Added support for Aspire dashboard in App Service

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentExtensions.cs

@@ -7,6 +7,7 @@
 using Aspire.Hosting.Lifecycle;
 using Azure.Provisioning;
 using Azure.Provisioning.AppService;
+using Azure.Provisioning.Authorization;
 using Azure.Provisioning.ContainerRegistry;
 using Azure.Provisioning.Expressions;
 using Azure.Provisioning.Roles;
@@ -64,6 +65,12 @@ public static IResourceBuilder<AzureAppServiceEnvironmentResource> AddAzureAppSe
 
             infra.Add(identity);
 
+            var contributorIdentity = new UserAssignedIdentity(Infrastructure.NormalizeBicepIdentifier($"{prefix}-contributor-mi"))
+            {
+            };
+
+            infra.Add(contributorIdentity);
+
             ContainerRegistryService? containerRegistry = null;
 #pragma warning disable ASPIRECOMPUTE001 // Type is for evaluation purposes only and is subject to change or removal in future updates. Suppress this diagnostic to proceed.
             if (resource.TryGetLastAnnotation<ContainerRegistryReferenceAnnotation>(out var registryReferenceAnnotation) && registryReferenceAnnotation.Registry is AzureProvisioningResource registry)
@@ -96,7 +103,9 @@ public static IResourceBuilder<AzureAppServiceEnvironmentResource> AddAzureAppSe
                     Tier = "Premium"
                 },
                 Kind = "Linux",
-                IsReserved = true
+                IsReserved = true,
+                // Enable per-site scaling so each app service can scale independently
+                IsPerSiteScaling = true
             };
 
             infra.Add(plan);
@@ -111,6 +120,40 @@ public static IResourceBuilder<AzureAppServiceEnvironmentResource> AddAzureAppSe
                 Value = plan.Id
             });
 
+            // Add Website Contributor role assignment
+            var rgRaId = BicepFunction.GetSubscriptionResourceId(
+                        "Microsoft.Authorization/roleDefinitions",
+                        "de139f84-1756-47ae-9be6-808fbbe84772");
+            var rgRaName = BicepFunction.CreateGuid(BicepFunction.GetResourceGroup().Id, contributorIdentity.Id, rgRaId);
+            var rgRa = new RoleAssignment(Infrastructure.NormalizeBicepIdentifier($"{prefix}_ra"))
+            {
+                Name = rgRaName,
+                PrincipalType = RoleManagementPrincipalType.ServicePrincipal,
+                PrincipalId = contributorIdentity.PrincipalId,
+                RoleDefinitionId = rgRaId,
+            };
+
+            infra.Add(rgRa);
+
+            // Add Reader role assignment
+            var rgRaId2 = BicepFunction.GetSubscriptionResourceId(
+                "Microsoft.Authorization/roleDefinitions",
+                "acdd72a7-3385-48ef-bd42-f606fba81ae7");
+            var rgRaName2 = BicepFunction.CreateGuid(BicepFunction.GetResourceGroup().Id, contributorIdentity.Id, rgRaId2);
+
+            var rgRa2 = new RoleAssignment(Infrastructure.NormalizeBicepIdentifier($"{prefix}_ra2"))
+            {
+                Name = rgRaName2,
+                PrincipalType = RoleManagementPrincipalType.ServicePrincipal,
+                PrincipalId = contributorIdentity.PrincipalId,
+                RoleDefinitionId = rgRaId2
+            };
+
+            infra.Add(rgRa2);
+
+            // Add aspire dashboard website
+            var website = AzureAppServiceEnvironmentUtility.AddDashboard(infra, identity, contributorIdentity, plan.Id);
+
             infra.Add(new ProvisioningOutput("AZURE_CONTAINER_REGISTRY_NAME", typeof(string))
             {
                 Value = containerRegistry.Name
@@ -131,6 +174,16 @@ public static IResourceBuilder<AzureAppServiceEnvironmentResource> AddAzureAppSe
             {
                 Value = identity.ClientId
             });
+
+            infra.Add(new ProvisioningOutput("AZURE_CONTAINER_REGISTRY_MANAGED_IDENTITY_NAME", typeof(string))
+            {
+                Value = identity.Name
+            });
+
+            infra.Add(new ProvisioningOutput("DASHBOARD_URI", typeof(string))
+            {
+                Value = BicepFunction.Interpolate($"https://{AzureAppServiceEnvironmentUtility.DashboardHostName}.azurewebsites.net")
+            });
         });
 
         if (!builder.ExecutionContext.IsPublishMode)

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentResource.cs

@@ -32,6 +32,11 @@ public class AzureAppServiceEnvironmentResource(string name, Action<AzureResourc
     /// </summary>
     public BicepOutputReference NameOutputReference => new("name", this);
 
+    /// <summary>
+    /// Gets the URI of the App Service Environment dashboard.
+    /// </summary>
+    public BicepOutputReference DashboardUriReference => new("DASHBOARD_URI", this);
+
     ReferenceExpression IAzureContainerRegistry.ManagedIdentityId => 
         ReferenceExpression.Create($"{ContainerRegistryManagedIdentityId}");
 

src/Aspire.Hosting.Azure.AppService/AzureAppServiceEnvironmentUtility.cs

@@ -0,0 +1,77 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using Azure.Core;
+using Azure.Provisioning;
+using Azure.Provisioning.AppService;
+using Azure.Provisioning.Expressions;
+using Azure.Provisioning.Resources;
+using Azure.Provisioning.Roles;
+
+namespace Aspire.Hosting.Azure.AppService;
+
+internal static class AzureAppServiceEnvironmentUtility
+{
+    const string ResourceName = "dashboard";
+
+    public static BicepValue<string> DashboardHostName => BicepFunction.Take(
+        BicepFunction.Interpolate($"{BicepFunction.ToLower(ResourceName)}-{BicepFunction.GetUniqueString(BicepFunction.GetResourceGroup().Id)}"), 60);
+
+    public static WebSite AddDashboard(AzureResourceInfrastructure infra,
+        UserAssignedIdentity otelIdentity,
+        UserAssignedIdentity contributorIdentity,
+        BicepValue<ResourceIdentifier> appServicePlanId)
+    {
+        var acrClientIdParameter = otelIdentity.ClientId;
+        var contributorMidParameter = contributorIdentity.Id;
+        var contributorClientIdParameter = contributorIdentity.ClientId;
+
+        var webSite = new WebSite("webapp")
+        {
+            // Use the host name as the name of the web app
+            Name = DashboardHostName,
+            AppServicePlanId = appServicePlanId,
+            // Aspire dashboards are created with a new kind aspiredashboard
+            Kind = "app,linux,aspiredashboard",
+            SiteConfig = new SiteConfigProperties()
+            {
+                LinuxFxVersion = "ASPIREDASHBOARD|1.0",
+                AcrUserManagedIdentityId = acrClientIdParameter,
+                UseManagedIdentityCreds = true,
+                IsHttp20Enabled = true,
+                Http20ProxyFlag = 1,
+                // Setting NumberOfWorkers to 1 to ensure dashboard runs of 1 instance
+                NumberOfWorkers = 1,
+                // IsAlwaysOn set to true ensures the app is always running
+                IsAlwaysOn = true,
+                AppSettings = []
+            },
+            Identity = new ManagedServiceIdentity()
+            {
+                ManagedServiceIdentityType = ManagedServiceIdentityType.UserAssigned,
+                UserAssignedIdentities = []
+            }
+        };
+
+        //var acrMid = BicepFunction.Interpolate($"{acrMidParameter}").Compile().ToString();
+        //webSite.Identity.UserAssignedIdentities[acrMid] = new UserAssignedIdentityDetails();
+        var contributorMid = BicepFunction.Interpolate($"{contributorMidParameter}").Compile().ToString();
+        webSite.Identity.UserAssignedIdentities[contributorMid] = new UserAssignedIdentityDetails();
+
+        // Security is handled by app service platform
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "Dashboard__Frontend__AuthMode", Value = "Unsecured" });
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "Dashboard__Otlp__AuthMode", Value = "Unsecured" });
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "Dashboard__ResourceServiceClient__AuthMode", Value = "Unsecured" });
+        // Dashboard ports
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "WEBSITES_PORT", Value = "5000" });
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "HTTP20_ONLY_PORT", Value = "4317" });
+        // Enable SCM preloading to ensure dashboard is always available
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "WEBSITE_START_SCM_WITH_PRELOAD", Value = "true" });
+        // Appsettings related to managed identity for auth
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "AZURE_CLIENT_ID", Value = contributorClientIdParameter });
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "ALLOWED_MANAGED_IDENTITIES", Value = acrClientIdParameter });
+        infra.Add(webSite);
+
+        return webSite;
+    }
+}

src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebsiteContext.cs

@@ -212,6 +212,7 @@ public void BuildWebSite(AzureResourceInfrastructure infra)
         var acrMidParameter = environmentContext.Environment.ContainerRegistryManagedIdentityId.AsProvisioningParameter(infra);
         var acrClientIdParameter = environmentContext.Environment.ContainerRegistryClientId.AsProvisioningParameter(infra);
         var containerImage = AllocateParameter(new ContainerImageReference(Resource, environmentContext.ServiceProvider));
+        var dashboardUri = environmentContext.Environment.DashboardUriReference.AsProvisioningParameter(infra);
 
         var webSite = new WebSite("webapp")
         {
@@ -224,6 +225,9 @@ public void BuildWebSite(AzureResourceInfrastructure infra)
                 LinuxFxVersion = "SITECONTAINERS",
                 AcrUserManagedIdentityId = acrClientIdParameter,
                 UseManagedIdentityCreds = true,
+                // Setting NumberOfWorkers to maximum allowed value for Premium SKU
+                // https://learn.microsoft.com/en-us/azure/app-service/manage-scale-up
+                NumberOfWorkers = 30,
                 AppSettings = []
             },
             Identity = new ManagedServiceIdentity()
@@ -323,6 +327,8 @@ static FunctionCallExpression Join(BicepExpression args, string delimeter) =>
         }
 #pragma warning restore ASPIREPROBES001 // Type is for evaluation purposes only and is subject to change or removal in future updates. Suppress this diagnostic to proceed.
 
+        AddDashboardSettings(webSite, acrClientIdParameter, dashboardUri);
+
         infra.Add(webSite);
 
         // Allow users to customize the web app here
@@ -362,6 +368,15 @@ private ProvisioningParameter AllocateParameter(IManifestExpressionProvider para
     {
         return parameter.AsProvisioningParameter(Infra, isSecure: secretType == SecretType.Normal);
     }
+    private void AddDashboardSettings(WebSite webSite, ProvisioningParameter acrClientIdParameter, ProvisioningParameter dashboardUri)
+    {
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "OTEL_SERVICE_NAME", Value = resource.Name });
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "OTEL_EXPORTER_OTLP_PROTOCOL", Value = "grpc" });
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "OTEL_EXPORTER_OTLP_ENDPOINT", Value = "http://localhost:6001" });
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "WEBSITE_ENABLE_ASPIRE_OTEL_SIDECAR", Value = "true" });
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "OTEL_COLLECTOR_URL", Value = dashboardUri });
+        webSite.SiteConfig.AppSettings.Add(new AppServiceNameValuePair { Name = "OTEL_CLIENT_ID", Value = acrClientIdParameter });
+    }
 
     enum SecretType
     {