From e3952877254499ba9edbd88ee3e05a34f49bce0a Mon Sep 17 00:00:00 2001 From: Bernie White Date: Tue, 2 Apr 2024 00:35:23 +1000 Subject: [PATCH 1/3] Check that Container Apps have a minimum number of replicas #2790 --- docs/CHANGELOG-v1.md | 12 +- .../rules/Azure.ContainerApp.MinReplicas.md | 130 ++++++++++++++++++ docs/examples-containerapp.bicep | 4 + docs/examples-containerapp.json | 12 +- .../rules/Azure.ContainerApp.Rule.yaml | 18 +++ .../Azure.ContainerApp.Tests.ps1 | 15 ++ .../Resources.ContainerApp.json | 3 + 7 files changed, 189 insertions(+), 5 deletions(-) create mode 100644 docs/en/rules/Azure.ContainerApp.MinReplicas.md diff --git a/docs/CHANGELOG-v1.md b/docs/CHANGELOG-v1.md index 9af2dd0e32e..1199a29bd9d 100644 --- a/docs/CHANGELOG-v1.md +++ b/docs/CHANGELOG-v1.md @@ -32,6 +32,16 @@ See [upgrade notes][1] for helpful information when upgrading from previous vers ## Unreleased +What's changed since v1.35.0: + +- New rules: + - Container App: + - Check that Container Apps have a minimum number of replicas by @BernieWhite. + [#2790](https://github.com/Azure/PSRule.Rules.Azure/issues/2790) +- General improvements: + - Quality updates to documentation by @lukemurraynz. + [#2789](https://github.com/Azure/PSRule.Rules.Azure/pull/2789) + ## v1.35.0 What's changed since v1.34.2: @@ -1014,7 +1024,7 @@ What's changed since pre-release v1.30.0-B0026: What's changed since pre-release v1.30.0-B0011: - New rules: - - Azure Container Apps: + - Container Apps: - Check that Container Apps uses a supported API version by @BenjaminEngeset. [#2398](https://github.com/Azure/PSRule.Rules.Azure/issues/2398) - Bug fixes: diff --git a/docs/en/rules/Azure.ContainerApp.MinReplicas.md b/docs/en/rules/Azure.ContainerApp.MinReplicas.md new file mode 100644 index 00000000000..668b2028f69 --- /dev/null +++ b/docs/en/rules/Azure.ContainerApp.MinReplicas.md @@ -0,0 +1,130 @@ +--- +reviewed: 2024-04-02 +severity: Important +pillar: Reliability +category: RE:05 Redundancy +resource: Container App +online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ContainerApp.MinReplicas/ +--- + +# Use a minimum number of replicas + +## SYNOPSIS + +Use multiple replicas to remove a single point of failure. + +## DESCRIPTION + +When a Container App is deployed Azure create one or more instances or replicas of the application. +The number of replicas is configurable and can be automatically scaled up or down based on demand using scaling rules. + +When a single instance of the application is deployed, in the event of a failure Azure will replace the instance. +However, this can lead to downtime while the instance is replaced with this single point of failure. + +To ensure that the application is highly available, it is recommended to configure a minimum number of replicas. +The minimum number of replicas required will depend on the criticality of the application and the expected demand. + +For a production application, consider configuring a minimum of two (2) replicas. +When zone redundancy is configured, use a minimum of three (3) replicas to spread the replicas across all availability zones. + +## RECOMMENDATION + +Consider configuring a minimum number of replicas for the Container App to remove a single point of failure on a single instance. + +## EXAMPLES + +### Configure with Azure template + +To deploy Container Apps that pass this rule: + +- Set the `properties.template.scale.minReplicas` property to a minimum of `2`. + +For example: + +```json +{ + "type": "Microsoft.App/containerApps", + "apiVersion": "2023-05-01", + "name": "[parameters('appName')]", + "location": "[parameters('location')]", + "identity": { + "type": "SystemAssigned" + }, + "properties": { + "environmentId": "[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]", + "template": { + "revisionSuffix": "[parameters('revision')]", + "containers": "[variables('containers')]", + "scale": { + "minReplicas": 2 + } + }, + "configuration": { + "ingress": { + "allowInsecure": false, + "stickySessions": { + "affinity": "none" + } + } + } + }, + "dependsOn": [ + "[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]" + ] +} +``` + +### Configure with Bicep + +To deploy Container Apps that pass this rule: + +- Set