How to deploy aspire app using azd in a particular VNET

[Faisal Riaz (faisalriazz)]

Hi All
I want to deploy an aspire app to my own VNET using azd so that i can control it and add application gateway , web application firewall and other other services.
Currently when deployed using azd i do not have control over the VNET.
is it possible ? or there is any other solution to deploy aspire app so that i can have control over it

[David Fowler (davidfowl)]

is it possible ? or there is any other solution to deploy aspire app so that i can have control over it

There's nothing built in to help you here as yet. If you need more control over the deployment you'll need to use azd infra synth and you'll have to mutate the generated bicep.

[Faisal Riaz (faisalriazz)]

David Fowler (@davidfowl) Thanks for your reply.
Is there any recommended procedure to follow for example a microsoft document.
Or If someone has achieved it and shared in aspire community as a reference.
It would be of great help.

[David Fowler (davidfowl)]

Do you have experience with virtual networks and bicep?

[Faisal Riaz (faisalriazz)]

yes ,basic knowledge , can use template from

[https://azure.github.io/bicep/] to modify as per my need

[Harlow Burgess (Datamark) (dmi-harlow)]

Faisal Riaz (@faisalriazz), I had a similar requirement and found that deploying an Aspire application to an existing vnet is actually pretty straightforward. Here is an excerpt from the default resources.bicep generated by azd infra synth with the new code added between the comments:

resource containerAppEnvironment 'Microsoft.App/managedEnvironments@2024-02-02-preview' = {
  name: 'cae-${resourceToken}'
  location: location
  properties: {
    workloadProfiles: [{
      workloadProfileType: 'Consumption'
      name: 'consumption'
    }]
    appLogsConfiguration: {
      destination: 'log-analytics'
      logAnalyticsConfiguration: {
        customerId: logAnalyticsWorkspace.properties.customerId
        sharedKey: logAnalyticsWorkspace.listKeys().primarySharedKey
      }
    }

    //---- BEGIN VNET INTEGRATION ----//
    vnetConfiguration: {
      internal: true
      infrastructureSubnetId: resourceId('yourVnetResourceGroupName', 'Microsoft.Network/virtualNetworks/subnets', 'yourVnetName', 'yourSubnetName')
    }
    publicNetworkAccess: 'Disabled'
    //---- END VNET INTEGRATION ----//

  }
  tags: tags

  resource aspireDashboard 'dotNetComponents' = {
    name: 'aspire-dashboard'
    properties: {
      componentType: 'AspireDashboard'
    }
  }
}

Note that the subnet used must be empty and delegated to Microsoft.App/environments.

After deploying this I was able to add a Private Endpoint to the CAE and access container apps with external ingress over the Private Endpoint.

[Conrad (conradvc-kaha)]

Hi Faisal Riaz (@faisalriazz), I just came across this post of yours and wanted to follow up; what was the best solution for you?

I'm in a similar boat. I want to deploy my container apps (using azd) to a VNET for control, and that I can add an application gateway and all that.

Did you have to mutate the generated biceps manually, or did you find a more elegant solution?

[Faisal Riaz (faisalriazz)]

Conrad (@conradvc-kaha) I am sorry that i overlooked your question. Hope you have solved this issue but if you still need any help i am available. I overcome the same problem and solved it .
Let me know if i can help you out.

[David Fowler (davidfowl)]

cc Eric Erhardt (@eerhardt)

[Conrad (conradvc)]

Faisal Riaz (@faisalriazz) No problem. It has been a while since I've looked at this, but now that Aspire 13 has a Azure VNET integration, I'd like to pick it back up.

What was your latest approach? Did you manually modify the biceps after azd infra synth or have you tried using the new Aspire Vnet integration?

Ideally, I'd like to continue without manual bicep file mutation, but I'm not sure if that's possible

[David Fowler (davidfowl)]

https://aspire.dev/integrations/cloud/azure/azure-virtual-network/