pulumi-django-azure 1.0.34__py3-none-any.whl → 1.0.35__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of pulumi-django-azure might be problematic. Click here for more details.
- pulumi_django_azure/azure_helper.py +38 -8
- pulumi_django_azure/django_deployment.py +20 -115
- pulumi_django_azure/management/commands/test_redis.py +248 -0
- pulumi_django_azure/middleware.py +16 -33
- pulumi_django_azure/settings.py +7 -22
- {pulumi_django_azure-1.0.34.dist-info → pulumi_django_azure-1.0.35.dist-info}/METADATA +246 -243
- pulumi_django_azure-1.0.35.dist-info/RECORD +13 -0
- {pulumi_django_azure-1.0.34.dist-info → pulumi_django_azure-1.0.35.dist-info}/WHEEL +1 -2
- pulumi_django_azure-1.0.34.dist-info/RECORD +0 -13
- pulumi_django_azure-1.0.34.dist-info/top_level.txt +0 -1
|
@@ -2,7 +2,9 @@ import base64
|
|
|
2
2
|
import json
|
|
3
3
|
import logging
|
|
4
4
|
import os
|
|
5
|
+
import time
|
|
5
6
|
from dataclasses import dataclass
|
|
7
|
+
from enum import Enum
|
|
6
8
|
from subprocess import check_output
|
|
7
9
|
|
|
8
10
|
from azure.identity import DefaultAzureCredential
|
|
@@ -15,6 +17,9 @@ logger = logging.getLogger("pulumi_django_azure.azure_helper")
|
|
|
15
17
|
# Azure credentials
|
|
16
18
|
AZURE_CREDENTIAL = DefaultAzureCredential()
|
|
17
19
|
|
|
20
|
+
# Buffer for token expiration (5 minutes)
|
|
21
|
+
TOKEN_EXPIRATION_BUFFER = 300
|
|
22
|
+
|
|
18
23
|
# Get the local IP addresses of the machine (only when runnig on Azure)
|
|
19
24
|
if os.environ.get("IS_AZURE_ENVIRONMENT"):
|
|
20
25
|
LOCAL_IP_ADDRESSES = check_output(["hostname", "--all-ip-addresses"]).decode("utf-8").strip().split(" ")
|
|
@@ -22,17 +27,44 @@ else:
|
|
|
22
27
|
LOCAL_IP_ADDRESSES = []
|
|
23
28
|
|
|
24
29
|
|
|
25
|
-
|
|
30
|
+
class TokenType(Enum):
|
|
31
|
+
DATABASE = "https://ossrdbms-aad.database.windows.net/.default"
|
|
32
|
+
REDIS = "https://redis.azure.com/.default"
|
|
33
|
+
|
|
34
|
+
|
|
35
|
+
def _get_azure_token(type: TokenType) -> str:
|
|
26
36
|
"""
|
|
27
|
-
Get a valid
|
|
37
|
+
Get a valid token for the given scope.
|
|
28
38
|
"""
|
|
29
|
-
|
|
39
|
+
global AZURE_CREDENTIAL
|
|
40
|
+
|
|
41
|
+
token = AZURE_CREDENTIAL.get_token(type.value)
|
|
42
|
+
|
|
43
|
+
if token.expires_on < time.time() + TOKEN_EXPIRATION_BUFFER:
|
|
44
|
+
# We received an expired or nearly expired token from the API. Force a new token by creating a new instance of the credential.
|
|
45
|
+
logger.debug(
|
|
46
|
+
"Received an expired or nearly expired %s token (current time: %s, token expiration: %s)."
|
|
47
|
+
"Creating a new instance of the credential.",
|
|
48
|
+
type.name,
|
|
49
|
+
time.time(),
|
|
50
|
+
token.expires_on,
|
|
51
|
+
)
|
|
52
|
+
|
|
53
|
+
AZURE_CREDENTIAL = DefaultAzureCredential()
|
|
54
|
+
token = AZURE_CREDENTIAL.get_token(type.value)
|
|
30
55
|
|
|
31
|
-
|
|
56
|
+
logger.debug("New %s token (try 2): %s", type.name, token)
|
|
32
57
|
|
|
33
58
|
return token.token
|
|
34
59
|
|
|
35
60
|
|
|
61
|
+
def get_db_password() -> str:
|
|
62
|
+
"""
|
|
63
|
+
Get a valid password for the database.
|
|
64
|
+
"""
|
|
65
|
+
return _get_azure_token(TokenType.DATABASE)
|
|
66
|
+
|
|
67
|
+
|
|
36
68
|
@dataclass
|
|
37
69
|
class RedisCredentials:
|
|
38
70
|
username: str
|
|
@@ -43,11 +75,9 @@ def get_redis_credentials() -> RedisCredentials:
|
|
|
43
75
|
"""
|
|
44
76
|
Get valid credentials for the Redis cache.
|
|
45
77
|
"""
|
|
46
|
-
token =
|
|
47
|
-
|
|
48
|
-
logger.debug("New Redis token: %s", token)
|
|
78
|
+
token = _get_azure_token(TokenType.REDIS)
|
|
49
79
|
|
|
50
|
-
return RedisCredentials(_extract_username_from_token(token
|
|
80
|
+
return RedisCredentials(_extract_username_from_token(token), token)
|
|
51
81
|
|
|
52
82
|
|
|
53
83
|
def get_subscription() -> Subscription:
|
|
@@ -4,6 +4,8 @@ import pulumi
|
|
|
4
4
|
import pulumi_azure_native as azure
|
|
5
5
|
import pulumi_random
|
|
6
6
|
|
|
7
|
+
REDIS_IMAGE = "redis:8.2"
|
|
8
|
+
|
|
7
9
|
|
|
8
10
|
class HostDefinition:
|
|
9
11
|
"""
|
|
@@ -71,8 +73,6 @@ class DjangoDeployment(pulumi.ComponentResource):
|
|
|
71
73
|
pgsql_parameters: dict[str, str] | None = None,
|
|
72
74
|
pgadmin_access_ip: Sequence[str] | None = None,
|
|
73
75
|
pgadmin_dns_zone: azure.dns.Zone | None = None,
|
|
74
|
-
cache_ip_prefix: str | None = None,
|
|
75
|
-
cache_sku: azure.redis.SkuArgs | None = None,
|
|
76
76
|
cdn_host: HostDefinition | None = None,
|
|
77
77
|
opts=None,
|
|
78
78
|
):
|
|
@@ -92,8 +92,6 @@ class DjangoDeployment(pulumi.ComponentResource):
|
|
|
92
92
|
:param pgsql_parameters: The parameters to set on the PostgreSQL server. (optional)
|
|
93
93
|
:param pgadmin_access_ip: The IP addresses to allow access to pgAdmin. If empty, all IP addresses are allowed.
