You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
[Azure.VNET.FirewallSubnet](Azure.VNET.FirewallSubnet.md) | Use Azure Firewall to filter network traffic to and from Azure resources. | Important | Error
[Azure.VNET.FirewallSubnet](Azure.VNET.FirewallSubnet.md) | Use Azure Firewall to filter network traffic to and from Azure resources. | Important | Error
L --> M["Resolve property expressions\n(ExpressionBuilder)"]
66
+
M --> N[Emit resource to context]
67
+
K --> N
68
+
N --> O{More resources?}
69
+
O -->|Yes| I
70
+
O -->|No| P["Post-process\n(MaterializedDeploymentVisitor)\nNest children, materialize properties"]
71
+
P --> Q[Output expanded resources]
72
+
```
73
+
74
+
### Key components
75
+
76
+
The key source code components involved in the expansion process are:
77
+
78
+
Component | Source file | Description
79
+
---------- | ----------- | -----------
80
+
`BicepHelper` | `src/PSRule.Rules.Azure/Data/Bicep/BicepHelper.cs` | Invokes the Bicep CLI and coordinates expansion of Bicep and ARM files.
81
+
`DeploymentVisitor` | `src/PSRule.Rules.Azure/Arm/Deployments/DeploymentVisitor.cs` | The core visitor that walks the ARM deployment structure.
82
+
`MaterializedDeploymentVisitor` | `src/PSRule.Rules.Azure/Arm/Deployments/MaterializedDeploymentVisitor.cs` | Extends `DeploymentVisitor` to handle post-processing of emitted resources.
83
+
`ResourceDependencyGraph` | `src/PSRule.Rules.Azure/Arm/Deployments/ResourceDependencyGraph.cs` | Builds and resolves the dependency graph for resources in a deployment.
84
+
`ExpressionBuilder` | `src/PSRule.Rules.Azure/Arm/Expressions/ExpressionBuilder.cs` | Parses and evaluates ARM template expressions.
85
+
`Functions` | `src/PSRule.Rules.Azure/Arm/Expressions/Functions.cs` | Implementations of ARM template built-in functions used during expression evaluation.
86
+
47
87
## Building Bicep
48
88
49
89
Azure Bicep code syntax is a domain specific language provides a higher level of abstraction over ARM deployments.
@@ -55,6 +95,14 @@ As a result, the Bicep CLI must be installed and available prior to running the
55
95
56
96
To build a Bicep file, the Bicep CLI is invoked with `bicep build` or `bicep build-params` command.
57
97
98
+
!!! Implementation
99
+
The `BicepHelper` class (`src/PSRule.Rules.Azure/Data/Bicep/BicepHelper.cs`) is responsible for:
100
+
101
+
- Discovering the Bicep CLI.
102
+
- Spawning the Bicep CLI process.
103
+
- Calling `ProcessFile` for a `.bicep` file or `ProcessParamFile` for a `.bicepparam` file.
104
+
- Passing the resulting ARM template JSON to the deployment visitor for expansion.
105
+
58
106
### CLI discovery
59
107
60
108
To find an instance of the Bicep CLI, PSRule for Azure probes several paths, and uses the first instance found.
@@ -94,6 +142,10 @@ Secrets are a good example of this, as they should not be specified in the param
94
142
Definitions are the building blocks of the ARM deployment and may be reference by resources or other definitions.
95
143
For most cases, definitions are lazy loaded into the context of the deployment during expansion.
96
144
145
+
!!! Implementation
146
+
The `LazyParameter`, `LazyVariable`, and `LazyOutput` classes (in `src/PSRule.Rules.Azure/Arm/Deployments/`) implement this lazy loading pattern,
147
+
deferring evaluation of each definition until it is first referenced.
148
+
97
149
Exceptions to this are when copy loops are used to define variables and parameters.
98
150
Otherwise the definitions are not resolved until they are referenced by a resource.
99
151
@@ -107,6 +159,10 @@ Similarly, a deployment may return outputs that are used in the parent deploymen
107
159
As a result, each resource must be visited based on a dependency graph so that dependencies are resolved
108
160
before dependant resources.
109
161
162
+
!!! Implementation
163
+
The `ResourceDependencyGraph` class (`src/PSRule.Rules.Azure/Arm/Deployments/ResourceDependencyGraph.cs`) builds this graph
164
+
from the `dependsOn` properties declared in the template, and performs a topological sort to produce the correct visit order.
165
+
110
166
## Visiting each resource
111
167
112
168
When a resource is visited:
@@ -146,6 +202,16 @@ For each function to be understood by the expansion process, it must be implemen
146
202
147
203
When an expression is called, context about the deployment is passed into the root function of the expression.
0 commit comments