Updating azure infra build to move Products to Postgres by spruit-avanade · Pull Request #144 · Avanade/CoreEx

spruit-avanade · 2026-05-19T22:50:00Z

E2E Runner migration still doesn't work. Unsure why, but want this as a PR for the time being.

Co-authored-by: Copilot copilot@github.com

Copilot

Pull request overview

Updates the Azure deployment infrastructure (azd/Bicep primary, Terraform mirrored) to run the Contoso Products domain on Azure Database for PostgreSQL Flexible Server, while keeping other domains on Azure SQL. This aligns app-service configuration, secrets, and predeploy migration hooks with the new split-provider model.

Changes:

Provision PostgreSQL Flexible Server + database (Products) and wire its connection string into Products-related App Services.
Update predeploy migration hook scripts to run Products migrations against PostgreSQL and other domains against Azure SQL.
Extend Key Vault secret storage and docs to include PostgreSQL credentials/connection string.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
azure/terraform/variables.tf	Adds Terraform variables for PostgreSQL server/database configuration.
azure/terraform/dev.tfvars	Supplies dev PostgreSQL settings (SKU/version/storage/db name).
azure/terraform/test.tfvars	Supplies test PostgreSQL settings (SKU/version/storage/db name).
azure/terraform/prod.tfvars	Supplies prod PostgreSQL settings (SKU/version/storage/db name).
azure/terraform/outputs.tf	Exposes PostgreSQL server/database names as Terraform outputs.
azure/terraform/main.tf	Provisions PostgreSQL resources, stores secrets, and switches Products app settings to Npgsql connection string.
azure/scripts/run-products-db-migrations.sh	Runs domain-specific DbEx migrations (Products → Postgres; others → SQL), including the Products ResetAndAll workaround sequence.
azure/scripts/run-products-db-migrations.ps1	PowerShell equivalent of the domain-specific migration flow.
azure/README.md	Documents PostgreSQL addition, required ports, optional password env var, and new KV secrets.
azure/infra/scripts/use-dev-params.sh	Injects PostgreSQL password and firewall client IP into generated parameters.json.
azure/infra/scripts/use-dev-params.ps1	PowerShell equivalent of PostgreSQL parameter injection.
azure/infra/scripts/store-secrets.sh	Stores PostgreSQL password/connection string in Key Vault and builds Postgres conn string from env/azd outputs.
azure/infra/scripts/store-secrets.ps1	Stores PostgreSQL password/connection string in Key Vault (currently uses discovery via az CLI).
azure/infra/modules/postgres-database.bicep	New Bicep module to deploy PostgreSQL Flexible Server, firewall rules, and database.
azure/infra/modules/app-services.bicep	Adds postgres connection string input and applies it only to Products-related services.
azure/infra/main.test.bicepparam	Adds PostgreSQL parameters for test deployments (admin creds/db/sku/version/storage).
azure/infra/main.prod.bicepparam	Adds PostgreSQL parameters for prod deployments (admin creds/db/sku/version/storage).
azure/infra/main.dev.parameters.json	Adds PostgreSQL parameters (password placeholder + firewall client IP, etc.) to the dev template.
azure/infra/main.dev.bicepparam	Adds PostgreSQL parameters for dev bicepparam usage.
azure/infra/main.bicep	Wires the new postgres module and outputs postgres server/database names.
azure/AGENTS.md	Updates Azure agent guidance to reflect PostgreSQL + SQL split and new secrets, and lists the new module.

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 12 comments.

Comments suppressed due to low confidence (1)

azure/infra/scripts/store-secrets.ps1:56

The Postgres connection string sets Trust Server Certificate=true, which disables certificate validation and weakens TLS security. Prefer omitting it (default false) or setting it to false.

$postgresConn   = "Server=$postgresServer.postgres.database.azure.com;Port=5432;Database=$postgresDb;User Id=$postgresLogin;Password=$postgresPassword;Ssl Mode=Require;Trust Server Certificate=true;"

Co-authored-by: Copilot <copilot@github.com> Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

…ig setup Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

spruit-avanade · 2026-05-20T18:57:12Z

Looking into terraform items now. Still no dice on running the migration from E2E, pretty sure it's blowing up on psql. Could be due to the connection string not being superuser after the DB was already setup.