|
|
94
94
|
:param pgadmin_dns_zone: The Azure DNS zone to a pgadmin DNS record in. (optional)
|
|
95
|
-
:param cache_ip_prefix: The IP prefix for the cache subnet. (optional)
|
|
96
|
-
:param cache_sku: The SKU for the cache. (optional)
|
|
97
95
|
:param cdn_host: A custom CDN host name. (optional)
|
|
98
96
|
:param opts: The resource options
|
|
99
97
|
"""
|
|
@@ -115,12 +113,6 @@ class DjangoDeployment(pulumi.ComponentResource):
|
|
|
115
113
|
# PostgreSQL resources
|
|
116
114
|
self._create_database(sku=pgsql_sku, ip_prefix=pgsql_ip_prefix, parameters=pgsql_parameters)
|
|
117
115
|
|
|
118
|
-
# Cache resources
|
|
119
|
-
if cache_ip_prefix and cache_sku:
|
|
120
|
-
self._create_cache(sku=cache_sku, ip_prefix=cache_ip_prefix)
|
|
121
|
-
else:
|
|
122
|
-
self._cache = None
|
|
123
|
-
|
|
124
116
|
# Subnet for the apps
|
|
125
117
|
self._app_subnet = self._create_subnet(
|
|
126
118
|
name="app-service",
|
|
@@ -325,91 +317,6 @@ class DjangoDeployment(pulumi.ComponentResource):
|
|
|
325
317
|
|
|
326
318
|
pulumi.export("pgsql_host", self._pgsql.fully_qualified_domain_name)
|
|
327
319
|
|
|
328
|
-
def _create_cache(self, sku: azure.redis.SkuArgs, ip_prefix: str):
|
|
329
|
-
# Create a Redis cache
|
|
330
|
-
self._cache = azure.redis.Redis(
|
|
331
|
-
f"cache-{self._name}",
|
|
332
|
-
resource_group_name=self._rg,
|
|
333
|
-
sku=sku,
|
|
334
|
-
enable_non_ssl_port=False,
|
|
335
|
-
public_network_access=azure.redis.PublicNetworkAccess.DISABLED,
|
|
336
|
-
# Disable access key authentication...
|
|
337
|
-
disable_access_key_authentication=True,
|
|
338
|
-
# ... and enable Entra ID authentication.
|
|
339
|
-
redis_configuration=azure.redis.RedisCommonPropertiesRedisConfigurationArgs(
|
|
340
|
-
aad_enabled="true",
|
|
341
|
-
),
|
|
342
|
-
)
|
|
343
|
-
|
|
344
|
-
# Create an access policy that gives us access to the cache
|
|
345
|
-
self._cache_access_policy = azure.redis.AccessPolicy(
|
|
346
|
-
f"cache-access-policy-{self._name}",
|
|
347
|
-
resource_group_name=self._rg,
|
|
348
|
-
cache_name=self._cache.name,
|
|
349
|
-
# Same as the built in Data Contributor policy + flushdb permissions
|
|
350
|
-
permissions="+@all -@dangerous +flushdb +cluster|info +cluster|nodes +cluster|slots allkeys",
|
|
351
|
-
)
|
|
352
|
-
|
|
353
|
-
# Allocate a subnet for the cache
|
|
354
|
-
subnet = self._create_subnet(
|
|
355
|
-
name="cache",
|
|
356
|
-
prefix=ip_prefix,
|
|
357
|
-
)
|
|
358
|
-
|
|
359
|
-
# Create a private DNS zone for the cache
|
|
360
|
-
dns = azure.privatedns.PrivateZone(
|
|
361
|
-
f"dns-cache-{self._name}",
|
|
362
|
-
resource_group_name=self._rg,
|
|
363
|
-
location="global",
|
|
364
|
-
private_zone_name="privatelink.redis.cache.windows.net",
|
|
365
|
-
)
|
|
366
|
-
|
|
367
|
-
# Link the private DNS zone to the VNet in order to make resolving work
|
|
368
|
-
azure.privatedns.VirtualNetworkLink(
|
|
369
|
-
f"vnet-link-cache-{self._name}",
|
|
370
|
-
resource_group_name=self._rg,
|
|
371
|
-
location="global",
|
|
372
|
-
private_zone_name=dns.name,
|
|
373
|
-
virtual_network=azure.network.SubResourceArgs(id=self._vnet.id),
|
|
374
|
-
registration_enabled=True,
|
|
375
|
-
)
|
|
376
|
-
|
|
377
|
-
# Create a private endpoint for the cache
|
|
378
|
-
endpoint = azure.network.PrivateEndpoint(
|
|
379
|
-
f"private-endpoint-cache-{self._name}",
|
|
380
|
-
resource_group_name=self._rg,
|
|
381
|
-
subnet=azure.network.SubnetArgs(id=subnet.id),
|
|
382
|
-
custom_network_interface_name=f"nic-cache-{self._name}",
|
|
383
|
-
private_link_service_connections=[
|
|
384
|
-
azure.network.PrivateLinkServiceConnectionArgs(
|
|
385
|
-
name=f"pls-cache-{self._name}",
|
|
386
|
-
private_link_service_id=self._cache.id,
|
|
387
|
-
group_ids=["redisCache"],
|
|
388
|
-
)
|
|
389
|
-
],
|
|
390
|
-
)
|
|
391
|
-
|
|
392
|
-
# Get the private IP address of the endpoint NIC
|
|
393
|
-
ip = endpoint.network_interfaces.apply(
|
|
394
|
-
lambda nics: azure.network.get_network_interface(
|
|
395
|
-
network_interface_name=nics[0].id.split("/")[-1],
|
|
396
|
-
resource_group_name=self._rg,
|
|
397
|
-
)
|
|
398
|
-
.ip_configurations[0]
|
|
399
|
-
.private_ip_address
|
|
400
|
-
)
|
|
401
|
-
|
|
402
|
-
# Create a DNS record for the cache
|
|
403
|
-
azure.privatedns.PrivateRecordSet(
|
|
404
|
-
f"dns-a-cache-{self._name}",
|
|
405
|
-
resource_group_name=self._rg,
|
|
406
|
-
private_zone_name=dns.name,
|
|
407
|
-
relative_record_set_name=self._cache.name,
|
|
408
|
-
record_type="A",
|
|
409
|
-
ttl=300,
|
|
410
|
-
a_records=[azure.privatedns.ARecordArgs(ipv4_address=ip)],
|
|
411
|
-
)
|
|
412
|
-
|
|
413
320
|
def _create_subnet(
|
|
414
321
|
self,
|
|
415
322
|
name,
|
|
@@ -866,7 +773,7 @@ class DjangoDeployment(pulumi.ComponentResource):
|
|
|
866
773
|
comms_domains: list[HostDefinition] | None = None,
|
|
867
774
|
dedicated_app_service_sku: azure.web.SkuDescriptionArgs | None = None,
|
|
868
775
|
vault_administrators: list[str] | None = None,
|
|
869
|
-
|
|
776
|
+
redis_cache: bool = True,
|
|
870
777
|
startup_timeout: int = 300,
|
|
871
778
|
) -> azure.web.WebApp:
|
|
872
779
|
"""
|
|
@@ -887,7 +794,7 @@ class DjangoDeployment(pulumi.ComponentResource):
|
|
|
887
794
|
:param comms_domains: The list of custom domains for the E-mail Communication Services (optional).
|
|
888
795
|
:param dedicated_app_service_sku: The SKU for the dedicated App Service Plan (optional).
|
|
889
796
|
:param vault_administrators: The principal IDs of the vault administrators (optional).
|
|
890
|
-
:param
|
|
797
|
+
:param redis_cache: Whether to create a Redis sidecar container.
|
|
891
798
|
:param startup_timeout: The startup timeout for the App Service (default is 300 seconds).
