9 replies
Thanks
Question though: The example videos I have seen have a different file structure to the ones in the landing zone/starter-kit as it is now. We are unable to run any of the examples without an error. This may be down to our understanding as there are clearly people using this successfully!
As an example, trying to run the eslz addon results in the following errors. What are we doing wrong?
BTW: As we are beginning our journey, I am more than happy to contribute/update any 'beginner/getting started with' type documentation if it would assist you?
8 replies
Hello guys,
I need to do something really simple: Create a new secret to a keyvault. The secret value must be randomly generated
I was hoping to do something as simple as that:
keyvaults.tfvars
random_strings = {
foo_password = {
length = 20
special = true
upper = true
number = true
}
}
dynamic_keyvault_secrets = {
kv = {
secret_key1 = {
secret_name = "foo_key"
value = foo_password.value
}
}
}However, I don't think we can put any logic in tfvars files. It means that the logic must be placed somewhere else.
Do you have any recommendation ?
1 reply
I want to build an enterprise scale environment having platform subscriptions for management, identity and connectivity, as well as different landing zones for various applications like analytics, aks ... I started with the CAF landingzones having a launchpad (which I understood will have only one in my environment) and a solution (for level 1-4). Since for example AKS has different solution requirements than analytics, what will be the best way to separate these environments - a own solution per landing zone? besides will the app subscriptions then start at Level 2 or will they have empty Level 0 and empty Level 1 (asumption L0 & L1 are managed on platform level in the management subscription). Hope someone can point me to the right direction and have some recommendations! Thanks
1 reply
Hi. I finally have something working :-).
There's a gap between creating the launchpad and then creating level 2 resources.
I've used the CAF_TERRAFORM_LANDING_ZONES repository.
Running the level 100 launchpad shows no issues, however when running the Level 2 networking example (100-Single-Region-Hub), the command fails with an error about a NULL value for global_setting.regions.
In the end, it's to do with the content of the remote state file.
Level 1 is not populated with the 'Global_Settings' block in the Output section of the state file.
Running the level 1 Foundations doesn't work either as it seems to write to a different state file!
However, copying the Global_Settings block from the CAF_Solutions.tfstate to the caf_foundations.tfstate works!
I'm guessing therefore that there is a disconnect in the state files that the examples (scenarios) use which has thrown me?
Or have I missed something monumentally important?
Thanks
2 replies
1 reply
Hello there. I have been searching for documentation on this topic for a few hours, but have not been able to identify if what I am trying to do is something that the caf terraform module supports.
I am attempting to use subdirectory modules of https://github.com/aztfmod/terraform-azurerm-caf . Take for example trying to use the resource_group subdirectory module (aztfmod/caf/azurerm//modules/resource_group).
Is this something this module is intended to support the usage of?
# The code tries to peer to a vnet created in the same landing zone. If it fails it tries with the data remote state
resource "azurerm_virtual_network_peering" "peering" {
depends_on = [module.networking]
for_each = local.networking.vnet_peerings
name = azurecaf_name.peering[each.key].result
virtual_network_name = try(each.value.from.virtual_network_name, null) != null ? each.value.from.virtual_network_name : try(each.value.from.lz_key, null) == null ? try(local.combined_objects_networking[local.client_config.landingzone_key][each.value.from.vnet_key].name, null) : try(local.combined_objects_networking[each.value.from.lz_key][each.value.from.vnet_key].name, null)
resource_group_name = try(each.value.from.resource_group_name, null) != null ? each.value.from.resource_group_name : try(each.value.from.lz_key, null) == null ? try(local.combined_objects_networking[local.client_config.landingzone_key][each.value.from.vnet_key].resource_group_name, null) : try(local.combined_objects_networking[each.value.from.lz_key][each.value.from.vnet_key].resource_group_name, null)
