Hello all,
Very new to all this. Trying to step beyond running the examples and actually create something. I like the capabilities here, but am not finding what I need. I am trying to implement IAC for our ESLZ Sandbox Subscriptions. I found the following:
- terraform-azurerm-caf/subscriptions.tf
- terraform-azurerm-caf/modules/subscriptions
- terraform-azurerm-caf/modules/subscription_billing_role_assignment
I am trying to "connect the dots" and get a working standalone or rover-based solution for this where I can create sandbox subscriptions upon request for our AppDev teams to use (supplementing their MSDN/VS subscriptions when they need more than the default spending limits on those subscriptions).
I submit this with the hope that I can turn around something quickly if I find the "how to guide" I seem to be missing. Any/all help would be greatly appreciated!
4 replies
rover -lz /tf/caf/landingzones/caf_solution/ -tfstate aks.tfstate -env myenv -level level3 -tfstate_subscription_id 78c73253-4901-4f08-8784-85731562c8b8 -a output [launchpad: 78c73253-4901-4f08-8784-85731562c8b8]
In the docs under https://github.com/Azure/caf-terraform-landingzones/blob/master/documentation/code_architecture/hierarchy.md#operate-with-landing-zones-hierarchy where it says "A deployment will typically contain: ...". What does a deployment refer to here?
I'm trying to get a feel for the distribution of levels, e.g. should there be a full set of levels 0-4 for each of dev/test/prod, or is it intended some levels are shared between environments?
3 replies
Hello. I am trying to find a way to change the subscription_id that I am configuring against when use the standalone module as seen here: https://github.com/aztfmod/terraform-azurerm-caf/blob/master/examples/standalone.md
I have seen the documentation that says you can use "az account set --subscription <subscription_GUID>", but I am trying to perform this in code instead of switching context through the CLI. The azurerm provider itself supports supplying the "subscription_id", but when I attempt to use a provider with an alias while referencing the caf module directly I receive a message stating "Provider azurerm is configured within the module module.caf and cannot be overridden."
provider "azurerm" {
features {}
}
provider "azurerm" {
subscription_id = "0000000000-0000-0000-0000000000"
alias = "set_subscription"
features {}
}
module "caf" {
source = "aztfmod/caf/azurerm"
version = "5.3.11"
providers = {
azurerm = azurerm.set_subscription
}
......
}
4 replies
1 reply
│ on extensions/devops_selfhosted_agent.tf line 2, in resource "azurerm_virtual_machine_extension" "devops_selfhosted_agent":
│ 2: resource "azurerm_virtual_machine_extension" "devops_selfhosted_agent" {
│
2 replies
After having the launchpad running (with only level0 and level1 for training purposes) I am trying to get my first landingzone on level1 up and running. Unfortunately Rover complains:
var.dynamic_keyvault_secrets
Enter a value:
var.keyvaults
Enter a value:
var.launchpad_key_names
Enter a value:
var.resource_groups
Enter a value:
var.storage_accounts
Enter a value:In the landingzone configuration there is only a landingzone.tfvar file with following content:landingzone = {
backend_type = "azurerm"
global_settings_key = "launchpad"
level = "level1"
key = "networking_HUB"
tfstates = {
launchpad = {
level = "lower"
tfstate = "caf_landingzones.tfstate"
}
}
}
I am running rover with the following command:rover -lz /tf/caf/caf_landingzones/ -var-folder /tf/caf/caf_landingzones/Level1/Networking_HUB -tfstate Networking_HUB.tfstate -level level1 -a plan
I don't find the reason why rover is asking for those variables?
12 replies
Its a 3 issues kind of day...
If UPN1 deploys the launchpad with n subscriptions, then UPN2 try to execute plan or apply for the launchpad then the following error is shown:
│ Error: reading Subscription Alias "subscription_alias_name": subscription.AliasClient#Get: Failure responding to request: StatusCode=401 -- Original Error: autorest/azure: Service returned an error. Status=401 Code="UserNotAuthorized" Message="User does not have access Microsoft.Subscription/aliases/read over scope providers/Microsoft.Subscription/aliases/subscription_alias_name"Both UPN1 and UPN2 have the billing role assignment and I cannot find any (and I mean any) docs on subscription alias permission. Using az account alias list confirms that the subscription creator (UPN1) has access whilst UPN2 does not. Does anyone know about this issue?
1 reply
contoso-2109 branch as we are really interesting in the templating feature. Is it at a working stage ? I've tried to deploy templates/platform but I have a few files missing. @LaurentLesle ?I also saw that this templating feature is available on
AL-contoso branch. I am able to generate configuration files, but it feels like this branch is not maintained anymore.
9 replies
Terraform returned errors:
╷
│ Error: validating Template Deployment "g23d2gb1.com" (Resource Group "myrg"): requesting validating: resources.DeploymentsClient#Validate: Failure sending request: StatusCode=0 -- Original Error: Code="InvalidTemplateDeployment" Message="The template deployment 'e23d2gb1.com' is not valid according to the validation procedure. The tracking id is 'c85cc5fa-66ef-4f1c-a9f5-a094d2ae034f'. See inner errors for details." Details=[{"code":"ValidationForResourceFailed","details":[{"code":"INVALID_AGREEMENT_KEYS","message":"End-user must read and consent to all of the following legal agreements: DNRA DNPA"}],"message":"Validation failed for a resource. Check 'Error.Details[0]' for more information."}]
│
│ with module.solution.module.domain_name_registrations["domain_cdn"].azurerm_resource_group_template_deployment.domain,
│ on ../../terraform-azurerm-caf/modules/networking/domain_name_registrations/module.tf line 11, in resource "azurerm_resource_group_template_deployment" "domain":
│ 11: resource "azurerm_resource_group_template_deployment" "domain" {Is anyone successfully using the level0 service principal to run rover?
Certain lzs by default only configure access to keyvaults for this SP (which I'd expect), but Rover's --impersonate functionality seems broken (aztfmod/terraform-azurerm-caf#554, https://github.com/aztfmod/rover/pull/190)
7 replies
9 replies
│ Error: Unsupported attribute
│
│ on ../../terraform-azurerm-caf/modules/networking/domain_name_registrations/output.tf line 8, in output "dns_domain_registration_id":
│ 8: value = jsondecode(azurerm_resource_group_template_deployment.domain.output_content).id.value
│ ├────────────────
│ │ azurerm_resource_group_template_deployment.domain.output_content is "{}"
│
│ This object does not have an attribute named "id".
╵
@calling apply
running terraform apply
Terraform version 0.15 or greater
Terraform apply return code: 1
Terraform returned errors:
I'm exploring the possibility of configuring certain aspects of B2C with CAF and experiencing the following error:
│ Error: Unable to list provider registration status, it is possible that this is due to invalid credentials or the service principal does not have permission to use the Resource Manager API, Azure error: resources.ProvidersClient#List: Failure responding to request: StatusCode=404 -- Original Error: autorest/azure: Service returned an error. Status=404 Code="SubscriptionNotFound" Message="The subscription '000000-0000-0000-0000-000000000000' could not be found."
│
│ with provider["registry.terraform.io/hashicorp/azurerm"],
│ on main.tf line 30, in provider "azurerm":
│ 30: provider "azurerm" {
│
╵The subscription ID (000000-0000-0000-0000-000000000000) is actually the B2C tenant ID which I believe is one cause for the error. Has anyone had success using CAF and rover with B2C?
} to try(azurerm_windows_virtual_machine_scale_set.vmss["windows"].id, null)}
1 reply
2 replies
Good afternoon. Im trying to create an azuread application with service principal and a assigned built in role but still the example (examples/azuread/100-azuread-application-with-sevice-principle-with-builtin-roles) fails. with the following error
```Error: Error in function call
on /home/vscode/.terraform.cache/Dev/rover_jobs/20211029113352728156040/modules/solution/azuread_service_principals.tf line 15, in module "azuread_service_principals":
15: application_id = coalesce(
16: try(each.value.azuread_application.application_id, ""),
17: try(local.combined_objects_azuread_applications[each.value.azuread_application.lz_key][each.value.azuread_application.key].application_id, ""),
18: try(local.combined_objects_azuread_applications[local.client_config.landingzone_key][each.value.azuread_application.key].application_id, "")
19: )
────────────────
each.value.azuread_application is object with 1 attribute "key"
each.value.azuread_application.key is "test_client"
local.client_config.landingzone_key is "management"
local.combined_objects_azuread_applications is object with 2 attributes
Call to function "coalesce" failed: no non-null, non-empty-string arguments.
Terraform plan return code: 1
Error on or near line 287: Error running terraform plan; exiting with status 1
```
i am using terraform caf solution v5.4.4
seems to be that the applicaiton id could not be obtained. any hint on that would be welcome. thx
41 replies
4 replies
9 replies
I knew if i put a subscription id to subscription_id_overrides it will move it to the dependent management group. but what is the other key for.
3 replies
Initializing the backend...
╷
│ Error: Error building ARM Config: Authenticating using the Azure CLI is only supported as a User (not a Service Principal).
│
│ To authenticate to Azure using a Service Principal, you can use the separate 'Authenticate using a Service Principal'
│ auth method - instructions for which can be found here: https://www.terraform.io/docs/providers/azurerm/guides/service_principal_client_secret.html
│
│ Alternatively you can authenticate using the Azure CLI by using a User Account.
│
│Does the aztfmod/terraform-azurerm-caf super module contain any coverage for CDN profiles / endpoints?
Sorry if this blatantly obvious, I searched the repo and came up empty. I did get the static site stubbed, but want to add these resources as well. I can, of course, create these using the hashicorp/azurerm provider resources, but don't want to go outside of CAF if I can help it.
2 replies
https://github.com/aztfmod/terraform-provider-azurecaf/blob/master/resourceDefinition.json
5 replies
- How do we handle changes in lower layers and run the pipeline for all the impacted layers?
- How do we handle multi-user mode and merge conflicts using CI/CD?
... more
17 replies