Skip to content

Commit eeae9b2

Browse files
oZakarioZakari
committed
feat: Enable availability zone support across all applicable resources using pickZones()
1 parent 0aa57ac commit eeae9b2

5 files changed

Lines changed: 50 additions & 32 deletions

File tree

‎Scenarios/AKS-Secure-Baseline-PrivateCluster/Bicep/04-Network-LZ/main.bicep‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ param vnetHubName string
2222
param agcName string
2323

2424
@description('The name of the resource group containing the hub VNet.')
25-
param vnetHUBRGName string
25+
param vnetHubRgName string
2626

2727
@description('The name of the NSG for the AKS subnet.')
2828
param nsgAKSName string
@@ -57,6 +57,9 @@ param remotePeeringName string = 'spoke-hub-peering'
5757
@description('The VM size for the jumpbox virtual machine.')
5858
param vmSize string = 'Standard_DS2_v2'
5959

60+
// Auto-detect zone support for VMs in this region
61+
var vmZones = pickZones('Microsoft.Compute', 'virtualMachines', location, 1)
62+
6063
@secure()
6164
@description('The admin password for the jumpbox VM.')
6265
param jumpboxAdminPassword string
@@ -69,7 +72,7 @@ var privateDNSZoneAKSSuffixes = {
6972
}
7073

7174
resource vnethub 'Microsoft.Network/virtualNetworks@2021-02-01' existing = {
72-
scope: resourceGroup(vnetHUBRGName)
75+
scope: resourceGroup(vnetHubRgName)
7376
name: vnetHubName
7477
}
7578

@@ -290,7 +293,7 @@ module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.21.0' = {
290293
}
291294
osType: 'Linux'
292295
vmSize: vmSize
293-
availabilityZone: 1
296+
availabilityZone: length(vmZones) > 0 ? int(vmZones[0]) : -1
294297
// Non-required parameters
295298
disablePasswordAuthentication: false
296299
adminPassword: jumpboxAdminPassword

‎Scenarios/AKS-Secure-Baseline-PrivateCluster/Bicep/05-AKS-supporting/main.bicep‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,22 +36,25 @@ param enableKmsEncryption bool = true
3636
@description('The Azure region for all resources.')
3737
param location string = deployment().location
3838

39-
resource servicesSubnet 'Microsoft.Network/virtualNetworks/subnets@2021-02-01' existing = {
39+
// Auto-detect zone support for the region
40+
var acrZoneRedundancy = length(pickZones('Microsoft.ContainerRegistry', 'registries', location, 3)) > 0 ? 'Enabled' : 'Disabled'
41+
42+
resource servicesSubnet 'Microsoft.Network/virtualNetworks/subnets@2025-05-01'existing = {
4043
scope: resourceGroup(rg.name)
4144
name: '${vnetName}/${subnetName}'
4245
}
4346

44-
resource privateDNSZoneSA 'Microsoft.Network/privateDnsZones@2020-06-01' existing = {
47+
resource privateDNSZoneSA 'Microsoft.Network/privateDnsZones@2024-06-01' existing = {
4548
scope: resourceGroup(rg.name)
4649
name: privateDNSZoneSAName
4750
}
4851

49-
resource privateDNSZoneKV 'Microsoft.Network/privateDnsZones@2020-06-01' existing = {
52+
resource privateDNSZoneKV 'Microsoft.Network/privateDnsZones@2024-06-01' existing = {
5053
scope: resourceGroup(rg.name)
5154
name: privateDNSZoneKVName
5255
}
5356

54-
resource privateDNSZoneACR 'Microsoft.Network/privateDnsZones@2020-06-01' existing = {
57+
resource privateDNSZoneACR 'Microsoft.Network/privateDnsZones@2024-06-01' existing = {
5558
scope: resourceGroup(rg.name)
5659
name: privateDNSZoneACRName
5760
}
@@ -74,6 +77,7 @@ module registry 'br/public:avm/res/container-registry/registry:0.11.0' = {
7477
acrAdminUserEnabled: true
7578
publicNetworkAccess: 'Disabled'
7679
acrSku: 'Premium'
80+
zoneRedundancy: acrZoneRedundancy
7781
privateEndpoints: [
7882
{
7983
privateDnsZoneGroup: {

‎Scenarios/AKS-Secure-Baseline-PrivateCluster/Bicep/06-AKS-cluster/main.bicep‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,9 @@ param networkPlugin string
5656
])
5757
param aksSkuName string = 'Base'
5858

59+
@description('Availability zones for AKS node pools. Defaults to auto-detected zones via pickZones(). Set to empty array [] to disable.')
60+
param availabilityZones array = pickZones('Microsoft.ContainerService', 'managedClusters', location, 3)
61+
5962
@description('Enable etcd encryption with KMS v2. Requires a Key Vault key named "aks-etcd-kms".')
6063
param enableKmsEncryption bool = true
6164

@@ -141,9 +144,7 @@ module managedCluster 'br/public:avm/res/container-service/managed-cluster:0.12.
141144
skuTier: 'Standard'
142145
primaryAgentPoolProfiles: [
143146
{
144-
availabilityZones: [
145-
3
146-
]
147+
availabilityZones: availabilityZones
147148
count: 3
148149
enableAutoScaling: true
149150
maxCount: 3

‎Scenarios/AKS-Secure-Baseline-PrivateCluster/Bicep/All-in-One-Bicep/main.bicep‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -354,7 +354,7 @@ module networkSpoke '../04-Network-LZ/main.bicep' = {
354354
firewallIP: firewallIP
355355
vnetHubName: vnetHubName
356356
agcName: agcName
357-
vnetHUBRGName: rgHubName
357+
vnetHubRgName: rgHubName
358358
nsgAKSName: nsgAKSName
359359
securityRules: securityRules
360360
spokeSubnetDefaultPrefix: spokeSubnetDefaultPrefix