remote_virtual_network_id = try(each.value.to.remote_virtual_network_id, null) != null ? each.value.to.remote_virtual_network_id : try(each.value.to.lz_key, null) == null ? try(local.combined_objects_networking[local.client_config.landingzone_key][each.value.to.vnet_key].id, null) : try(local.combined_objects_networking[each.value.to.lz_key][each.value.to.vnet_key].id, null)
allow_virtual_network_access = try(each.value.allow_virtual_network_access, true)
allow_forwarded_traffic = try(each.value.allow_forwarded_traffic, false)
allow_gateway_transit = try(each.value.allow_gateway_transit, false)
use_remote_gateways = try(each.value.use_remote_gateways, false)
}vnet_peerings = {
mgmt_spoke_re1_TO_hub_re1 = {
name = "mgmt_spoke_re1_TO_hub_re1"
from = {
vnet_key = "mgmt_spoke_re1" # in landingzone subscription
}
to = {
lz_key = "networking_hub" # in connectivity subscription
output_key = "vnets"
vnet_key = "hub_re1"
}
allow_virtual_network_access = true
allow_forwarded_traffic = true
allow_gateway_transit = false
use_remote_gateways = false
}
hub_re1_TO_mgmt_spoke_re1 = {
name = "hub_re1_TO_mgmt_spoke_re1"
from = {
lz_key = "networking_hub"
output_key = "vnets"
vnet_key = "hub_re1"
}
to = {
vnet_key = "mgmt_spoke_re1"
}
allow_virtual_network_access = true
allow_forwarded_traffic = true
allow_gateway_transit = true
use_remote_gateways = false
}
}terraform returned errors:
╷
│ Error: network.VirtualNetworkPeeringsClient#CreateOrUpdate: Failure sending request: StatusCode=0 -- Original Error: Code="ResourceGroupNotFound" Message="Resource group 'dso01-rg-hub-re1' could not be found."
│
│ with module.solution.azurerm_virtual_network_peering.peering["hub_re1_TO_mgmt_spoke_re1"],
│ on ../../terraform-azurerm-caf/networking.tf line 107, in resource "azurerm_virtual_network_peering" "peering":
│ 107: resource "azurerm_virtual_network_peering" "peering" {
│
╵
Hello all,
Very new to all this. Trying to step beyond running the examples and actually create something. I like the capabilities here, but am not finding what I need. I am trying to implement IAC for our ESLZ Sandbox Subscriptions. I found the following:
- terraform-azurerm-caf/subscriptions.tf
- terraform-azurerm-caf/modules/subscriptions
- terraform-azurerm-caf/modules/subscription_billing_role_assignment
I am trying to "connect the dots" and get a working standalone or rover-based solution for this where I can create sandbox subscriptions upon request for our AppDev teams to use (supplementing their MSDN/VS subscriptions when they need more than the default spending limits on those subscriptions).
I submit this with the hope that I can turn around something quickly if I find the "how to guide" I seem to be missing. Any/all help would be greatly appreciated!
4 replies
rover -lz /tf/caf/landingzones/caf_solution/ -tfstate aks.tfstate -env myenv -level level3 -tfstate_subscription_id 78c73253-4901-4f08-8784-85731562c8b8 -a output [launchpad: 78c73253-4901-4f08-8784-85731562c8b8]
In the docs under https://github.com/Azure/caf-terraform-landingzones/blob/master/documentation/code_architecture/hierarchy.md#operate-with-landing-zones-hierarchy where it says "A deployment will typically contain: ...". What does a deployment refer to here?
I'm trying to get a feel for the distribution of levels, e.g. should there be a full set of levels 0-4 for each of dev/test/prod, or is it intended some levels are shared between environments?
3 replies
Hello. I am trying to find a way to change the subscription_id that I am configuring against when use the standalone module as seen here: https://github.com/aztfmod/terraform-azurerm-caf/blob/master/examples/standalone.md
I have seen the documentation that says you can use "az account set --subscription <subscription_GUID>", but I am trying to perform this in code instead of switching context through the CLI. The azurerm provider itself supports supplying the "subscription_id", but when I attempt to use a provider with an alias while referencing the caf module directly I receive a message stating "Provider azurerm is configured within the module module.caf and cannot be overridden."
provider "azurerm" {
features {}
}
provider "azurerm" {
subscription_id = "0000000000-0000-0000-0000000000"
alias = "set_subscription"
features {}
}
module "caf" {
source = "aztfmod/caf/azurerm"
version = "5.3.11"
providers = {
azurerm = azurerm.set_subscription
}
......