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

…lidation. Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

it was infra only anyways without any code deploy Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Copilot

Pull request overview

Copilot reviewed 31 out of 31 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

azure/scripts/setup-e2e-runner.ps1:53

This script always uses -SkipCertificateCheck for endpoint validation, but the bash equivalent only disables TLS verification when --insecure is explicitly passed. For security and parity, add an -Insecure switch (default false) and only skip certificate checks when requested.

    try {
        $response = Invoke-WebRequest -Uri $Url -Method $Method -SkipCertificateCheck -UseBasicParsing -ErrorAction Stop
        $code = [int]$response.StatusCode

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Copilot

Pull request overview

Copilot reviewed 31 out of 31 changed files in this pull request and generated 5 comments.

…and servicebus Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Copilot

Pull request overview

Copilot reviewed 34 out of 34 changed files in this pull request and generated 9 comments.

+    [string[]] $AppName,
+
+    [Alias('w')]
+    [ValidateRange(0, 600)]


+            "appInsightsInstrumentationKey": {
+              "type": "string"
+            },
            "sqlConnectionString": {
              "type": "string"
            },
+            "postgresConnectionString": {
+              "type": "string"
+            },
            "redisConnectionString": {
              "type": "string"
            },
            "serviceBusConnectionString": {
              "type": "string"
            },
-            "otlpGrpcEndpoint": {
+            "otlpHttpEndpoint": {
              "type": "string"
            }
          },
          "variables": {
+            "keyVaultSecretsUserRoleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
+            "sqlConnectionStringKeyVaultReference": "[format('@Microsoft.KeyVault(SecretUri={0}secrets/sql-connection-string/)', parameters('keyVaultUri'))]",
+            "postgresConnectionStringKeyVaultReference": "[format('@Microsoft.KeyVault(SecretUri={0}secrets/postgres-connection-string/)', parameters('keyVaultUri'))]",
+            "serviceBusConnectionStringKeyVaultReference": "[format('@Microsoft.KeyVault(SecretUri={0}secrets/service-bus-connection-string/)', parameters('keyVaultUri'))]",


+                "value": "[parameters('sqlConnectionString')]"
+              }
+            ],
+            "postgresDbAppSettings": [
+              {
+                "name": "Aspire__Npgsql__ConnectionString",
+                "value": "[parameters('postgresConnectionString')]"


 rg="${AZURE_RESOURCE_GROUP:?AZURE_RESOURCE_GROUP is not set}"
 sql_password="${AZURE_SQL_ADMIN_PASSWORD:?AZURE_SQL_ADMIN_PASSWORD is not set}"
+postgres_password="${AZURE_POSTGRES_ADMIN_PASSWORD:-${AZURE_SQL_ADMIN_PASSWORD}}"
+sql_server="${AZURE_SQL_SERVER:-${sqlServerName:-}}"
+sql_login="${AZURE_SQL_ADMIN_LOGIN:-coreexadmin}"
+sql_db="${AZURE_SQL_DB_NAME:-${sqlDatabaseName:-}}"
+postgres_server="${AZURE_POSTGRES_SERVER:-${postgresServerName:-}}"
+postgres_login="${AZURE_POSTGRES_ADMIN_LOGIN:-coreexpgadmin}"
+postgres_db="${AZURE_POSTGRES_DB_NAME:-${postgresDatabaseName:-}}"


…n Bicep and scripts Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Copilot

Pull request overview

Copilot reviewed 32 out of 32 changed files in this pull request and generated 6 comments.

 $sqlServer = (azd env get-value sqlServerName).Trim()
+$postgresServer = (azd env get-value postgresServerName).Trim()
 $azureResourceGroup = (azd env get-value AZURE_RESOURCE_GROUP).Trim()
 $azureSubscriptionId = (azd env get-value AZURE_SUBSCRIPTION_ID).Trim()
 $azureEnvName = (azd env get-value AZURE_ENV_NAME).Trim()

-if ([string]::IsNullOrWhiteSpace($sqlServer) -or [string]::IsNullOrWhiteSpace($azureResourceGroup)) {
-    throw 'Unable to resolve sqlServerName/AZURE_RESOURCE_GROUP from the active azd environment.'
+if (([string]::IsNullOrWhiteSpace($sqlServer) -and [string]::IsNullOrWhiteSpace($postgresServer)) -or [string]::IsNullOrWhiteSpace($azureResourceGroup)) {
+    throw 'Unable to resolve sqlServerName and/or postgresServerName and AZURE_RESOURCE_GROUP from the active azd environment.'
 }