the `properties.template.scale.minReplicas` property to a minimum of `2`. + +For example: + +```bicep +resource containerApp 'Microsoft.App/containerApps@2023-05-01' = { + name: appName + location: location + identity: { + type: 'SystemAssigned' + } + properties: { + environmentId: containerEnv.id + template: { + revisionSuffix: revision + containers: containers + scale: { + minReplicas: 2 + } + } + configuration: { + ingress: { + allowInsecure: false + stickySessions: { + affinity: 'none' + } + } + } + } +} +``` + +### Configure with Azure CLI + +```bash +az containerapp update -n '' -g '' --min-replicas 2 --max-replicas 10 +``` + +### Configure with Azure PowerShell + +```powershell +Update-AzContainerApp -Name '' -ResourceGroupName '' -ScaleMinReplica 2 -ScaleMaxReplica 10 +``` + +## LINKS + +- [RE:05 Redundancy](https://learn.microsoft.com/azure/well-architected/reliability/redundancy) +- [Reliability in Azure Container Apps](https://learn.microsoft.com/azure/reliability/reliability-azure-container-apps#availability-zone-support) +- [Set scaling rules in Azure Container Apps](https://learn.microsoft.com/azure/container-apps/scale-app) +- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.app/containerapps) diff --git a/docs/examples-containerapp.bicep b/docs/examples-containerapp.bicep index a474a19b532..372bca3a760 100644 --- a/docs/examples-containerapp.bicep +++ b/docs/examples-containerapp.bicep @@ -45,6 +45,7 @@ resource containerEnv 'Microsoft.App/managedEnvironments@2023-05-01' = { sharedKey: workspace.listKeys().primarySharedKey } } + zoneRedundant: true } } @@ -60,6 +61,9 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = { template: { revisionSuffix: revision containers: containers + scale: { + minReplicas: 2 + } } configuration: { ingress: { diff --git a/docs/examples-containerapp.json b/docs/examples-containerapp.json index 8225c2c0aaa..75321204056 100644 --- a/docs/examples-containerapp.json +++ b/docs/examples-containerapp.json @@ -4,8 +4,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.21.1.54444", - "templateHash": "14295091017114091018" + "version": "0.26.54.24096", + "templateHash": "13273570990713004075" } }, "parameters": { @@ -66,7 +66,8 @@ "customerId": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceId')), '2022-10-01').customerId]", "sharedKey": "[listKeys(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspaceId')), '2022-10-01').primarySharedKey]" } - } + }, + "zoneRedundant": true } }, { @@ -81,7 +82,10 @@ "environmentId": "[resourceId('Microsoft.App/managedEnvironments', parameters('envName'))]", "template": { "revisionSuffix": "[parameters('revision')]", - "containers": "[variables('containers')]" + "containers": "[variables('containers')]", + "scale": { + "minReplicas": 2 + } }, "configuration": { "ingress": { diff --git a/src/PSRule.Rules.Azure/rules/Azure.ContainerApp.Rule.yaml b/src/PSRule.Rules.Azure/rules/Azure.ContainerApp.Rule.yaml index a71868f3229..ecd603fc5e6 100644 --- a/src/PSRule.Rules.Azure/rules/Azure.ContainerApp.Rule.yaml +++ b/src/PSRule.Rules.Azure/rules/Azure.ContainerApp.Rule.yaml @@ -183,6 +183,24 @@ spec: - 2022-06-01-preview - 2022-11-01-preview +--- +# Synopsis: Use multiple replicas to remove a single point of failure. +apiVersion: github.com/microsoft/PSRule/v1 +kind: Rule +metadata: + name: Azure.ContainerApp.MinReplicas + ref: AZR-000413 + tags: + release: GA + ruleSet: 2024_06 + Azure.WAF/pillar: Reliability +spec: + type: + - Microsoft.App/containerApps + condition: + field: properties.template.scale.minReplicas + greaterOrEquals: 2 + #endregion Rules #region Selectors diff --git a/tests/PSRule.Rules.Azure.Tests/Azure.ContainerApp.Tests.ps1 b/tests/PSRule.Rules.Azure.Tests/Azure.ContainerApp.Tests.ps1 index 7970050bfca..eedc2b9279e 100644 --- a/tests/PSRule.Rules.Azure.Tests/Azure.ContainerApp.Tests.ps1 +++ b/tests/PSRule.Rules.Azure.Tests/Azure.ContainerApp.Tests.ps1 @@ -174,6 +174,21 @@ Describe 'Azure.ContainerApp' -Tag 'ContainerApp' { $ruleResult.Length | Should -Be 2; $ruleResult.TargetName | Should -BeIn 'capp-C', 'capp-D'; } + + It 'Azure.ContainerApp.MinReplicas' { + $filteredResult = $result | Where-Object { $_.RuleName -eq 'Azure.ContainerApp.MinReplicas' }; + + # Fail + $ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Fail' }); + $ruleResult.Length | Should -Be 2; + $ruleResult.TargetName | Should -BeIn 'capp-A', 'capp-B'; + $ruleResult.Detail.Reason.Path | Should -BeIn 'properties.template.scale.minReplicas'; + + # Pass + $ruleResult = @($filteredResult | Where-Object { $_.Outcome -eq 'Pass' }); + $ruleResult.Length | Should -Be 2; + $ruleResult.TargetName | Should -BeIn 'capp-C', 'capp-D'; + } } Context 'Resource name - Azure.ContainerApp.Name' { diff --git a/tests/PSRule.Rules.Azure.Tests/Resources.ContainerApp.json b/tests/PSRule.Rules.Azure.Tests/Resources.ContainerApp.json index a6bed20e7a8..391c3e08816 100644 --- a/tests/PSRule.Rules.Azure.Tests/Resources.ContainerApp.json +++ b/tests/PSRule.Rules.Azure.Tests/Resources.ContainerApp.json @@ -274,6 +274,7 @@ } ], "scale": { + "minReplicas": 1, "maxReplicas": 10 }, "volumes": [] @@ -368,6 +369,7 @@ } ], "scale": { + "minReplicas": 3, "maxReplicas": 10 }, "volumes": [ @@ -465,6 +467,7 @@ } ], "scale": { + "minReplicas": 2, "maxReplicas": 10 }, "volumes": [ From 55016060909e8d956902d7ab81791499fe482c2f Mon Sep 17 00:00:00 2001 From: Bernie White Date: Tue, 2 Apr 2024 00:37:38 +1000 Subject: [PATCH 2/3] Fix ordering in change log --- docs/CHANGELOG-v1.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/CHANGELOG-v1.md b/docs/CHANGELOG-v1.md index 1199a29bd9d..25b52b878af 100644 --- a/docs/CHANGELOG-v1.md +++ b/docs/CHANGELOG-v1.md @@ -861,14 +861,6 @@ What's changed since v1.29.0: - Includes rules released before or during September 2023. - Marked `Azure.GA_2023_06` and `Azure.Preview_2023_06` baselines as obsolete. - New rules: - - Azure Container Apps: - - Check that Container Apps uses a supported API version by @BenjaminEngeset. - [#2398](https://github.com/Azure/PSRule.Rules.Azure/issues/2398) - - Azure Container Registry: - - Check that Container Registries restricts network access by @BenjaminEngeset. - [#2423](https://github.com/Azure/PSRule.Rules.Azure/issues/2423) - - Check that Container Registries disables anonymous pull access by @BenjaminEngeset. - [#2422](https://github.com/Azure/PSRule.Rules.Azure/issues/2422) - Azure Database for MySQL: - Check that Azure AD-only authentication is configured for Azure Database for MySQL databases by @BenjaminEngeset. [#2227](https://github.com/Azure/PSRule.Rules.Azure/issues/2227) @@ -878,6 +870,14 @@ What's changed since v1.29.0: - Backup vault: - Check that immutability is configured for Backup vaults by @BenjaminEngeset. [#2387](https://github.com/Azure/PSRule.Rules.Azure/issues/2387) + - Container App: + - Check that Container Apps uses a supported API version by @BenjaminEngeset. + [#2398](https://github.com/Azure/PSRule.Rules.Azure/issues/2398) + - Container Registry: + - Check that Container Registries restricts network access by @BenjaminEngeset. + [#2423](https://github.com/Azure/PSRule.Rules.Azure/issues/2423) + - Check that Container Registries disables anonymous pull access by @BenjaminEngeset. + [#2422](https://github.com/Azure/PSRule.Rules.Azure/issues/2422) - Front Door: - Check that managed identity for Azure Front Door instances are configured by @BenjaminEngeset. [#2378](https://github.com/Azure/PSRule.Rules.Azure/issues/2378) @@ -1024,7 +1024,7 @@ What's changed since pre-release v1.30.0-B0026: What's changed since pre-release v1.30.0-B0011: - New rules: - - Container Apps: + - Container App: - Check that Container Apps uses a supported API version by @BenjaminEngeset. [#2398](https://github.com/Azure/PSRule.Rules.Azure/issues/2398) - Bug fixes: From 0e2804be3bfbca266db219be8ecd13d1fc0b14ba Mon Sep 17 00:00:00 2001 From: Bernie White Date: Tue, 2 Apr 2024 01:51:11 +1000 Subject: [PATCH 3/3] Add AVM reference --- docs/en/rules/Azure.ContainerApp.MinReplicas.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/en/rules/Azure.ContainerApp.MinReplicas.md b/docs/en/rules/Azure.ContainerApp.MinReplicas.md index 668b2028f69..e9235204ab9 100644 --- a/docs/en/rules/Azure.ContainerApp.MinReplicas.md +++ b/docs/en/rules/Azure.ContainerApp.MinReplicas.md @@ -110,6 +110,8 @@ resource containerApp 'Microsoft.App/containerApps@2023-05-01' = { } ``` + + ### Configure with Azure CLI ```bash