}
1 reply
│ on extensions/devops_selfhosted_agent.tf line 2, in resource "azurerm_virtual_machine_extension" "devops_selfhosted_agent":
│ 2: resource "azurerm_virtual_machine_extension" "devops_selfhosted_agent" {
│
2 replies
After having the launchpad running (with only level0 and level1 for training purposes) I am trying to get my first landingzone on level1 up and running. Unfortunately Rover complains:
var.dynamic_keyvault_secrets
Enter a value:
var.keyvaults
Enter a value:
var.launchpad_key_names
Enter a value:
var.resource_groups
Enter a value:
var.storage_accounts
Enter a value:In the landingzone configuration there is only a landingzone.tfvar file with following content:landingzone = {
backend_type = "azurerm"
global_settings_key = "launchpad"
level = "level1"
key = "networking_HUB"
tfstates = {
launchpad = {
level = "lower"
tfstate = "caf_landingzones.tfstate"
}
}
}
I am running rover with the following command:rover -lz /tf/caf/caf_landingzones/ -var-folder /tf/caf/caf_landingzones/Level1/Networking_HUB -tfstate Networking_HUB.tfstate -level level1 -a plan
I don't find the reason why rover is asking for those variables?
12 replies
Its a 3 issues kind of day...
If UPN1 deploys the launchpad with n subscriptions, then UPN2 try to execute plan or apply for the launchpad then the following error is shown:
│ Error: reading Subscription Alias "subscription_alias_name": subscription.AliasClient#Get: Failure responding to request: StatusCode=401 -- Original Error: autorest/azure: Service returned an error. Status=401 Code="UserNotAuthorized" Message="User does not have access Microsoft.Subscription/aliases/read over scope providers/Microsoft.Subscription/aliases/subscription_alias_name"Both UPN1 and UPN2 have the billing role assignment and I cannot find any (and I mean any) docs on subscription alias permission. Using az account alias list confirms that the subscription creator (UPN1) has access whilst UPN2 does not. Does anyone know about this issue?
1 reply
contoso-2109 branch as we are really interesting in the templating feature. Is it at a working stage ? I've tried to deploy templates/platform but I have a few files missing. @LaurentLesle ?I also saw that this templating feature is available on
AL-contoso branch. I am able to generate configuration files, but it feels like this branch is not maintained anymore.
9 replies
3 replies
Terraform returned errors:
╷
│ Error: validating Template Deployment "g23d2gb1.com" (Resource Group "myrg"): requesting validating: resources.DeploymentsClient#Validate: Failure sending request: StatusCode=0 -- Original Error: Code="InvalidTemplateDeployment" Message="The template deployment 'e23d2gb1.com' is not valid according to the validation procedure. The tracking id is 'c85cc5fa-66ef-4f1c-a9f5-a094d2ae034f'. See inner errors for details." Details=[{"code":"ValidationForResourceFailed","details":[{"code":"INVALID_AGREEMENT_KEYS","message":"End-user must read and consent to all of the following legal agreements: DNRA DNPA"}],"message":"Validation failed for a resource. Check 'Error.Details[0]' for more information."}]
│
│ with module.solution.module.domain_name_registrations["domain_cdn"].azurerm_resource_group_template_deployment.domain,
│ on ../../terraform-azurerm-caf/modules/networking/domain_name_registrations/module.tf line 11, in resource "azurerm_resource_group_template_deployment" "domain":
│ 11: resource "azurerm_resource_group_template_deployment" "domain" {Is anyone successfully using the level0 service principal to run rover?
Certain lzs by default only configure access to keyvaults for this SP (which I'd expect), but Rover's --impersonate functionality seems broken (aztfmod/terraform-azurerm-caf#554, https://github.com/aztfmod/rover/pull/190)
7 replies