Honor existing Azure App Service plans

Honor AsExisting/PublishAsExisting for Azure App Service environments by referencing existing App Service Plans in generated Bicep instead of recreating them. Add ACR pull identity support, skip dashboard summary output when dashboards are disabled, and cover the publish/deploy shapes with App Service tests and snapshots.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: davidfowl

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentAcrPullIdentityAnnotation.cs

@@ -0,0 +1,21 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using Aspire.Hosting.ApplicationModel;
+
+namespace Aspire.Hosting.Azure;
+
+/// <summary>
+/// Indicates that an <see cref="AzureAppServiceEnvironmentResource"/> should use the supplied
+/// <see cref="AzureUserAssignedIdentityResource"/> as the identity that holds the <c>AcrPull</c> role on the
+/// configured container registry, instead of having Aspire create a new identity and a new <c>AcrPull</c>
+/// role assignment.
+/// </summary>
+/// <param name="identity">The user-assigned identity resource to use for the <c>AcrPull</c> role.</param>
+internal sealed class AzureAppServiceEnvironmentAcrPullIdentityAnnotation(AzureUserAssignedIdentityResource identity) : IResourceAnnotation
+{
+    /// <summary>
+    /// Gets the user-assigned identity resource that holds the <c>AcrPull</c> role.
+    /// </summary>
+    public AzureUserAssignedIdentityResource Identity { get; } = identity;
+}

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs

@@ -107,12 +107,30 @@ public static IResourceBuilder<AzureAppServiceEnvironmentResource> AddAzureAppSe
 
             infra.Add(tags);
 
-            var identity = new UserAssignedIdentity($"{prefix}_mi")
+            UserAssignedIdentity? newIdentity = null;
+            BicepValue<string> managedIdentityIdOutputValue;
+            BicepValue<string> managedIdentityClientIdOutputValue;
+
+            if (resource.TryGetLastAnnotation<AzureAppServiceEnvironmentAcrPullIdentityAnnotation>(out var identityAnnotation))
             {
-                Tags = tags
-            };
+                // The user has supplied an existing identity (commonly via AddAzureUserAssignedIdentity +
+                // .WithRoleAssignments(acr, AcrPull)). Skip creating env_mi + the AcrPull role assignment
+                // here and have the env module read the identity id/client id from parameters wired to the
+                // identity module's outputs.
+                managedIdentityIdOutputValue = identityAnnotation.Identity.Id.AsProvisioningParameter(infra);
+                managedIdentityClientIdOutputValue = identityAnnotation.Identity.ClientId.AsProvisioningParameter(infra);
+            }
+            else
+            {
+                newIdentity = new UserAssignedIdentity($"{prefix}_mi")
+                {
+                    Tags = tags
+                };
 
-            infra.Add(identity);
+                infra.Add(newIdentity);
+                managedIdentityIdOutputValue = newIdentity.Id.ToBicepExpression();
+                managedIdentityClientIdOutputValue = newIdentity.ClientId.ToBicepExpression();
+            }
 
             AzureProvisioningResource? registry = null;
             if (resource.TryGetLastAnnotation<ContainerRegistryReferenceAnnotation>(out var registryReferenceAnnotation) &&
@@ -133,26 +151,40 @@ public static IResourceBuilder<AzureAppServiceEnvironmentResource> AddAzureAppSe
             var containerRegistry = (ContainerRegistryService)registry.AddAsExistingResource(infra);
             infra.Add(containerRegistry);
 
-            var pullRa = containerRegistry.CreateRoleAssignment(ContainerRegistryBuiltInRole.AcrPull, identity);
+            if (newIdentity is not null)
+            {
+                var pullRa = containerRegistry.CreateRoleAssignment(ContainerRegistryBuiltInRole.AcrPull, newIdentity);
 
-            // There's a bug in the CDK, see https://github.com/Azure/azure-sdk-for-net/issues/47265
-            pullRa.Name = BicepFunction.CreateGuid(containerRegistry.Id, identity.Id, pullRa.RoleDefinitionId);
-            infra.Add(pullRa);
+                // There's a bug in the CDK, see https://github.com/Azure/azure-sdk-for-net/issues/47265
+                pullRa.Name = BicepFunction.CreateGuid(containerRegistry.Id, newIdentity.Id, pullRa.RoleDefinitionId);
+                infra.Add(pullRa);
+            }
 
-            var plan = new AppServicePlan($"{prefix}_asplan")
+            AppServicePlan plan;
+            if (resource.IsExisting())
+            {
+                // The Aspire resource models the App Service Plan. When users mark it existing,
+                // keep provisioning the supporting app resources but reference the supplied plan
+                // instead of declaring a new Microsoft.Web/serverfarms resource.
+                plan = (AppServicePlan)resource.AddAsExistingResource(infra);
+            }
+            else
             {
-                Sku = new AppServiceSkuDescription
+                plan = new AppServicePlan($"{prefix}_asplan")
                 {
-                    Name = "P0V3",
-                    Tier = "Premium"
-                },
-                Kind = "Linux",
-                IsReserved = true,
-                // Enable perSiteScaling so each app service can scale independently
-                IsPerSiteScaling = true
-            };
-
-            infra.Add(plan);
+                    Sku = new AppServiceSkuDescription
+                    {
+                        Name = "P0V3",
+                        Tier = "Premium"
+                    },
+                    Kind = "Linux",
+                    IsReserved = true,
+                    // Enable perSiteScaling so each app service can scale independently
+                    IsPerSiteScaling = true
+                };
+
+                infra.Add(plan);
+            }
 
             infra.Add(new ProvisioningOutput("name", typeof(string))
             {
@@ -182,18 +214,18 @@ public static IResourceBuilder<AzureAppServiceEnvironmentResource> AddAzureAppSe
 
             infra.Add(new ProvisioningOutput("AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_ID", typeof(string))
             {
-                Value = identity.Id.ToBicepExpression()
+                Value = managedIdentityIdOutputValue
             });
 
             infra.Add(new ProvisioningOutput("AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_CLIENT_ID", typeof(string))
             {
-                Value = identity.ClientId.ToBicepExpression()
+                Value = managedIdentityClientIdOutputValue
             });
 
             if (resource.EnableDashboard)
             {
                 // Add aspire dashboard website
-                var website = AzureAppServiceEnvironmentUtility.AddDashboard(infra, identity, plan.Id);
+                var website = AzureAppServiceEnvironmentUtility.AddDashboard(infra, managedIdentityClientIdOutputValue, plan.Id);
 
                 infra.Add(new ProvisioningOutput("AZURE_APP_SERVICE_DASHBOARD_URI", typeof(string))
                 {
@@ -437,6 +469,51 @@ public static IResourceBuilder<AzureAppServiceEnvironmentResource> WithDeploymen
         return builder;
     }
 
+    /// <summary>
+    /// Configures the Azure App Service environment to use the supplied <see cref="AzureUserAssignedIdentityResource"/>
+    /// as the managed identity that App Service apps use to pull images from the configured container registry
+    /// (the <c>AcrPull</c> identity), instead of having Aspire create a new identity and a new <c>AcrPull</c>
+    /// role assignment.
+    /// </summary>
+    /// <param name="builder">The Azure App Service environment to configure.</param>
+    /// <param name="identityBuilder">
+    /// The resource builder for the user-assigned identity that should be used for image pulls. This identity is
+    /// only used for the <c>AcrPull</c> role; it is not assigned as the app service runtime identity.
+    /// </param>
+    /// <returns>The <see cref="IResourceBuilder{T}"/> for chaining.</returns>
+    /// <remarks>
+    /// <para>
+    /// When this is set, Aspire will not create a new identity or an <c>AcrPull</c> role assignment for the
+    /// container registry. The caller is responsible for ensuring the supplied identity already has the required
+    /// <c>AcrPull</c> role assignment on the registry, for example by chaining
+    /// <c>.WithRoleAssignments(acr, ContainerRegistryBuiltInRole.AcrPull)</c> when adding the identity.
+    /// </para>
+    /// <para>
+    /// This is commonly combined with <c>AsExisting</c> on the App Service environment (App Service Plan) and on
+    /// the container registry to deploy websites into a pre-provisioned set of Azure resources without Aspire
+    /// emitting any new ACR-pull identity or ACR-pull role-assignment resources.
+    /// </para>
+    /// <para>
+    /// If the Aspire dashboard is enabled, Aspire still provisions the dashboard website and its contributor
+    /// identity. Use <see cref="WithDashboard(IResourceBuilder{AzureAppServiceEnvironmentResource}, bool)"/> with
+    /// <see langword="false"/> when targeting a fully pre-provisioned App Service Plan that should not receive a
+    /// dashboard.
+    /// </para>
+    /// </remarks>
+    /// <exception cref="ArgumentNullException">Thrown when <paramref name="builder"/> or <paramref name="identityBuilder"/> is <see langword="null"/>.</exception>
+    [AspireExport]
+    public static IResourceBuilder<AzureAppServiceEnvironmentResource> WithAcrPullIdentity(
+        this IResourceBuilder<AzureAppServiceEnvironmentResource> builder,
+        IResourceBuilder<AzureUserAssignedIdentityResource> identityBuilder)
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+        ArgumentNullException.ThrowIfNull(identityBuilder);
+
+        builder.WithAnnotation(new AzureAppServiceEnvironmentAcrPullIdentityAnnotation(identityBuilder.Resource), ResourceAnnotationMutationBehavior.Replace);
+
+        return builder;
+    }
+
     private static AzureContainerRegistryResource CreateDefaultAzureContainerRegistry(IDistributedApplicationBuilder builder, string name)
     {
         var resource = new AzureContainerRegistryResource(name, ContainerRegistryInfrastructure.ConfigureContainerRegistry);

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentResource.cs

@@ -71,18 +71,23 @@ public AzureAppServiceEnvironmentResource(string name, Action<AzureResourceInfra
 
             steps.Add(validateStep);
 
-            // Add print-dashboard-url step
-            var printDashboardUrlStep = new PipelineStep
+            if (EnableDashboard)
             {
-                Name = $"print-dashboard-url-{name}",
-                Description = $"Prints the deployment summary and dashboard URL for {name}.",
-                Action = ctx => PrintDashboardUrlAsync(ctx),
-                Tags = ["print-summary"],
-                DependsOnSteps = [AzureEnvironmentResource.ProvisionInfrastructureStepName],
-                RequiredBySteps = [WellKnownPipelineSteps.Deploy]
-            };
-
-            steps.Add(printDashboardUrlStep);
+                // The dashboard output is only emitted when the dashboard is provisioned.
+                // Avoid registering the summary step when WithDashboard(false) is used,
+                // otherwise deploy succeeds and then fails while trying to read a missing output.
+                var printDashboardUrlStep = new PipelineStep
+                {
+                    Name = $"print-dashboard-url-{name}",
+                    Description = $"Prints the deployment summary and dashboard URL for {name}.",
+                    Action = ctx => PrintDashboardUrlAsync(ctx),
+                    Tags = ["print-summary"],
+                    DependsOnSteps = [AzureEnvironmentResource.ProvisionInfrastructureStepName],
+                    RequiredBySteps = [WellKnownPipelineSteps.Deploy]
+                };
+
+                steps.Add(printDashboardUrlStep);
+            }
 
             // Expand deployment target steps for all compute resources
             // This ensures the push/provision steps from deployment targets are included in the pipeline

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

@@ -22,13 +22,12 @@ public static BicepValue<string> GetDashboardHostName(string aspireResourceName)
     }
 
     public static WebSite AddDashboard(AzureResourceInfrastructure infra,
-        UserAssignedIdentity otelIdentity,
+        BicepValue<string> acrPullIdentityClientId,
         BicepValue<ResourceIdentifier> appServicePlanId)
     {
         // This ACR identity is used by the dashboard to authorize the telemetry data
         // coming from the dotnet web apps. This identity is being assigned to every web app
         // in the aspire project and can be safely reused for authorization in the dashboard. 
-        var otelClientId = otelIdentity.ClientId;
         var prefix = infra.AspireResource.Name;
         var contributorIdentity = new UserAssignedIdentity(Infrastructure.NormalizeBicepIdentifier($"{prefix}-contributor-mi"));
 
@@ -60,7 +59,7 @@ public static WebSite AddDashboard(AzureResourceInfrastructure infra,
             SiteConfig = new SiteConfigProperties()
             {
                 LinuxFxVersion = "ASPIREDASHBOARD|1.0",
-                AcrUserManagedIdentityId = otelClientId,
+                AcrUserManagedIdentityId = acrPullIdentityClientId,
                 UseManagedIdentityCreds = true,
                 IsHttp20Enabled = true,
                 Http20ProxyFlag = 1,
@@ -93,7 +92,7 @@ public static WebSite AddDashboard(AzureResourceInfrastructure infra,
         dashboard.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "WEBSITE_START_SCM_WITH_PRELOAD", Value = "true" });
         // Appsettings related to managed identity for auth
         dashboard.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "AZURE_CLIENT_ID", Value = contributorIdentity.ClientId });
-        dashboard.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "ALLOWED_MANAGED_IDENTITIES", Value = otelClientId });
+        dashboard.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "ALLOWED_MANAGED_IDENTITIES", Value = acrPullIdentityClientId });
         // Added appsetting to identify the resources in a specific aspire environment
         dashboard.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "ASPIRE_ENVIRONMENT_NAME", Value = infra.AspireResource.Name });
 

src/Aspire.Hosting.Azure.AppService/api/Aspire.Hosting.Azure.AppService.ats.txt

@@ -8,6 +8,7 @@ Aspire.Hosting.Azure.AppService/Aspire.Hosting.Azure.AzureAppServiceEnvironmentR
 Aspire.Hosting.Azure.AppService/addAzureAppServiceEnvironment(name: string) -> Aspire.Hosting.Azure.AppService/Aspire.Hosting.Azure.AzureAppServiceEnvironmentResource
 Aspire.Hosting.Azure.AppService/publishAsAzureAppServiceWebsite(configure?: callback, configureSlot?: callback) -> Aspire.Hosting/Aspire.Hosting.ApplicationModel.IComputeResource
 Aspire.Hosting.Azure.AppService/skipEnvironmentVariableNameChecks() -> Aspire.Hosting/Aspire.Hosting.ApplicationModel.IComputeResource
+Aspire.Hosting.Azure.AppService/withAcrPullIdentity(identityBuilder: Aspire.Hosting.Azure/Aspire.Hosting.Azure.AzureUserAssignedIdentityResource) -> Aspire.Hosting.Azure.AppService/Aspire.Hosting.Azure.AzureAppServiceEnvironmentResource
 Aspire.Hosting.Azure.AppService/withAzureApplicationInsights(applicationInsights?: string|Aspire.Hosting/Aspire.Hosting.ApplicationModel.ParameterResource|Aspire.Hosting.Azure.ApplicationInsights/Aspire.Hosting.Azure.AzureApplicationInsightsResource) -> Aspire.Hosting.Azure.AppService/Aspire.Hosting.Azure.AzureAppServiceEnvironmentResource
 Aspire.Hosting.Azure.AppService/withDashboard(enable?: boolean) -> Aspire.Hosting.Azure.AppService/Aspire.Hosting.Azure.AzureAppServiceEnvironmentResource
 Aspire.Hosting.Azure.AppService/withDeploymentSlot(deploymentSlot: string|Aspire.Hosting/Aspire.Hosting.ApplicationModel.ParameterResource) -> Aspire.Hosting.Azure.AppService/Aspire.Hosting.Azure.AzureAppServiceEnvironmentResource