‎Scenarios/AKS-Secure-Baseline-PrivateCluster/Bicep/All-in-One-Bicep/main.json‎

Lines changed: 31 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
"_generator": {
66
"name": "bicep",
77
"version": "0.41.2.15936",
8-
"templateHash": "9255509095475829557"
8+
"templateHash": "2555766983935046298"
99
}
1010
},
1111
"parameters": {
@@ -10049,7 +10049,7 @@
1004910049
"agcName": {
1005010050
"value": "[parameters('agcName')]"
1005110051
},
10052-
"vnetHUBRGName": {
10052+
"vnetHubRgName": {
1005310053
"value": "[parameters('rgHubName')]"
1005410054
},
1005510055
"nsgAKSName": {
@@ -10090,7 +10090,7 @@
1009010090
"_generator": {
1009110091
"name": "bicep",
1009210092
"version": "0.41.2.15936",
10093-
"templateHash": "10435145642412965672"
10093+
"templateHash": "10182849648782112636"
1009410094
}
1009510095
},
1009610096
"parameters": {
@@ -10136,7 +10136,7 @@
1013610136
"description": "The name of the Application Gateway for Containers traffic controller."
1013710137
}
1013810138
},
10139-
"vnetHUBRGName": {
10139+
"vnetHubRgName": {
1014010140
"type": "string",
1014110141
"metadata": {
1014210142
"description": "The name of the resource group containing the hub VNet."
@@ -10226,6 +10226,7 @@
1022610226
}
1022710227
},
1022810228
"variables": {
10229+
"vmZones": "[pickZones('Microsoft.Compute', 'virtualMachines', parameters('location'), 1)]",
1022910230
"privateDNSZoneAKSSuffixes": {
1023010231
"AzureCloud": ".azmk8s.io",
1023110232
"AzureUSGovernment": ".cx.aks.containerservice.azure.us",
@@ -10794,7 +10795,7 @@
1079410795
"remotePeeringAllowVirtualNetworkAccess": true,
1079510796
"remotePeeringEnabled": true,
1079610797
"remotePeeringName": "[parameters('remotePeeringName')]",
10797-
"remoteVirtualNetworkResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('vnetHUBRGName')), 'Microsoft.Network/virtualNetworks', parameters('vnetHubName'))]",
10798+
"remoteVirtualNetworkResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('vnetHubRgName')), 'Microsoft.Network/virtualNetworks', parameters('vnetHubName'))]",
1079810799
"useRemoteGateways": false
1079910800
}
1080010801
]
@@ -13469,7 +13470,7 @@
1346913470
"virtualNetworkLinks": {
1347013471
"value": [
1347113472
{
13472-
"virtualNetworkResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('vnetHUBRGName')), 'Microsoft.Network/virtualNetworks', parameters('vnetHubName'))]"
13473+
"virtualNetworkResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('vnetHubRgName')), 'Microsoft.Network/virtualNetworks', parameters('vnetHubName'))]"
1347313474
},
1347413475
{
1347513476
"virtualNetworkResourceId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('rgName')), 'Microsoft.Resources/deployments', parameters('vnetSpokeName')), '2025-04-01').outputs.resourceId.value]"
@@ -16875,7 +16876,7 @@
1687516876
"virtualNetworkLinks": {
1687616877
"value": [
1687716878
{
16878-
"virtualNetworkResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('vnetHUBRGName')), 'Microsoft.Network/virtualNetworks', parameters('vnetHubName'))]"
16879+
"virtualNetworkResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('vnetHubRgName')), 'Microsoft.Network/virtualNetworks', parameters('vnetHubName'))]"
1687916880
},
1688016881
{
1688116882
"virtualNetworkResourceId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('rgName')), 'Microsoft.Resources/deployments', parameters('vnetSpokeName')), '2025-04-01').outputs.resourceId.value]"
@@ -20281,7 +20282,7 @@
2028120282
"virtualNetworkLinks": {
2028220283
"value": [
2028320284
{
20284-
"virtualNetworkResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('vnetHUBRGName')), 'Microsoft.Network/virtualNetworks', parameters('vnetHubName'))]"
20285+
"virtualNetworkResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('vnetHubRgName')), 'Microsoft.Network/virtualNetworks', parameters('vnetHubName'))]"
2028520286
}
2028620287
]
2028720288
},
@@ -23684,7 +23685,7 @@
2368423685
"virtualNetworkLinks": {
2368523686
"value": [
2368623687
{
23687-
"virtualNetworkResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('vnetHUBRGName')), 'Microsoft.Network/virtualNetworks', parameters('vnetHubName'))]"
