetworking ? 'Deny' : 'Allow'
918911 virtualNetworkRules : []
919912 }
920913 allowSharedKeyAccess : true
921- allowBlobPublicAccess : true
914+ allowBlobPublicAccess : false
922915 publicNetworkAccess : enablePrivateNetworking ? 'Disabled' : 'Enabled'
923916 privateEndpoints : enablePrivateNetworking
924917 ? [
@@ -1018,6 +1011,18 @@ module cosmosDb 'br/public:avm/res/document-db/database-account:0.18.0' = {
10181011 ]
10191012 }
10201013 ]
1014+ sqlRoleDefinitions : [
1015+ {
1016+ // Cosmos DB Built-in Data Contributor: https://docs.azure.cn/en-us/cosmos-db/nosql/security/reference-data-plane-roles#cosmos-db-built-in-data-contributor
1017+ roleName : 'Cosmos DB SQL Data Contributor'
1018+ dataActions : [
1019+ 'Microsoft.DocumentDB/databaseAccounts/readMetadata'
1020+ 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*'
1021+ 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*'
1022+ ]
1023+ assignments : [{ principalId : backendUserAssignedIdentity .outputs .principalId }]
1024+ }
1025+ ]
10211026 // WAF aligned configuration for Monitoring
10221027 diagnosticSettings : enableMonitoring ? [{ workspaceResourceId : logAnalyticsWorkspaceResourceId }] : null
10231028 // WAF aligned configuration for Private Networking
@@ -1041,9 +1046,9 @@ module cosmosDb 'br/public:avm/res/document-db/database-account:0.18.0' = {
10411046 ]
10421047 : []
10431048 // WAF aligned configuration for Redundancy
1044- zoneRedundant : enableRedundancy ? true : false
1049+ zoneRedundant : enableRedundancy
10451050 capabilitiesToAdd : enableRedundancy ? null : ['EnableServerless' ]
1046- enableAutomaticFailover : enableRedundancy ? true : false
1051+ enableAutomaticFailover : enableRedundancy
10471052 failoverLocations : enableRedundancy
10481053 ? [
10491054 {
@@ -1076,6 +1081,7 @@ module sqlDBModule 'br/public:avm/res/sql/server:0.21.1' = {
10761081 params : {
10771082 // Required parameters
10781083 name : sqlServerResourceName
1084+ enableTelemetry : enableTelemetry
10791085 // Non-required parameters
10801086 administrators : {
10811087 azureADOnlyAuthentication : true
@@ -1103,7 +1109,7 @@ module sqlDBModule 'br/public:avm/res/sql/server:0.21.1' = {
11031109 capacity : 2
11041110 }
11051111 // Note: Zone redundancy is not supported for serverless SKUs (GP_S_Gen5)
1106- zoneRedundant : enableRedundancy ? true : false
1112+ zoneRedundant : enableRedundancy
11071113 }
11081114 ]
11091115 location : secondaryLocation
@@ -1270,7 +1276,7 @@ module webSiteBackend 'modules/web-sites.bicep' = {
12701276 linuxFxVersion : 'PYTHON|3.11'
12711277 minTlsVersion : '1.2'
12721278 alwaysOn : true
1273- appCommandLine : 'gunicorn --bind= 0.0.0.0:8000 --timeout 600 --worker-class uvicorn.workers.UvicornWorker app:app '
1279+ appCommandLine : 'uvicorn app:app --host 0.0.0.0 --port 8000 '
12741280 }
12751281 configs : [
12761282 {
@@ -1335,17 +1341,19 @@ module webSiteFrontend 'modules/web-sites.bicep' = {
13351341 kind : 'app,linux'
13361342 serverFarmResourceId : webServerFarm .outputs .resourceId
13371343 siteConfig : {
1338- linuxFxVersion : 'NODE|18 -lts'
1344+ linuxFxVersion : 'NODE|20 -lts'
13391345 minTlsVersion : '1.2'
13401346 alwaysOn : true
1341- appCommandLine : 'pm2 serve /home/site/wwwroot --no-daemon --spa'
1347+ appCommandLine : 'pm2 serve /home/site/wwwroot/build --no-daemon --spa'
13421348 }
13431349 configs : [
13441350 {
13451351 name : 'appsettings'
13461352 properties : {
1347- SCM_DO_BUILD_DURING_DEPLOYMENT : 'false'
1348- WEBSITE_NODE_DEFAULT_VERSION : '~18'
1353+ SCM_DO_BUILD_DURING_DEPLOYMENT : 'true'
1354+ ENABLE_ORYX_BUILD : 'true'
1355+ REACT_APP_API_BASE_URL : 'https://api-${solutionSuffix }.azurewebsites.net'
1356+ WEBSITE_NODE_DEFAULT_VERSION : '~20'
13491357 APP_API_BASE_URL : 'https://api-${solutionSuffix }.azurewebsites.net'
13501358 }
13511359 applicationInsightResourceId : enableMonitoring ? applicationInsights !.outputs .resourceId : null
0 commit comments