|
|
892
799
|
"""
|
|
893
800
|
|
|
@@ -917,6 +824,10 @@ class DjangoDeployment(pulumi.ComponentResource):
|
|
|
917
824
|
container_name=f"{name}-static",
|
|
918
825
|
)
|
|
919
826
|
|
|
827
|
+
# Redis cache environment variable
|
|
828
|
+
if redis_cache:
|
|
829
|
+
environment_variables["REDIS_SIDECAR"] = "true"
|
|
830
|
+
|
|
920
831
|
# Communication Services (optional)
|
|
921
832
|
if comms_data_location:
|
|
922
833
|
if not comms_domains:
|
|
@@ -937,12 +848,6 @@ class DjangoDeployment(pulumi.ComponentResource):
|
|
|
937
848
|
s = self._add_webapp_secret(vault, env_name, config_name, f"{name}-{self._name}")
|
|
938
849
|
environment_variables[f"{env_name}_SECRET_NAME"] = s.name
|
|
939
850
|
|
|
940
|
-
# Cache (we need to check explicitly if it is not None because the db could also be 0)
|
|
941
|
-
if self._cache and cache_db is not None:
|
|
942
|
-
environment_variables["REDIS_CACHE_HOST"] = self._cache.host_name
|
|
943
|
-
environment_variables["REDIS_CACHE_PORT"] = self._cache.ssl_port.apply(lambda port: str(port))
|
|
944
|
-
environment_variables["REDIS_CACHE_DB"] = str(cache_db)
|
|
945
|
-
|
|
946
851
|
# Create a Django Secret Key (random)
|
|
947
852
|
secret_key = pulumi_random.RandomString(f"django-secret-{name}-{self._name}", length=50)
|
|
948
853
|
|
|
@@ -1023,6 +928,18 @@ class DjangoDeployment(pulumi.ComponentResource):
|
|
|
1023
928
|
),
|
|
1024
929
|
)
|
|
1025
930
|
|
|
931
|
+
# Redis cache
|
|
932
|
+
if redis_cache:
|
|
933
|
+
azure.web.WebAppSiteContainer(
|
|
934
|
+
f"redis-cache-{name}-{self._name}",
|
|
935
|
+
resource_group_name=self._rg,
|
|
936
|
+
name=app.name,
|
|
937
|
+
is_main=False,
|
|
938
|
+
container_name="redis-cache",
|
|
939
|
+
image=REDIS_IMAGE,
|
|
940
|
+
target_port="6379",
|
|
941
|
+
)
|
|
942
|
+
|
|
1026
943
|
# We need this to create the database role and grant permissions
|
|
1027
944
|
principal_id = app.identity.apply(lambda identity: identity.principal_id)
|
|
1028
945
|
pulumi.export(f"{name}_site_principal_id", principal_id)
|
|
@@ -1148,18 +1065,6 @@ class DjangoDeployment(pulumi.ComponentResource):
|
|
|
1148
1065
|
scope=self._storage_account.id,
|
|
1149
1066
|
)
|
|
1150
1067
|
|
|
1151
|
-
# Grant the app access to the cache if needed.
|
|
1152
|
-
# We need to check explicitly if it is not None because the db could also be 0.
|
|
1153
|
-
if self._cache and cache_db is not None:
|
|
1154
|
-
azure.redis.AccessPolicyAssignment(
|
|
1155
|
-
f"ra-{name}-cache",
|
|
1156
|
-
resource_group_name=self._rg,
|
|
1157
|
-
cache_name=self._cache.name,
|
|
1158
|
-
object_id=principal_id,
|
|
1159
|
-
object_id_alias=f"app-{name}-managed-identity",
|
|
1160
|
-
access_policy_name=self._cache_access_policy.name,
|
|
1161
|
-
)
|
|
1162
|
-
|
|
1163
1068
|
# Grant the app to send e-mails
|
|
1164
1069
|
if comms:
|
|
1165
1070
|
comms_role = comms.id.apply(
|
|
@@ -0,0 +1,248 @@
|
|
|
1
|
+
"""
|
|
2
|
+
Management command to test Redis connectivity and functionality.
|
|
3
|
+
"""
|
|
4
|
+
|
|
5
|
+
import time
|
|
6
|
+
|
|
7
|
+
from django.conf import settings
|
|
8
|
+
from django.core.cache import cache
|
|
9
|
+
from django.core.management.base import BaseCommand, CommandError
|
|
10
|
+
|
|
11
|
+
|
|
12
|
+
class Command(BaseCommand):
|
|
13
|
+
help = "Test Redis connectivity and basic functionality"
|
|
14
|
+
|
|
15
|
+
def add_arguments(self, parser):
|
|
16
|
+
parser.add_argument(
|
|
17
|
+
"--detailed",
|
|
18
|
+
action="store_true",
|
|
19
|
+
help="Show detailed Redis information and run comprehensive tests",
|
|
20
|
+
)
|
|
21
|
+
parser.add_argument(
|
|
22
|
+
"--quiet",
|
|
23
|
+
action="store_true",
|
|
24
|
+
help="Only show errors and final status",
|
|
25
|
+
)
|
|
26
|
+
|
|
27
|
+
def handle(self, *args, **options):
|
|
28
|
+
verbosity = 0 if options["quiet"] else (2 if options["detailed"] else 1)
|
|
29
|
+
|
|
30
|
+
if verbosity >= 1:
|
|
31
|
+
self.stdout.write("Testing Redis connectivity...")
|
|
32
|
+
self.stdout.write("-" * 50)
|
|
33
|
+
|
|
34
|
+
try:
|
|
35
|
+
# Test basic connectivity
|
|
36
|
+
self._test_basic_connectivity(verbosity)
|
|
37
|
+
|
|
38
|
+
# Test basic cache operations
|
|
39
|
+
self._test_cache_operations(verbosity)
|
|
40
|
+
|
|
41
|
+
# If detailed mode, run additional tests
|
|
42
|
+
if options["detailed"]:
|
|
43
|
+
self._test_detailed_operations(verbosity)
|
|
44
|
+
self._show_cache_info(verbosity)
|
|
45
|
+
|
|
46
|
+
if verbosity >= 1:
|
|
47
|
+
self.stdout.write(self.style.SUCCESS("✓ All Redis tests passed successfully!"))
|
|
48
|
+
|
|
49
|
+
except Exception as e:
|
|
50
|
+
if verbosity >= 1:
|
|
51
|
+
self.stdout.write(self.style.ERROR(f"✗ Redis test failed: {str(e)}"))
|
|
52
|
+
raise CommandError(f"Redis connectivity test failed: {str(e)}") from e
|
|
53
|
+
|
|
54
|
+
def _test_basic_connectivity(self, verbosity):
|
|
55
|
+
"""Test basic Redis connectivity."""
|
|
56
|
+
if verbosity >= 2:
|
|
57
|
+
self.stdout.write("Testing basic connectivity...")
|
|
58
|
+
|
|
59
|
+
try:
|
|
60
|
+
# Try to set and get a simple value
|
|
61
|
+
cache.set("redis_test_key", "test_value", 30)
|
|
62
|
+
value = cache.get("redis_test_key")
|
|
63
|
+
|
|
64
|
+
if value != "test_value":
|
|
65
|
+
raise Exception("Failed to retrieve test value from cache")
|
|
66
|
+
|
|
67
|
+
# Clean up
|
|
68
|
+
cache.delete("redis_test_key")
|
|
69
|
+
|
|
70
|
+
if verbosity >= 2:
|
|
71
|
+
self.stdout.write(self.style.SUCCESS(" ✓ Basic connectivity test passed"))
|
|
72
|
+
|
|
73
|
+
except Exception as e:
|
|
74
|
+
raise Exception(f"Basic connectivity test failed: {str(e)}") from e
|
|
75
|
+
|
|
76
|
+
def _test_cache_operations(self, verbosity):
|
|
77
|
+
"""Test various cache operations."""
|
|
78
|
+
if verbosity >= 2:
|
|
79
|
+
self.stdout.write("Testing cache operations...")