23688+
"virtualNetworkResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('vnetHubRgName')), 'Microsoft.Network/virtualNetworks', parameters('vnetHubName'))]"
2368823689
}
2368923690
]
2369023691
},
@@ -27715,9 +27716,7 @@
2771527716
"vmSize": {
2771627717
"value": "[parameters('vmSize')]"
2771727718
},
27718-
"availabilityZone": {
27719-
"value": 1
27720-
},
27719+
"availabilityZone": "[if(greater(length(variables('vmZones')), 0), createObject('value', int(variables('vmZones')[0])), createObject('value', -1))]",
2772127720
"disablePasswordAuthentication": {
2772227721
"value": false
2772327722
},
@@ -36826,7 +36825,7 @@
3682636825
"_generator": {
3682736826
"name": "bicep",
3682836827
"version": "0.41.2.15936",
36829-
"templateHash": "15104695538087637258"
36828+
"templateHash": "9953326879417741521"
3683036829
}
3683136830
},
3683236831
"parameters": {
@@ -36911,11 +36910,14 @@
3691136910
}
3691236911
}
3691336912
},
36913+
"variables": {
36914+
"acrZoneRedundancy": "[if(greater(length(pickZones('Microsoft.ContainerRegistry', 'registries', parameters('location'), 3)), 0), 'Enabled', 'Disabled')]"
36915+
},
3691436916
"resources": {
3691536917
"servicesSubnet": {
3691636918
"existing": true,
3691736919
"type": "Microsoft.Network/virtualNetworks/subnets",
36918-
"apiVersion": "2021-02-01",
36920+
"apiVersion": "2025-05-01",
3691936921
"resourceGroup": "[parameters('rgName')]",
3692036922
"name": "[format('{0}/{1}', parameters('vnetName'), parameters('subnetName'))]",
3692136923
"dependsOn": [
@@ -36925,7 +36927,7 @@
3692536927
"privateDNSZoneSA": {
3692636928
"existing": true,
3692736929
"type": "Microsoft.Network/privateDnsZones",
36928-
"apiVersion": "2020-06-01",
36930+
"apiVersion": "2024-06-01",
3692936931
"resourceGroup": "[parameters('rgName')]",
3693036932
"name": "[parameters('privateDNSZoneSAName')]",
3693136933
"dependsOn": [
@@ -36935,7 +36937,7 @@
3693536937
"privateDNSZoneKV": {
3693636938
"existing": true,
3693736939
"type": "Microsoft.Network/privateDnsZones",
36938-
"apiVersion": "2020-06-01",
36940+
"apiVersion": "2024-06-01",
3693936941
"resourceGroup": "[parameters('rgName')]",
3694036942
"name": "[parameters('privateDNSZoneKVName')]",
3694136943
"dependsOn": [
@@ -36945,7 +36947,7 @@
3694536947
"privateDNSZoneACR": {
3694636948
"existing": true,
3694736949
"type": "Microsoft.Network/privateDnsZones",
36948-
"apiVersion": "2020-06-01",
36950+
"apiVersion": "2024-06-01",
3694936951
"resourceGroup": "[parameters('rgName')]",
3695036952
"name": "[parameters('privateDNSZoneACRName')]",
3695136953
"dependsOn": [
@@ -37478,6 +37480,9 @@
3747837480
"acrSku": {
3747937481
"value": "Premium"
3748037482
},
37483+
"zoneRedundancy": {
37484+
"value": "[variables('acrZoneRedundancy')]"
37485+
},
3748137486
"privateEndpoints": {
3748237487
"value": [
3748337488
{
@@ -52382,7 +52387,7 @@
5238252387
"_generator": {
5238352388
"name": "bicep",
5238452389
"version": "0.41.2.15936",
52385-
"templateHash": "3470445614776705232"
52390+
"templateHash": "12712825286428203978"
5238652391
}
5238752392
},
5238852393
"parameters": {
@@ -52494,6 +52499,13 @@
5249452499
"description": "Optional. The AKS cluster SKU name. Set to \"Automatic\" for AKS Automatic mode, or \"Base\" for standard mode."
5249552500
}
5249652501
},
52502+
"availabilityZones": {
52503+
"type": "array",
52504+
"defaultValue": "[pickZones('Microsoft.ContainerService', 'managedClusters', parameters('location'), 3)]",
52505+
"metadata": {
52506+
"description": "Availability zones for AKS node pools. Defaults to auto-detected zones via pickZones(). Set to empty array [] to disable."
52507+
}
52508+
},
5249752509
"enableKmsEncryption": {
5249852510
"type": "bool",
5249952511
"defaultValue": true,
@@ -56196,9 +56208,7 @@
5619656208
"primaryAgentPoolProfiles": {
5619756209
"value": [
5619856210
{
56199-
"availabilityZones": [
56200-
3
56201-
],
56211+
"availabilityZones": "[parameters('availabilityZones')]",
5620256212
"count": 3,
5620356213
"enableAutoScaling": true,
5620456214
"maxCount": 3,

0 commit comments

Comments
 (0)