microsoft / microsoft/AzureTRE
Enable access to Management storage account and ACR from private runners
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 235
- Forks
- 192
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 13
Description
Description
As part of issue #4463 and pull request #4495, we have enabled support for configuring a private agent subnet ID to enable virtual network (vnet) exceptions for accessing Core Key Vault from Github runners.
If private agent subnet ID is not provided in the config, it defaults to just in time public access of the key vault during deployment.
We need to add similar implementation with private agent subnet vnet exception for Management Storage account and ACR to make the private resource access behavior consistent.
Acceptance criteria
- Should be able to deploy TRE from private runners using CICD
- Should be able to deploy TRE from local dev machine
- Public access to the Storage account and ACR should be in disabled state at the end of deployment
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading issue #4463 and pull request #4495 to trace the existing private agent subnet configuration and Core Key Vault deployment path. Then locate the corresponding Management Storage account and ACR configuration and deployment entry points. Done means private-runner and local deployments both work, while public access to Storage and ACR is disabled afterward.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, python
- Domain
- cloud, devops, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100