Lack of documentation regarding the use of Azure Container Instances by the toolkit

[philipstreet]

@flanakin I've been trying to find something in the documentation about how and when Azure Container Instances are used by the toolkit, in anticipation of questions from our Cyber team.

The deployment template page contains references to Microsoft.ContainerInstance/containerGroups/write and 'another /28 subnet for temporary deployment scripts (container instances)', but I can't find anything else.

As far as I can tell the toolkit uses a Container Instance to execute the deployment scripts that are loaded onto '<hubName>script<unique-suffix> storage account (Data Lake Storage Gen2)', although I might be wrong.

Azure Container Instances are NOT an approved resource type in our production environment (although not denied by Azure Policy), so if the toolkit is going to deploy something like that then I need to know about it and how it work such that I can provide the right assurances for an exemption from Cyber.

Can someone please point me to a page in the documentation, or update the documentation to include some detailed information on the use of Container Instances by the toolkit? Thanks.

[flanakin]

Azure deployment scripts use Azure Container Instance. We don't use it directly. I'm not sure how this will impact you. Fwiw, I think this is mostly an issue when private endpoints are used. That's when we need a separate storage account at least.

@MSBrett, do you have any other insights on this?

[MSBrett]

@philipstreet - We don't use ACI directly. Deployment scripts use ACI under the hood. Here are the docs for bicep deployment scripts:

• Use deployment scripts in Bicep
• Run Bicep deployment script privately over a private endpoint
• FinOps Toolkit Private Network

ADLS doesn't support the file endpoint which is required when running deployment scripts behind private endpoints so we have to create some backing storage in that scenario rather than being able to use the blob endpoint like we can when public.

[philipstreet]

Thanks @MSBrett and @flanakin. OK, so the ACIs are only used during the Toolkit install/upgrade.

Thanks for the links. Hopefully they will address any concerns from our Cyber team. 🤞

[flanakin]

@philipstreet Any news? I'm curious how things turned out!

[philipstreet]

@flanakin after reviewing with Cyber team we're going to deploy a Hub in public mode in our Sandbox env.

Do you have a timeframe for the next release?

[flanakin]

Working on it right now... Let's say by Monday to pad it... 🤞