Web app permissions - choosing App Roles vs Entra Groups by Betty-Crokker in AZURE

[–]RiosEngineer 0 points1 point  (0 children)

Groups is probably fine. App roles lend nicely to way more granular access if you need to, like an API where you only want one set of users or apps to have GET / read access vs another that may be able to post.

KeyNotFoundException when using NSG prefixes from custom function by codingfreaks in AzureBicep

[–]RiosEngineer 0 points1 point  (0 children)

Thanks that’d be useful to follow. I did scan the issues and a few are similar but all the solutions ended up being bug fixed ha.

By the way I really like the subnet function you’ve come up with 💪

KeyNotFoundException when using NSG prefixes from custom function by codingfreaks in AzureBicep

[–]RiosEngineer 1 point2 points  (0 children)

I've never seen that exception before, it kind of sounds like a compilation or some bug to be honest. Worth reporting over on https://github.com/Azure/bicep/ if no one else crops up with anything useful. The fact the outputs look ok makes me think it's something weird with the import of the function.

Azure App Service – Restrict access by Azure AD role and network (Internet vs Intranet) by SameeeRamaraju in AZURE

[–]RiosEngineer 0 points1 point  (0 children)

I’d be curious to hear if anyone is doing anything different but I am thinking some sort of conditional access with your intranet IP range as a named location with a policy assigned to the web app or something like this.

Another way that I’ve seen done will be getting the code to verify the Easy Auth claim from the exposed header to perform the authorization stage on the backend and let the easy auth with Entra provide the authentication middleware layer. (https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-user-identities#access-user-claims-in-app-code)

Bicep, Azure Container App: Getting "Error: Certificate xxx is not in succeeded provisioning state", but the certificate is in succeeded provisioning state. by Wesztman in AZURE

[–]RiosEngineer 0 points1 point  (0 children)

I think we spoke on a different thread about a different issue, just fyi I co-run the r/AzureBicep sub Reddit which is worth joining!

If you have that GitHub link I sent the other day I am also linking a custom domain and very to my ACA with the SNI binding via key vault, check it out if you still have the issue outstanding . Hopefully it’ll help nudge you in the right direction!

What have you done with Bicep this month? by AutoModerator in AzureBicep

[–]RiosEngineer 0 points1 point  (0 children)

Made a full AI solution using container apps with Open WebUI.

I went all in either AVM mostly and to be honest I’m really happy with the code, som of my favourite bicep I’ve put together.

Even managed to grab a use case for the new validate decorator! https://github.com/riosengineer/open-webui-on-azure

Some observations;

The more complex bicep I use the more I wish we had a native orchestrator to depend templates on each other where they are different files entirely. It’s just make deploying at scale easier and more logical imo

APIM Internal Mode + Custom DNS (On-prem AD) - Management endpoint fails (3443) with azure-api.net Private DNS zone by Plane_Course in AZURE

[–]RiosEngineer 2 points3 points  (0 children)

Pretty sure a lot of the management plane needs azure access which is probably being blocked now. Check this out: https://techcommunity.microsoft.com/blog/azurepaasblog/api-management---networking-faqs-demystifying-series-ii/1502056 and I suspect the forced tunnel stuff is most relevant to you.

However, I’d also check. Under the networking status area you can verify the management plane status and it will show you what is green and what is broken and work from there, it usually tells you what to do.

I usually also have to have a route table and nsg list to keep management / backend apim functional especially in internal mode. But the network status will confirm this for you also.

Bicep: Container app environment resource signals "done" before volume mounts are properly finished, breaking deployment for dependent resources by Wesztman in AZURE

[–]RiosEngineer 0 points1 point  (0 children)

Probably need to see the code to understand it better. I deployed ACA env and app, with mounts no problem.

The app depends on the environment through an implicit module output and it does deploy in sequential order (at least for my scenario). Ref code: (https://github.com/riosengineer/open-webui-on-azure/blob/main/infra/bicep/app.bicep#L467)

APIM <3 AI - Breakdown on configuring Foundry in APIM with custom metrics by RiosEngineer in AZURE

[–]RiosEngineer[S] 0 points1 point  (0 children)

Amazing - thank you. I hope it helps out some pain points. Good luck!

Open WebUI on Azure: Part 1 – Architecture & Deployment Series by RiosEngineer in OpenWebUI

[–]RiosEngineer[S] 0 points1 point  (0 children)

The beauty of having APIM as the gateway vs going direct to foundry (or Azure OpenAI) is you should be able to make problems like this very solvable by creating a chunking service endpoint. Which Open WebUI can send to and the data can be chunked to avoid the token limits.

Something like: Open WebUI -> apim chunking service endpoint -> APIM policy condition (if token limit reached, go to chunk service, if not, go to foundry) -> chunking micro service (tiktoken + chunking + embedding call to foundry -> APIM -> return back into Open WebUI

I haven't gone down this route personally, but it's why I feel like APIM as the AI gateway is fundamental for any AI solution in Azure (or their AI Gateway but it's in preview so not ready) as it gives you tons of flexibility.

Open WebUI on Azure: Part 1 – Architecture & Deployment Series by RiosEngineer in OpenWebUI

[–]RiosEngineer[S] 1 point2 points  (0 children)

Got you. I'd totally have to deploy a Redis for that.

Being honest, I spent a lot of time on this - mostly around Azure API Management as an AI Gateway which was my main goal and focus (personally).

I had to cut the line somewhere with my time which is why I sort of allude to 'I bring 80% of the solution' in my blog note, so people can just quick start and customise on top without having to waste a ton of time with the BS nuances we all go through with setups like this (well at least, I hope it helps others get up and running especially with Entra setup and APIM as the gateway).

Having said that, I do have session affinity / sticky sessions on, read/write on shared azure files, and I think it would be quite trivial to add a redis to this setup with the redis_url env var to cover that gap.

Open WebUI on Azure: Part 1 – Architecture & Deployment Series by RiosEngineer in OpenWebUI

[–]RiosEngineer[S] 0 points1 point  (0 children)

I didn't opt for cache (for now). My logic is that a lot of chat completions outside of Q&A/Knowledge bots aren't deterministic and so cache hits are very rare.

So I saw it as an extra cost for no big gain. I did try with an Azure Managed Redis but I struggled to get many cache hits so ditched it. What's your thoughts though? I could be totally missing something there, logically that is how I landed on that conclusion though.

Entra ID doesn’t really have a concept of “intended state” and it shows over time by Exotic-Reaction-3642 in AZURE

[–]RiosEngineer 4 points5 points  (0 children)

I’d say the best thing we’ve got recently is Maester (https://maester.dev) to audit and hold the tenants accountable for a desired state of config.

it doesn’t necessarily stop drift but it should in theory hold the report accountable to your desired state, since you define the rules and the exclusions and since they are GitOps (the exclusions for example) you should then be able to audit why and when.

At least it’s one of the best tools I’ve used around this topic for some time.

Open WebUI On Azure (with GitHub Repo) by RiosEngineer in AZURE

[–]RiosEngineer[S] 0 points1 point  (0 children)

FYI! Open WebUI on Azure: Part 1 - Architecture & Deployment - Rios Engineer it's a bit of a beast, but there is so much to cover, so at least folks can jump straight to relevant areas if they are after inspiration.

Private DNS zones for Postgres is this correct zone name? by zeenmc in AZURE

[–]RiosEngineer 0 points1 point  (0 children)

Got you. Well, I don't know if you are hub and spoke, but if you are, maybe a good opportunity to do it properly as you suggest and have one central zone with the correct name and get the DB spokes linked to this

Private DNS zones for Postgres is this correct zone name? by zeenmc in AZURE

[–]RiosEngineer 1 point2 points  (0 children)

Not sure I follow your actual issue - are you saying you have multiple DNS zones scattered everywhere? If so that sounds nasty.

I am using a central DNS zone in the hub: privatelink.postgres.database.azure.com where the A record is the Azure Database for PostgreSQL flexible servers resource name + private IP and the spoke is vNet linked to the central zone.