|
|
80
|
+
|
|
81
|
+
test_data = {
|
|
82
|
+
"string_test": "Hello Redis!",
|
|
83
|
+
"number_test": 42,
|
|
84
|
+
"dict_test": {"key": "value", "nested": {"data": True}},
|
|
85
|
+
"list_test": [1, 2, 3, "four", 5.0],
|
|
86
|
+
}
|
|
87
|
+
|
|
88
|
+
try:
|
|
89
|
+
# Test different data types
|
|
90
|
+
for key, value in test_data.items():
|
|
91
|
+
cache.set(f"test_{key}", value, 60)
|
|
92
|
+
retrieved_value = cache.get(f"test_{key}")
|
|
93
|
+
|
|
94
|
+
if retrieved_value != value:
|
|
95
|
+
raise Exception(f"Data mismatch for {key}: expected {value}, got {retrieved_value}")
|
|
96
|
+
|
|
97
|
+
if verbosity >= 2:
|
|
98
|
+
self.stdout.write(f" ✓ {key}: {type(value).__name__} data test passed")
|
|
99
|
+
|
|
100
|
+
# Test cache.get_or_set
|
|
101
|
+
default_value = "default_from_function"
|
|
102
|
+
result = cache.get_or_set("test_get_or_set", default_value, 60)
|
|
103
|
+
if result != default_value:
|
|
104
|
+
raise Exception("get_or_set test failed")
|
|
105
|
+
|
|
106
|
+
if verbosity >= 2:
|
|
107
|
+
self.stdout.write(" ✓ get_or_set operation test passed")
|
|
108
|
+
|
|
109
|
+
# Test cache.add (should fail on existing key)
|
|
110
|
+
if cache.add("test_string_test", "should_not_override"):
|
|
111
|
+
raise Exception("add() should have failed on existing key")
|
|
112
|
+
|
|
113
|
+
if verbosity >= 2:
|
|
114
|
+
self.stdout.write(" ✓ add operation test passed")
|
|
115
|
+
|
|
116
|
+
# Test cache expiration
|
|
117
|
+
cache.set("test_expiration", "will_expire", 1)
|
|
118
|
+
time.sleep(1.1) # Wait for expiration
|
|
119
|
+
expired_value = cache.get("test_expiration")
|
|
120
|
+
if expired_value is not None:
|
|
121
|
+
raise Exception("Cache expiration test failed - value should have expired")
|
|
122
|
+
|
|
123
|
+
if verbosity >= 2:
|
|
124
|
+
self.stdout.write(" ✓ Cache expiration test passed")
|
|
125
|
+
|
|
126
|
+
# Clean up test keys
|
|
127
|
+
for key in test_data:
|
|
128
|
+
cache.delete(f"test_{key}")
|
|
129
|
+
cache.delete("test_get_or_set")
|
|
130
|
+
|
|
131
|
+
if verbosity >= 2:
|
|
132
|
+
self.stdout.write(self.style.SUCCESS(" ✓ All cache operations tests passed"))
|
|
133
|
+
|
|
134
|
+
except Exception as e:
|
|
135
|
+
raise Exception(f"Cache operations test failed: {str(e)}") from e
|
|
136
|
+
|
|
137
|
+
def _test_detailed_operations(self, verbosity):
|
|
138
|
+
"""Run detailed Redis operations tests."""
|
|
139
|
+
if verbosity >= 2:
|
|
140
|
+
self.stdout.write("Running detailed operations...")
|
|
141
|
+
|
|
142
|
+
try:
|
|
143
|
+
# Test cache.get_many and set_many
|
|
144
|
+
test_data = {
|
|
145
|
+
"bulk_key_1": "value_1",
|
|
146
|
+
"bulk_key_2": "value_2",
|
|
147
|
+
"bulk_key_3": "value_3",
|
|
148
|
+
}
|
|
149
|
+
|
|
150
|
+
cache.set_many(test_data, 60)
|
|
151
|
+
retrieved_data = cache.get_many(test_data.keys())
|
|
152
|
+
|
|
153
|
+
for key, expected_value in test_data.items():
|
|
154
|
+
if retrieved_data.get(key) != expected_value:
|
|
155
|
+
raise Exception(f"Bulk operation failed for key {key}")
|
|
156
|
+
|
|
157
|
+
if verbosity >= 2:
|
|
158
|
+
self.stdout.write(" ✓ Bulk operations (set_many/get_many) test passed")
|
|
159
|
+
|
|
160
|
+
# Test cache.delete_many
|
|
161
|
+
cache.delete_many(test_data.keys())
|
|
162
|
+
remaining_data = cache.get_many(test_data.keys())
|
|
163
|
+
if any(remaining_data.values()):
|
|
164
|
+
raise Exception("delete_many operation failed")
|
|
165
|
+
|
|
166
|
+
if verbosity >= 2:
|
|
167
|
+
self.stdout.write(" ✓ Bulk delete (delete_many) test passed")
|
|
168
|
+
|
|
169
|
+
# Test cache versioning if supported
|
|
170
|
+
try:
|
|
171
|
+
cache.set("version_test", "version_1", 60, version=1)
|
|
172
|
+
cache.set("version_test", "version_2", 60, version=2)
|
|
173
|
+
|
|
174
|
+
v1_value = cache.get("version_test", version=1)
|
|
175
|
+
v2_value = cache.get("version_test", version=2)
|
|
176
|
+
|
|
177
|
+
if v1_value == "version_1" and v2_value == "version_2":
|
|
178
|
+
if verbosity >= 2:
|
|
179
|
+
self.stdout.write(" ✓ Cache versioning test passed")
|
|
180
|
+
else:
|
|
181
|
+
if verbosity >= 2:
|
|
182
|
+
self.stdout.write(" ! Cache versioning not supported or failed")
|
|
183
|
+
|
|
184
|
+
cache.delete("version_test", version=1)
|
|
185
|
+
cache.delete("version_test", version=2)
|
|
186
|
+
|
|
187
|
+
except Exception:
|
|
188
|
+
if verbosity >= 2:
|
|
189
|
+
self.stdout.write(" ! Cache versioning not supported")
|
|
190
|
+
|
|
191
|
+
except Exception as e:
|
|
192
|
+
raise Exception(f"Detailed operations test failed: {str(e)}") from e
|
|
193
|
+
|
|
194
|
+
def _show_cache_info(self, verbosity):
|
|
195
|
+
"""Show information about the cache configuration."""
|
|
196
|
+
if verbosity >= 2:
|
|
197
|
+
self.stdout.write("\nCache Configuration Information:")
|
|
198
|
+
self.stdout.write("-" * 35)
|
|
199
|
+
|
|
200
|
+
# Show cache backend information
|
|
201
|
+
cache_config = getattr(settings, "CACHES", {}).get("default", {})
|
|
202
|
+
backend = cache_config.get("BACKEND", "Unknown")
|
|
203
|
+
location = cache_config.get("LOCATION", "Not specified")
|
|
204
|
+
|
|
205
|
+
self.stdout.write(f"Backend: {backend}")
|
|
206
|
+
self.stdout.write(f"Location: {location}")
|
|
207
|
+
|
|
208
|
+
# Show cache options if any
|
|
209
|
+
options = cache_config.get("OPTIONS", {})
|
|
210
|
+
if options:
|
|
211
|
+
self.stdout.write("Options:")
|
|
212
|
+
for key, value in options.items():
|
|
213
|
+
# Don't show sensitive information like passwords
|
|
214
|
+
if "password" in key.lower() or "secret" in key.lower():
|
|
215
|
+
value = "***hidden***"
|
|
216
|
+
self.stdout.write(f" {key}: {value}")
|
|
217
|
+
|
|
218
|
+
# Try to get cache stats if available
|
|
219
|
+
try:
|
|
220
|
+
if hasattr(cache, "_cache") and hasattr(cache._cache, "get_stats"):
|
|
221
|
+
stats = cache._cache.get_stats()
|
|
222
|
+
if stats:
|
|
223
|
+
self.stdout.write("\nCache Statistics:")
|
|
224
|
+
for stat_key, stat_value in stats.items():
|
|
225
|
+
self.stdout.write(f" {stat_key}: {stat_value}")
|
|
226
|
+
except Exception:
|
|
227
|
+
pass # Stats not available
|
|
228
|
+
|
|
229
|
+
# Test if we can determine Redis info
|
|
230
|
+
try:
|
|
231
|
+
# Try to access Redis client directly if using django-redis
|
|
232
|
+
if hasattr(cache, "_cache") and hasattr(cache._cache, "_client"):
|
|
233
|
+
client = cache._cache._client
|
|
234
|
+
if hasattr(client, "connection_pool"):
|
|
235
|
+
pool = client.connection_pool
|
|
236
|
+
self.stdout.write("\nConnection Pool Info:")
|
|
237
|
+
self.stdout.write(f" Max connections: {getattr(pool, 'max_connections', 'Unknown')}")
|
|
238
|
+
self.stdout.write(f" Connection class: {getattr(pool, 'connection_class', 'Unknown')}")
|
|
239
|
+
|
|
240
|
+
connection_kwargs = getattr(pool, "connection_kwargs", {})
|
|
241
|
+
if connection_kwargs:
|
|
242
|
+
self.stdout.write(" Connection parameters:")
|
|
243
|
+
for key, value in connection_kwargs.items():
|
|
244
|
+
if "password" in key.lower():
|
|
245
|
+
value = "***hidden***"
|
|
246
|
+
self.stdout.write(f" {key}: {value}")
|
|
247
|
+
except Exception:
|
|
248
|
+
pass # Redis-specific info not available
|
|
@@ -1,14 +1,12 @@
|
|
|
1
1
|
import logging
|
|
2
2
|
import os
|
|
3
|
+
import signal
|
|
3
4
|
|
|
4
5
|
from django.conf import settings
|
|
5
|
-
from django.core.cache import cache
|
|
6
6
|
from django.db import connection
|
|
7
|
-
from django.db.utils import OperationalError
|
|
8
7
|
from django.http import HttpResponse
|
|
9
|
-
from django_redis import get_redis_connection
|
|
10
8
|
|
|
11
|
-
from .azure_helper import get_db_password
|
|
9
|
+
from .azure_helper import get_db_password
|
|
12
10
|
|
|
13
11
|
logger = logging.getLogger("pulumi_django_azure.health_check")
|
|
14
12
|
|
|
@@ -18,9 +16,20 @@ class HealthCheckMiddleware:
|
|
|
18
16
|
self.get_response = get_response
|
|
19
17
|
|
|
20
18
|
def _self_heal(self):
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
os.