+    '.E2E.Products.BaseAddress = $productsBase
+    | .E2E.Products.ConnectionString = $productsConnectionString
+    | .E2E.Shopping.BaseAddress = $shoppingBase
+    | .E2E.Shopping.ConnectionString = $shoppingConnectionString' \
+    "${appsettings_path}" > "${temp_path}"


+if (-not $settings['E2E'].ContainsKey('Shopping'))              { $settings['E2E']['Shopping'] = @{} }
+
+$settings['E2E']['Products']['BaseAddress']      = "https://${productsHost}"
+$settings['E2E']['Products']['ConnectionString'] = $postgresConnectionString
+$settings['E2E']['Shopping']['BaseAddress']      = "https://${shoppingHost}"
+$settings['E2E']['Shopping']['ConnectionString'] = $sqlConnectionString


Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Copilot AI review requested due to automatic review settings May 19, 2026 22:50

Copilot started reviewing on behalf of spruit-avanade May 19, 2026 22:50 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread azure/infra/scripts/store-secrets.sh

Comment thread azure/terraform/dev.tfvars Outdated

Comment thread azure/terraform/test.tfvars Outdated

Comment thread azure/terraform/prod.tfvars Outdated

Comment thread azure/terraform/main.tf Outdated

Copilot AI review requested due to automatic review settings May 20, 2026 18:45

Copilot started reviewing on behalf of spruit-avanade May 20, 2026 18:45 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

spruit-avanade and others added 4 commits May 20, 2026 11:54

Updating azure infra build to move Products to Postgres

8347b23

Co-authored-by: Copilot <copilot@github.com> Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

fix: README.md updated for clean clone setup

482e192

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

adding helper scripts for aspire dashboard tokens and E2E runner conf…

b16667c

…ig setup Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

adding ps1 variants of helper scripts.

194bb3a

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

spruit-avanade force-pushed the azure/psql branch from 8c81fe4 to 194bb3a Compare May 20, 2026 18:54

spruit-avanade added 3 commits May 20, 2026 12:52

fix: updating copilot review findings for the scripts

221228c

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

fix: removing the psql connection string parameter to disable cert va…

7158927

…lidation. Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

removing terraform and it's references

915b653

it was infra only anyways without any code deploy Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Copilot AI review requested due to automatic review settings May 20, 2026 20:12

Copilot started reviewing on behalf of spruit-avanade May 20, 2026 20:12 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

Comment thread azure/scripts/setup-e2e-runner.ps1 Outdated

Comment thread azure/scripts/get-aspire-dashboard-login.sh

Comment thread azure/scripts/run-products-db-migrations.sh

Comment thread azure/scripts/run-products-db-migrations.ps1

spruit-avanade added 2 commits May 20, 2026 13:22

fix: updated ps1 to correctly get statuscodes

fb7b8af

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

updating agents.md to include helper script info

18fcbef

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Copilot AI review requested due to automatic review settings May 20, 2026 20:40

Copilot started reviewing on behalf of spruit-avanade May 20, 2026 20:40 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

Comment thread azure/scripts/get-aspire-dashboard-login.sh

Comment thread azure/scripts/setup-e2e-runner.ps1

Comment thread azure/scripts/setup-e2e-runner.ps1 Outdated

Comment thread azure/scripts/get-aspire-dashboard-login.ps1

Comment thread azure/README.md Outdated

spruit-avanade added 2 commits May 20, 2026 15:04

fix: updated webapps to use keyvault connection strings for database …

1b6ac41

…and servicebus Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

reverting use of keyvault for webapps & fixing keyvault reuse

31868c5

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Copilot AI review requested due to automatic review settings May 21, 2026 16:16

Copilot started reviewing on behalf of spruit-avanade May 21, 2026 16:16 View session

Copilot AI reviewed May 21, 2026

View reviewed changes

spruit-avanade added 2 commits May 21, 2026 09:49

refactor: remove Key Vault references and update connection strings i…

8f52d9f

…n Bicep and scripts Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

fix: update dev params for when keyvault env var doesn't exist

1fe4eeb

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Copilot AI review requested due to automatic review settings May 21, 2026 17:12

Copilot started reviewing on behalf of spruit-avanade May 21, 2026 17:13 View session

Copilot AI reviewed May 21, 2026

View reviewed changes

fix: copilot review updates

c425314

Signed-off-by: Aaron Spruit <aaron.spruit@avanade.com>

Conversation

spruit-avanade commented May 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

spruit-avanade commented May 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants