Skip to content

Latest commit

 

History

History
327 lines (278 loc) · 17.1 KB

File metadata and controls

327 lines (278 loc) · 17.1 KB

InfraForge — Self-Service Infrastructure Platform

Generate once, reuse forever. Provision production-ready Azure infrastructure from natural language — powered by a catalog of pre-approved templates, the GitHub Copilot SDK, and organizational governance built in.

🎯 Problem → Solution

The Problem

Enterprise teams face a painful infrastructure bottleneck:

  • App teams wait days for platform teams to write Bicep/Terraform
  • Platform teams are overwhelmed with repetitive "just give me an App Service" requests
  • Every team reinvents patterns — inconsistent naming, missing tags, insecure defaults
  • No reuse — templates are written once, then lost in repo sprawl
  • Cost surprises — teams deploy without knowing the price tag

The Solution

InfraForge is a self-service infrastructure platform that lets business and app teams provision production-ready cloud infrastructure through natural language — while platform teams retain full control through:

  • 📚 Approved Template Catalog — Pre-vetted, tested infrastructure modules that teams reuse
  • 🔒 Policy Engine — Automated governance checks (tags, naming, security, regions)
  • 💰 Cost Transparency — Cost estimates before deployment, not after
  • 🤖 AI Composition — The agent searches the catalog first, generates only as a last resort
  • 📦 Register & Reuse — New templates get registered back for organization-wide benefit

The workflow: Search → Compose → Generate (if needed) → Validate → Save → Register

Before After
App team files Jira ticket App team asks InfraForge in plain English
Platform team writes Bicep (4-8 hours) InfraForge finds approved template (30 seconds)
Back-and-forth on requirements AI asks clarifying questions interactively
Manual policy review Automated compliance check
Cost surprise after deployment Cost estimate before provisioning

📋 Prerequisites

  • Python 3.9+
  • GitHub Copilot CLI installed and authenticated
  • GitHub Copilot subscription (or BYOK configuration)
  • Git for version control

🚀 Setup & Installation

# 1. Clone the repository
git clone https://github.com/<your-org>/infraforge.git
cd infraforge

# 2. Create and activate a virtual environment
python -m venv .venv
# Windows:
.venv\Scripts\activate
# macOS/Linux:
source .venv/bin/activate

# 3. Install dependencies
pip install -r requirements.txt

# 4. Verify Copilot CLI
copilot --version

# 5. Run InfraForge
python -m src.main

Environment Variables (Optional)

Variable Default Description
COPILOT_MODEL gpt-4.1 Copilot model to use
COPILOT_LOG_LEVEL warning SDK log verbosity
INFRAFORGE_OUTPUT_DIR ./output Directory for saved files

🏗️ Architecture

                     ┌───────────────────────┐
                     │   Microsoft Entra ID  │
                     │     (Azure AD SSO)    │
                     │  ┌─────────────────┐  │
                     │  │ App Registration │  │
                     │  │  + Client Secret │  │
                     │  │  + Group Claims  │  │
                     │  └────────┬────────┘  │
                     └───────────┼───────────┘
                        Tokens   │   Graph API
                       (MSAL)    │  (Identity: dept,
                                 │   manager, cost center)
┌──────────────────────────────────────────────────────────────┐
│                         User (Web UI / CLI)                   │
│          "I need a web app with SQL and Key Vault"           │
└───────────────────────┬──────────────────────────────────────┘
                        │
                        ▼
┌──────────────────────────────────────────────────────────────┐
│                    InfraForge Agent                           │
│              (src/main.py + src/config.py)                   │
│                                                              │
│  ┌─────────────────────────────────────────────────────────┐ │
│  │              GitHub Copilot SDK (Python)                 │ │
│  │         CopilotClient → Session → Events                │ │
│  └────────────────────┬────────────────────────────────────┘ │
│                       │                                      │
│           ┌───── STEP 1: Search ─────┐                       │
│           ▼                          │                       │
│  ┌─────────────────────┐             │                       │
│  │  Template Catalog   │  Azure SQL  │                       │
│  │  ┌───────────────┐  │             │                       │
│  │  │ catalog_      │  │  Pre-approved, tested              │
│  │  │ templates DB  │  │  modules that teams                │
│  │  │ + bicep src   │  │  reuse across projects             │
│  │  └───────────────┘  │             │                       │
│  └─────────┬───────────┘             │                       │
│            │                         │                       │
│       Found? ──── Yes ──→ Compose from catalog               │
│            │                                                 │
│            No                                                │
│            │                                                 │
│           ┌───── STEP 2: Generate (fallback) ────┐           │
│           ▼                                      │           │
│  ┌─────────────────────────────────────────────┐ │           │
│  │            Generation Tools                  │ │           │
│  │  ┌──────────┐ ┌──────────┐ ┌──────────────┐ │ │           │
│  │  │ Bicep    │ │Terraform │ │ GH Actions / │ │ │           │
│  │  │ Gen      │ │ Gen      │ │ ADO Pipeline │ │ │           │
│  │  └──────────┘ └──────────┘ └──────────────┘ │ │           │
│  └─────────────────────────────────────────────┘ │           │
│            │                                     │           │
│           ┌───── STEP 3: Validate ───────────────┘           │
│           ▼                                                  │
│  ┌─────────────────────────────────────────────┐             │
│  │  ┌──────────────┐  ┌──────────────┐         │             │
│  │  │ Policy       │  │ Cost         │         │             │
│  │  │ Checker      │  │ Estimator    │         │             │
│  │  └──────────────┘  └──────────────┘         │             │
│  └─────────────────────────────────────────────┘             │
│            │                                                 │
│           ┌───── STEP 4: Save & Register ────────┐           │
│           ▼                                      ▼           │
│  ┌──────────────┐                    ┌──────────────┐        │
│  │ Save to File │                    │ Register in  │        │
│  │              │                    │ Catalog      │        │
│  └──────────────┘                    └──────────────┘        │
└───────────────────────┬──────────────────────────────────────┘
                        │
           ┌────────────┼────────────┐
           ▼            ▼            ▼
  ┌──────────────┐ ┌────────┐ ┌──────────────────────────┐
  │  Azure SQL   │ │ Azure  │ │ Microsoft Fabric         │
  │  (Catalog,   │ │  ARM   │ │ (Fabric IQ)              │
  │  Governance, │ │  SDK   │ │ ┌──────────────────────┐ │
  │  Usage       │ │        │ │ │ OneLake Lakehouse    │ │
  │  Analytics)  │ │        │ │ │ → Power BI Dashboards│ │
  └──────────────┘ └────────┘ │ └──────────────────────┘ │
                              └──────────────────────────┘

🔧 Usage Examples

Catalog-First Flow (Recommended)

You: I need a web app with a SQL database and Key Vault for my project

InfraForge: I found 4 approved templates in the catalog:
  ✓ app-service-linux (98% match) — Linux App Service with managed identity
  ✓ sql-database (95% match) — Azure SQL with TLS 1.2 and firewall rules
  ✓ key-vault (92% match) — Key Vault with RBAC and network ACLs
  ✓ three-tier-web (blueprint) — Pre-wired composition of all three!

  The "three-tier-web" blueprint already assembles these modules with proper
  wiring. Shall I compose from the blueprint, or build a custom composition?

Compose from Catalog

You: Use the three-tier-web blueprint for prod in eastus2

InfraForge: Composing from the approved "three-tier-web" blueprint...
  [Shows complete Bicep with all modules wired together]
  Estimated cost: ~$385/mo | Policy: ✓ Compliant
  Want me to save this and run a full policy check?

Register a New Template

You: Register this AKS template I just generated — other teams might need it

InfraForge: Registered "aks-cluster" in the catalog with tags: kubernetes, aks, containers
  Future searches for "kubernetes" or "AKS" will find this template.

Generate (Fallback — No Catalog Match)

You: Create Terraform for a Databricks workspace with Unity Catalog

InfraForge: No matching templates found in the catalog. Generating from scratch...
  [Generates Terraform HCL]
  Want me to register this as an approved template for future reuse?

CI/CD Pipelines

You: Create a GitHub Actions pipeline for deploying Bicep templates with dev, staging, prod

Cost Estimation

You: How much would 2 App Services (S1), a SQL Database (S1), Redis (C1), and Key Vault cost?

Policy Compliance

You: Check if my resources comply — App Service in westus with no tags and public access

🛡️ Responsible AI (RAI) Notes

What InfraForge Does

  • Generates IaC templates and pipelines based on user descriptions
  • Applies security best practices by default (HTTPS, managed identities, private endpoints)
  • Validates against governance policies before deployment
  • Provides cost transparency before resource creation

What InfraForge Does NOT Do

  • Does not deploy without confirmation — ARM What-If preview is shown before deployment
  • Does not store credentials — All secrets are parameterized, never hardcoded
  • Does not bypass approval gates — Generated pipelines include manual approvals for production
  • Does not guarantee cost accuracy — Estimates are approximate; refer to Azure Pricing Calculator

Human Oversight

  • All generated code should be reviewed by an engineer before deployment
  • Policy compliance checks are advisory — they do not replace organizational review processes
  • Cost estimates are approximate and should be validated against actual Azure pricing

Data Handling

  • InfraForge runs locally and does not persist conversation data
  • Infrastructure descriptions are sent to the Copilot model for generation
  • No customer data, credentials, or PII are stored or transmitted beyond the session

📁 Project Structure

CopilotSDKChallenge/
├── src/
│   ├── __init__.py
│   ├── main.py              # Entry point — interactive CLI
│   ├── config.py             # Configuration & system prompt
│   ├── utils.py              # Helper utilities
│   ├── tools/
│   │   ├── __init__.py       # Tool registry (10 tools)
│   │   ├── catalog_search.py    # Search approved template catalog
│   │   ├── catalog_compose.py   # Compose from existing templates
│   │   ├── catalog_register.py  # Register new templates
│   │   ├── bicep_generator.py   # Generate Bicep (fallback)
│   │   ├── terraform_generator.py
│   │   ├── github_actions_generator.py
│   │   ├── azure_devops_generator.py
│   │   ├── cost_estimator.py
│   │   ├── policy_checker.py
│   │   ├── save_output.py
│   │   ├── deploy_engine.py     # ARM SDK deployment engine
│   │   ├── design_document.py   # Approval-ready design docs
│   │   ├── diagram_generator.py # Mermaid architecture diagrams
│   │   ├── github_publisher.py  # GitHub repo/PR publishing
│   │   ├── service_catalog.py   # Service approval tools
│   │   ├── governance_tools.py  # Security standards, compliance, policies
│   │   ├── arm_generator.py     # ARM generation/editing helpers
│   │   └── static_policy_validator.py  # Static ARM template validation
│   └── templates/
│       ├── __init__.py
│       ├── bicep_patterns.py     # Reference patterns for generation
│       ├── terraform_patterns.py
│       └── pipeline_patterns.py
├── catalog/                  # Approved template catalog (DB-backed)
│   └── bicep/                # Source Bicep files (content stored in DB)
│       ├── app-service-linux.bicep
│       ├── sql-database.bicep
│       ├── key-vault.bicep
│       ├── log-analytics.bicep
│       ├── storage-account.bicep
│       └── blueprints/
│           └── three-tier-web.bicep
├── docs/
│   ├── ARCHITECTURE.md       # Architecture reference (LLM context)
│   ├── README.md             # This file
│   └── TECHNICAL.md          # Data model & standards system
├── output/                   # Generated files (gitignored)
├── AGENTS.md                 # Agent instructions (references docs/)
├── mcp.json                  # MCP server configuration
├── requirements.txt          # Python dependencies
├── start.py                  # CLI launcher
├── web_start.py              # Web server launcher
└── .gitignore

🚢 Deployment

InfraForge is a web application (FastAPI on port 8080) with a CLI fallback. It deploys ARM templates directly to Azure via the SDK — no az, terraform, or bicep CLI dependencies on the deploy path.

  1. Containerize with Docker for consistent environments
  2. Configure Entra ID for corporate SSO — requires an App Registration with client secret, redirect URI, and group claims (see docs/SETUP.md Step 3)
  3. Set AZURE_SQL_CONNECTION_STRING for Azure SQL Database
  4. Fabric IQ is auto-provisioned by scripts/setup.ps1 (Step 6) — creates a Fabric workspace and Lakehouse for OneLake analytics. Use -SkipFabric if no capacity is available.
  5. Launch with python web_start.py

Demo mode is available when Entra ID is not configured — the app falls back to a sample user session for development and demos.