|
|
19
|
+
logger.warning("Self-healing by gracefully restarting Gunicorn.")
|
|
20
|
+
|
|
21
|
+
master_pid = os.getppid()
|
|
22
|
+
|
|
23
|
+
logger.debug("Master PID: %d", master_pid)
|
|
24
|
+
|
|
25
|
+
# https://docs.gunicorn.org/en/latest/signals.html
|
|
26
|
+
|
|
27
|
+
# Reload a new master with new workers,
|
|
28
|
+
# since the application is preloaded this is the only safe way for now.
|
|
29
|
+
os.kill(master_pid, signal.SIGUSR2)
|
|
30
|
+
|
|
31
|
+
# Gracefully shutdown the current workers
|
|
32
|
+
os.kill(master_pid, signal.SIGTERM)
|
|
24
33
|
|
|
25
34
|
def __call__(self, request):
|
|
26
35
|
if request.path == settings.HEALTH_CHECK_PATH:
|
|
@@ -43,41 +52,15 @@ class HealthCheckMiddleware:
|
|
|
43
52
|
self._self_heal()
|
|
44
53
|
return HttpResponse(status=503)
|
|
45
54
|
|
|
46
|
-
# Update the Redis credentials if needed
|
|
47
|
-
if settings.AZURE_REDIS_CREDENTIALS:
|
|
48
|
-
try:
|
|
49
|
-
current_redis_password = settings.CACHES["default"]["OPTIONS"]["PASSWORD"]
|
|
50
|
-
redis_credentials = get_redis_credentials()
|
|
51
|
-
|
|
52
|
-
if redis_credentials.password != current_redis_password:
|
|
53
|
-
logger.debug("Redis password has changed, updating credentials")
|
|
54
|
-
|
|
55
|
-
# Re-authenticate the Redis connection
|
|
56
|
-
redis_connection = get_redis_connection("default")
|
|
57
|
-
redis_connection.execute_command("AUTH", redis_credentials.username, redis_credentials.password)
|
|
58
|
-
|
|
59
|
-
settings.CACHES["default"]["OPTIONS"]["PASSWORD"] = redis_credentials.password
|
|
60
|
-
else:
|
|
61
|
-
logger.debug("Redis password unchanged, keeping existing credentials")
|
|
62
|
-
except Exception as e:
|
|
63
|
-
logger.error("Failed to update Redis credentials: %s", str(e))
|
|
64
|
-
self._self_heal()
|
|
65
|
-
return HttpResponse(status=503)
|
|
66
|
-
|
|
67
55
|
try:
|
|
68
56
|
# Test the database connection
|
|
69
57
|
connection.ensure_connection()
|
|
70
58
|
logger.debug("Database connection check passed")
|
|
71
59
|
|
|
72
|
-
# Test the Redis connection
|
|
73
|
-
cache.set("health_check", "test")
|
|
74
|
-
logger.debug("Redis connection check passed")
|
|
75
|
-
|
|
76
60
|
return HttpResponse("OK")
|
|
77
61
|
|
|
78
62
|
except Exception as e:
|
|
79
63
|
logger.error("Health check failed with unexpected error: %s", str(e))
|
|
80
|
-
logger.warning("Self-healing by gracefully restarting workers.")
|
|
81
64
|
self._self_heal()
|
|
82
65
|
return HttpResponse(status=503)
|
|
83
66
|
|
pulumi_django_azure/settings.py
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import environ
|
|
2
2
|
from azure.keyvault.secrets import SecretClient
|
|
3
3
|
|
|
4
|
-
from .azure_helper import AZURE_CREDENTIAL, LOCAL_IP_ADDRESSES, get_db_password,
|
|
4
|
+
from .azure_helper import AZURE_CREDENTIAL, LOCAL_IP_ADDRESSES, get_db_password, get_subscription
|
|
5
5
|
|
|
6
6
|
env = environ.Env()
|
|
7
7
|
|
|
@@ -104,7 +104,7 @@ if IS_AZURE_ENVIRONMENT:
|
|
|
104
104
|
"disable_existing_loggers": False,
|
|
105
105
|
"formatters": {
|
|
106
106
|
"timestamped": {
|
|
107
|
-
"format": "{asctime} {levelname} {message}",
|
|
107
|
+
"format": "{asctime} {levelname} [p:{process:d}] [t:{thread:d}] {message}",
|
|
108
108
|
"style": "{",
|
|
109
109
|
},
|
|
110
110
|
},
|
|
@@ -127,42 +127,27 @@ if IS_AZURE_ENVIRONMENT:
|
|
|
127
127
|
},
|
|
128
128
|
"pulumi_django_azure": {
|
|
129
129
|
"handlers": ["file"],
|
|
130
|
-
"level": "
|
|
130
|
+
"level": "DEBUG",
|
|
131
131
|
"propagate": True,
|
|
132
132
|
},
|
|
133
133
|
},
|
|
134
134
|
}
|
|
135
135
|
|
|
136
136
|
# Redis, if enabled
|
|
137
|
-
|
|
138
|
-
redis_cache_port = env("REDIS_CACHE_PORT", default=None)
|
|
139
|
-
redis_cache_db = env("REDIS_CACHE_DB", default=None)
|
|
140
|
-
|
|
141
|
-
if redis_cache_host and redis_cache_port and redis_cache_db:
|
|
142
|
-
# This will enable the health check to update the Redis credentials
|
|
143
|
-
AZURE_REDIS_CREDENTIALS = True
|
|
137
|
+
REDIS_SIDECAR = env("REDIS_SIDECAR", default=False)
|
|
144
138
|
|
|
145
|
-
|
|
139
|
+
if REDIS_SIDECAR:
|
|
140
|
+
# This will prevent the website from failing if Redis is not available.
|
|
146
141
|
DJANGO_REDIS_IGNORE_EXCEPTIONS = True
|
|
147
142
|
DJANGO_REDIS_LOG_IGNORED_EXCEPTIONS = True
|
|
148
143
|
|
|
149
|
-
REDIS_CACHE_HOST = redis_cache_host
|
|
150
|
-
REDIS_CACHE_PORT = redis_cache_port
|
|
151
|
-
REDIS_CACHE_DB = redis_cache_db
|
|
152
|
-
redis_credentials = get_redis_credentials()
|
|
153
|
-
REDIS_USERNAME = redis_credentials.username
|
|
154
|
-
REDIS_PASSWORD = redis_credentials.password
|
|
155
|
-
|
|
156
144
|
CACHES = {
|
|
157
145
|
"default": {
|
|
158
146
|
"BACKEND": "django_redis.cache.RedisCache",
|
|
159
|
-
"LOCATION":
|
|
147
|
+
"LOCATION": "redis://localhost:6379/0",
|
|
160
148
|
"OPTIONS": {
|
|
161
149
|
"CLIENT_CLASS": "django_redis.client.DefaultClient",
|
|
162
150
|
"PARSER_CLASS": "redis.connection._HiredisParser",
|
|
163
|
-
"PASSWORD": REDIS_PASSWORD,
|
|
164
151
|
},
|
|
165
152
|
},
|
|
166
153
|
}
|
|
167
|
-
else:
|
|
168
|
-
AZURE_REDIS_CREDENTIALS = False
|
|
@@ -1,243 +1,246 @@
|
|
|
1
|
-
Metadata-Version: 2.
|
|
2
|
-
Name: pulumi-django-azure
|
|
3
|
-
Version: 1.0.
|
|
4
|
-
Summary: Simply deployment of Django on Azure with Pulumi
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
Classifier: Programming Language :: Python
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
Requires-Dist: azure-
|
|
14
|
-
Requires-Dist: azure-
|
|
15
|
-
Requires-Dist: azure-mgmt-
|
|
16
|
-
Requires-Dist:
|
|
17
|
-
Requires-Dist: django
|
|
18
|
-
Requires-Dist: django-
|
|
19
|
-
Requires-Dist: django-
|
|
20
|
-
Requires-Dist: django-
|
|
21
|
-
Requires-Dist:
|
|
22
|
-
Requires-Dist: pulumi>=3.
|
|
23
|
-
Requires-Dist: pulumi-
|
|
24
|
-
Requires-Dist:
|
|
25
|
-
Requires-Dist:
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
*
|
|
35
|
-
*
|
|
36
|
-
*
|
|
37
|
-
* Azure
|
|
38
|
-
* Webapp
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
##
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
```
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
```
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
pulumi config set --secret --path 'mywebsite_social_auth_azure.
|
|
190
|
-
pulumi config set --secret --path 'mywebsite_social_auth_azure.
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
|
|
216
|
-
|
|
217
|
-
|
|
218
|
-
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
|
|
224
|
-
|
|
225
|
-
|
|
226
|
-
|
|
227
|
-
|
|
228
|
-
|
|
229
|
-
|
|
230
|
-
|
|
231
|
-
|
|
232
|
-
```
|
|
233
|
-
|
|
234
|
-
```
|
|
235
|
-
|
|
236
|
-
|
|
237
|
-
|
|
238
|
-
|
|
239
|
-
|
|
240
|
-
|
|
241
|
-
|
|
242
|
-
|
|
243
|
-
|
|
1
|
+
Metadata-Version: 2.3
|
|
2
|
+
Name: pulumi-django-azure
|
|
3
|
+
Version: 1.0.35
|
|
4
|
+
Summary: Simply deployment of Django on Azure with Pulumi
|
|
5
|
+
License: MIT
|
|
6
|
+
Keywords: django,pulumi,azure
|
|
7
|
+
Author: Maarten Ureel
|
|
8
|
+
Author-email: maarten@youreal.eu
|
|
9
|
+
Requires-Python: >=3.11,<3.14
|
|
10
|
+
Classifier: Programming Language :: Python
|
|
11
|
+
Classifier: Programming Language :: Python :: 3
|
|
12
|
+
Requires-Dist: azure-identity (>=1.24.0,<2.0.0)
|
|
13
|
+
Requires-Dist: azure-keyvault-secrets (>=4.10.0,<5.0.0)
|
|
14
|
+
Requires-Dist: azure-mgmt-cdn (>=13.1.1,<14.0.0)
|
|
15
|
+
Requires-Dist: azure-mgmt-resource (>=24.0.0,<25.0.0)
|
|
16
|
+
Requires-Dist: django (>=5.2.5,<6.0.0)
|
|
17
|
+
Requires-Dist: django-azure-communication-email (>=1.3.2,<2.0.0)
|
|
18
|
+
Requires-Dist: django-environ (>=0.12.0,<0.13.0)
|
|
19
|
+
Requires-Dist: django-redis (>=6.0.0,<7.0.0)
|
|
20
|
+
Requires-Dist: django-storages[azure] (>=1.14.6,<2.0.0)
|
|
21
|
+
Requires-Dist: pulumi (>=3.189.0)
|
|
22
|
+
Requires-Dist: pulumi-azure-native (>=3.7.1)
|
|
23
|
+
Requires-Dist: pulumi-random (>=4.18.3)
|
|
24
|
+
Requires-Dist: redis[hiredis] (>=6.4.0,<7.0.0)
|
|
25
|
+
Requires-Dist: tenacity (>=9.1.2,<10.0.0)
|
|
26
|
+
Project-URL: Homepage, https://gitlab.com/MaartenUreel/pulumi-django-azure
|
|
27
|
+
Description-Content-Type: text/markdown
|
|
28
|
+
|
|
29
|
+
# Pulumi Django Deployment
|
|
30
|
+
|
|
31
|
+
This project aims to make a simple Django deployment on Azure easier.
|
|
32
|
+
|
|
33
|
+
To have a proper and secure environment, we need these components:
|
|
34
|
+
* Storage account for media and static files
|
|
35
|
+
* CDN endpoint in front with a domain name of our choosing
|
|
36
|
+
* PostgreSQL server
|
|
37
|
+
* Azure Communication Services to send e-mails
|
|
38
|
+
* Webapp with multiple custom host names and managed SSL for the website itself
|
|
39
|
+
* Azure Key Vault per application
|
|
40
|
+
* Webapp running pgAdmin
|
|
41
|
+
|
|
42
|
+
## Project requirements
|
|
43
|
+
|
|
44
|
+
## Installation
|
|
45
|
+
This package is published on PyPi, so you can just add pulumi-django-azure to your requirements file.
|
|
46
|
+
|
|
47
|
+
To use a specific branch in your project, add to pyproject.toml dependencies:
|
|
48
|
+
```
|
|
49
|
+
pulumi-django-azure = { git = "git@gitlab.com:MaartenUreel/pulumi-django-azure.git", branch = "dev" }
|
|
50
|
+
```
|
|
51
|
+
|
|
52
|
+
A simple project could look like this:
|
|
53
|
+
```python
|
|
54
|
+
import pulumi
|
|
55
|
+
import pulumi_azure_native as azure
|
|
56
|
+
from pulumi_django_azure import DjangoDeployment
|
|
57
|
+
|
|
58
|
+
stack = pulumi.get_stack()
|
|
59
|
+
config = pulumi.Config()
|
|
60
|
+
|
|
61
|
+
|
|
62
|
+
# Create resource group
|
|
63
|
+
rg = azure.resources.ResourceGroup(f"rg-{stack}")
|
|
64
|
+
|
|
65
|
+
# Create VNet
|
|
66
|
+
vnet = azure.network.VirtualNetwork(
|
|
67
|
+
f"vnet-{stack}",
|
|
68
|
+
resource_group_name=rg.name,
|
|
69
|
+
address_space=azure.network.AddressSpaceArgs(
|
|
70
|
+
address_prefixes=["10.0.0.0/16"],
|
|
71
|
+
),
|
|
72
|
+
)
|
|
73
|
+
|
|
74
|
+
# Deploy the website and all its components
|
|
75
|
+
django = DjangoDeployment(
|
|
76
|
+
stack,
|
|
77
|
+
tenant_id="abc123...",
|
|
78
|
+
resource_group_name=rg.name,
|
|
79
|
+
vnet=vnet,
|
|
80
|
+
pgsql_ip_prefix="10.0.10.0/24",
|
|
81
|
+
appservice_ip_prefix="10.0.20.0/24",
|
|
82
|
+
app_service_sku=azure.web.SkuDescriptionArgs(
|
|
83
|
+
name="B2",
|
|
84
|
+
tier="Basic",
|
|
85
|
+
),
|
|
86
|
+
storage_account_name="mystorageaccount",
|
|
87
|
+
cdn_host="cdn.example.com",
|
|
88
|
+
)
|
|
89
|
+
|
|
90
|
+
django.add_django_website(
|
|
91
|
+
name="web",
|
|
92
|
+
db_name="mywebsite",
|
|
93
|
+
repository_url="git@gitlab.com:project/website.git",
|
|
94
|
+
repository_branch="main",
|
|
95
|
+
website_hosts=["example.com", "www.example.com"],
|
|
96
|
+
django_settings_module="mywebsite.settings.production",
|
|
97
|
+
comms_data_location="europe",
|
|
98
|
+
comms_domains=["mydomain.com"],
|
|
99
|
+
)
|
|
100
|
+
|
|
101
|
+
django.add_database_administrator(
|
|
102
|
+
object_id="a1b2c3....",
|
|
103
|
+
user_name="user@example.com",
|
|
104
|
+
tenant_id="a1b2c3....",
|
|
105
|
+
)
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
## Changes to your Django project
|
|
109
|
+
1. Add `pulumi_django_azure` to your `INSTALLED_APPS`
|
|
110
|
+
2. Add to your settings file:
|
|
111
|
+
```python
|
|
112
|
+
from pulumi_django_azure.settings import * # noqa: F403
|
|
113
|
+
|
|
114
|
+
# This will provide the management command to purge the CDN and cache
|
|
115
|
+
INSTALLED_APPS += ["pulumi_django_azure"]
|
|
116
|
+
|
|
117
|
+
# This will provide the health check middleware that will also take care of credential rotation.
|
|
118
|
+
MIDDLEWARE += ["pulumi_django_azure.middleware.HealthCheckMiddleware"]
|
|
119
|
+
```
|
|
120
|
+
This will pre-configure most settings to make your app work on Azure. You can check the source for details,
|
|
121
|
+
and ofcourse override any value after importing them.
|
|
122
|
+
|
|
123
|
+
|
|
124
|
+
## Deployment steps
|
|
125
|
+
1. Deploy without custom hosts (for CDN and websites)
|
|
126
|
+
2. Configure the PostgreSQL server (create and grant permissions to role for your websites)
|
|
127
|
+
3. Retrieve the deployment SSH key and configure your remote GIT repository with it
|
|
128
|
+
4. Configure your CDN host (add the CNAME record)
|
|
129
|
+
5. Configure your custom website domains (add CNAME/A record and TXT validation records)
|
|
130
|
+
6. Re-deploy with custom hosts
|
|
131
|
+
7. Re-deploy once more to enable HTTPS on website domains
|
|
132
|
+
8. Manually activate HTTPS on the CDN host
|
|
133
|
+
9. Go to the e-mail communications service on Azure and configure DKIM, SPF,... for your custom domains.
|
|
134
|
+
|
|
135
|
+
## Custom domain name for CDN
|
|
136
|
+
When deploying the first time, you will get a `cdn_cname` output. You need to create a CNAME to this domain before the deployment of the custom domain will succeed.
|
|
137
|
+
|
|
138
|
+
You can safely deploy with the failing CustomDomain to get the CNAME, create the record and then deploy again.
|
|
139
|
+
|
|
140
|
+
To enable HTTPS, you need to do this manually in the console. This is because of a limitation in the Azure API:
|
|
141
|
+
https://github.com/Azure/azure-rest-api-specs/issues/17498
|
|
142
|
+
|
|
143
|
+
## Custom domain names for web application
|
|
144
|
+
Because of a circular dependency in custom domain name bindings and certificates that is out of our control, you need to deploy the stack twice.
|
|
145
|
+
|
|
146
|
+
The first time will create the bindings without a certificate.
|
|
147
|
+
The second deployment will then create the certificate for the domain (which is only possible if the binding exists), but also set the fingerprint of that certificate on the binding.
|
|
148
|
+
|
|
149
|
+
To make the certificate work, you need to create a TXT record named `asuid` point to the output of `{your_app}_site_domain_verification_id`. For example:
|
|
150
|
+
|
|
151
|
+
```
|
|
152
|
+
asuid.mywebsite.com. TXT "A1B2C3D4E5..."
|
|
153
|
+
asuid.www.mywebsite.com. TXT "A1B2C3D4E5..."
|
|
154
|
+
```
|
|
155
|
+
|
|
156
|
+
## Database authentication
|
|
157
|
+
The PostgreSQL uses Entra ID authentication only, no passwords.
|
|
158
|
+
|
|
159
|
+
### Administrator login
|
|
160
|
+
If you want to log in to the database yourself, you can add yourself as an administrator with the `add_database_administrator` function.
|
|
161
|
+
Your username is your e-mailaddress, a temporary password can be obtained using `az account get-access-token`.
|
|
162
|
+
|
|
163
|
+
You can use this method to log in to pgAdmin.
|
|
164
|
+
|
|
165
|
+
### Application
|
|
166
|
+
Refer to this documentation:
|
|
167
|
+
https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-manage-azure-ad-users#create-a-role-using-microsoft-entra-object-identifier
|
|
168
|
+
|
|
169
|
+
In short, run something like this in the `postgres` database:
|
|
170
|
+
```
|
|
171
|
+
SELECT * FROM pgaadauth_create_principal_with_oid('web_managed_identity', 'c8b25b85-d060-4cfc-bad4-b8581cfdf946', 'service', false, false);
|
|
172
|
+
```
|
|
173
|
+
Replace the GUID of course with the managed identity our web app gets.
|
|
174
|
+
|
|
175
|
+
The name of the role is outputted by `{your_app}_site_db_user`
|
|
176
|
+
|
|
177
|
+
Be sure to grant this role the correct permissions too.
|
|
178
|
+
|
|
179
|
+
## pgAdmin specifics
|
|
180
|
+
pgAdmin will be created with a default login:
|
|
181
|
+
* Login: dbadmin@dbadmin.net
|
|
182
|
+
* Password: dbadmin
|
|
183
|
+
|
|
184
|
+
Best practice is to log in right away, create a user for yourself and delete this default user.
|
|
185
|
+
|
|
186
|
+
## Azure OAuth2 / Django Social Auth
|
|
187
|
+
If you want to set up login with Azure, which would make sense since you are in the ecosystem, you need to create an App Registration in Entra ID, create a secret and then register these settings in your stack:
|
|
188
|
+
```
|
|
189
|
+
pulumi config set --secret --path 'mywebsite_social_auth_azure.key' secret_ID
|
|
190
|
+
pulumi config set --secret --path 'mywebsite_social_auth_azure.secret' secret_value
|
|
191
|
+
pulumi config set --secret --path 'mywebsite_social_auth_azure.tenant_id' directory_tenant_id
|
|
192
|
+
pulumi config set --secret --path 'mywebsite_social_auth_azure.client_id' application_id
|
|
193
|
+
```
|
|
194
|
+
|
|
195
|
+
Then in your Django deployment, pass to the `add_django_website` command:
|
|
196
|
+
```
|
|
197
|
+
secrets={
|
|
198
|
+
"mywebsite_social_auth_azure": "AZURE_OAUTH",
|
|
199
|
+
},
|
|
200
|
+
```
|
|
201
|
+
|
|
202
|
+
The value will be automatically stored in the vault where the application has access to.
|
|
203
|
+
The environment variable will be suffixed with `_SECRET_NAME`.
|
|
204
|
+
|
|
205
|
+
Then, in your application, retrieve this data from the vault, e.g.:
|
|
206
|
+
```python
|
|
207
|
+
# Social Auth settings
|
|
208
|
+
oauth_secret = AZURE_KEY_VAULT_CLIENT.get_secret(env("AZURE_OAUTH_SECRET_NAME"))
|
|
209
|
+
oauth_secret = json.loads(oauth_secret.value)
|
|
210
|
+
SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_KEY = oauth_secret["client_id"]
|
|
211
|
+
SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_SECRET = oauth_secret["secret"]
|
|
212
|
+
SOCIAL_AUTH_AZUREAD_TENANT_OAUTH2_TENANT_ID = oauth_secret["tenant_id"]
|
|
213
|
+
SOCIAL_AUTH_ADMIN_USER_SEARCH_FIELDS = ["username", "first_name", "last_name", "email"]
|
|
214
|
+
SOCIAL_AUTH_POSTGRES_JSONFIELD = True
|
|
215
|
+
|
|
216
|
+
AUTHENTICATION_BACKENDS = (
|
|
217
|
+
"social_core.backends.azuread_tenant.AzureADTenantOAuth2",
|
|
218
|
+
"django.contrib.auth.backends.ModelBackend",
|
|
219
|
+
)
|
|
220
|
+
```
|
|
221
|
+
|
|
222
|
+
And of course add the login button somewhere, following Django Social Auth instructions.
|
|
223
|
+
|
|
224
|
+
## Automate deployments
|
|
225
|
+
When using a service like GitLab, you can configure a Webhook to fire upon a push to your branch.
|
|
226
|
+
|
|
227
|
+
You need to download the deployment profile to obtain the deployment username and password, and then you can construct a URL like this:
|
|
228
|
+
|
|
229
|
+
```
|
|
230
|
+
https://{user}:{pass}@{appname}.scm.azurewebsites.net/deploy
|
|
231
|
+
|
|
232
|
+
```
|
|
233
|
+
|
|
234
|
+
```
|
|
235
|
+
https://{appname}.scm.azurewebsites.net/api/sshkey?ensurePublicKey=1
|
|
236
|
+
```
|
|
237
|
+
|
|
238
|
+
Be sure to configure the SSH key that Azure will use on GitLab side. You can obtain it using:
|
|
239
|
+
|
|
240
|
+
This would then trigger a redeploy everytime you make a commit to your live branch.
|
|
241
|
+
|
|
242
|
+
|
|
243
|
+
## Change requests
|
|
244
|
+
I created this for internal use but since it took me a while to puzzle all the things together I decided to share it.
|
|
245
|
+
Therefore this project is not super generic, but tailored to my needs. I am however open to pull or change requests to improve this project or to make it more usable for others.
|
|
246
|
+
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
pulumi_django_azure/__init__.py,sha256=WoTHLNGnqc3dQoJtzrAJY8OVA7ReP6XFkDb9BXZGfJ8,117
|
|
2
|
+
pulumi_django_azure/azure_helper.py,sha256=vZLIVZo44EP1-GGeq0XLJ10c42wJDDpKSL5-_sVgUzA,3053
|
|
3
|
+
pulumi_django_azure/context_processors.py,sha256=Qm2e_WBipJYMDH3clYAAaHvEDkG8au2czSQqRkS5928,1136
|
|
4
|
+
pulumi_django_azure/django_deployment.py,sha256=bVDEHrd7KeT6CAuLj0gozn_qSnfSBmm7iRk_6Yy2A34,46655
|
|
5
|
+
pulumi_django_azure/management/commands/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
6
|
+
pulumi_django_azure/management/commands/purge_cache.py,sha256=yjMoNvEPFmtuZctOKXMUacfKJLlTC9xfF-0W-IH3kF0,488
|
|
7
|
+
pulumi_django_azure/management/commands/purge_cdn.py,sha256=8iLuqjndvreTHXRp37sjpvcNltdGTpwhY9YiQokS_P0,2095
|
|
8
|
+
pulumi_django_azure/management/commands/test_redis.py,sha256=_jQXmv48NSPVGrgGZTmASWm0WAWYhqt9HaE3XdJ22U4,10225
|
|
9
|
+
pulumi_django_azure/middleware.py,sha256=XykZAmilyCaZR_5mM950h2WI4053HRqr95LGV1p8uR0,2472
|
|
10
|
+
pulumi_django_azure/settings.py,sha256=hneKnLgm-gzxgX724wEs1rJxK6oq7W5EgT2sJyx7bxY,5231
|
|
11
|
+
pulumi_django_azure-1.0.35.dist-info/METADATA,sha256=QmwtgaTBvlO8sL3AhD-DOGxFcu4iMzWyiOhVhTWuXgU,9598
|
|
12
|
+
pulumi_django_azure-1.0.35.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
|
|
13
|
+
pulumi_django_azure-1.0.35.dist-info/RECORD,,
|
|
@@ -1,13 +0,0 @@
|
|
|
1
|
-
pulumi_django_azure/__init__.py,sha256=WoTHLNGnqc3dQoJtzrAJY8OVA7ReP6XFkDb9BXZGfJ8,117
|
|
2
|
-
pulumi_django_azure/azure_helper.py,sha256=7YCVlsygGUVBfvAsaHaqe_-A_6VVcvuryTgr1QMXqgs,2126
|
|
3
|
-
pulumi_django_azure/context_processors.py,sha256=Qm2e_WBipJYMDH3clYAAaHvEDkG8au2czSQqRkS5928,1136
|
|
4
|
-
pulumi_django_azure/django_deployment.py,sha256=l3hXP8Eo5ZUjojQtDsWeBGCFoSKN76NSz7tW9d-s9FA,50964
|
|
5
|
-
pulumi_django_azure/middleware.py,sha256=7egut5QhBCleB-D3LHWMhZPh6bdrgWQqSShaXuV2tAM,3656
|
|
6
|
-
pulumi_django_azure/settings.py,sha256=BTP5y6KE3oP9pY01TR1ML6GArpLhnzx-mFflrhTQ4SE,5906
|
|
7
|
-
pulumi_django_azure/management/commands/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
8
|
-
pulumi_django_azure/management/commands/purge_cache.py,sha256=yjMoNvEPFmtuZctOKXMUacfKJLlTC9xfF-0W-IH3kF0,488
|
|
9
|
-
pulumi_django_azure/management/commands/purge_cdn.py,sha256=8iLuqjndvreTHXRp37sjpvcNltdGTpwhY9YiQokS_P0,2095
|
|
10
|
-
pulumi_django_azure-1.0.34.dist-info/METADATA,sha256=uNApn_QFC2kZWPEoQuVe3pPOARO42tfa0tgs3uIzGZM,9759
|
|
11
|
-
pulumi_django_azure-1.0.34.dist-info/WHEEL,sha256=wXxTzcEDnjrTwFYjLPcsW_7_XihufBwmpiBeiXNBGEA,91
|
|
12
|
-
pulumi_django_azure-1.0.34.dist-info/top_level.txt,sha256=MNPRJhq-_G8EMCHRkjdcb_xrqzOkmKogXUGV7Ysz3g0,20
|
|
13
|
-
pulumi_django_azure-1.0.34.dist-info/RECORD,,
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
pulumi_django_azure
|