Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Activity
  • May 20 04:01
    LaurentLesle synchronize #254
  • May 20 04:00
    LaurentLesle synchronize #254
  • May 19 10:27
    LaurentLesle synchronize #254
  • May 19 01:29
    LaurentLesle synchronize #254
  • May 19 01:27
    LaurentLesle labeled #261
  • May 19 01:27
    LaurentLesle assigned #261
  • May 19 01:27
    LaurentLesle opened #261
  • May 18 06:17
    LaurentLesle synchronize #254
  • May 09 16:51
    Nepomuceno synchronize #170
  • May 09 08:04
    Nepomuceno assigned #170
  • May 09 08:04
    Nepomuceno assigned #170
  • May 09 08:04
    Nepomuceno assigned #170
  • May 09 08:04
    Nepomuceno synchronize #170
  • May 09 08:01
    Nepomuceno synchronize #170
  • May 09 07:57
    Nepomuceno synchronize #170
  • May 09 07:52
    Nepomuceno synchronize #170
  • May 09 07:44
    Nepomuceno synchronize #170
  • May 09 07:34
    Nepomuceno opened #170
  • May 09 07:18
    Nepomuceno opened #169
  • May 06 12:24
    dependabot[bot] labeled #260
nusrath432
@nusrath432
How can we make a block within terraform resource defination - conditional - either based on a single value defined in the tfvars or a block defined in the tfvars. For example:
resource "my_resource" "demo"{
region = var.settings.region

config {
  var1 = lookup(var.settings.config_in_tfvars, "var1", null)
  var2 = lookup(var.settings.config_in_tfvars, "var2", null)
}

}
1 reply
nusrath432
@nusrath432
Has anyone managed to bootstrap CAF / level0 using a service principal - when I run the plan using UPN it works fine but when I run the same with SP (subscription owner), it throws "Building AzureAD Client" Authenticating using the Azure CLI is only supported as a User (not a│ Service Principal).
20 replies
Soy Milk
@SoyMilkOR_twitter
Hi folks, anyone knows how to force-unlock a state file through rover?
4 replies
Sergi Asensio
@asensionacher
Hi all, it is possible to add Suffixes to all resources as we use the prefix?
7 replies
florentvaldelievre
@florentvaldelievre
Hi all, I was wondering if you had a timeline regarding contoso-2109 branch, especially ado_pipeline component template ? (https://github.com/Azure/caf-terraform-landingzones-starter/tree/contoso-2109/templates)
nusrath432
@nusrath432
Does anyone (@arnaudlh) know the purpose of auditing.tf & threat_detection.tf within the postgresql_server module. Ref: https://github.com/aztfmod/terraform-azurerm-caf/blob/103887136309a41ad7772bd7bb433b445be8652e/modules/databases/postgresql_server/auditing.tf - it looks like it is just data source to storage accounts but not really used anywhere - did anyone use it or have an understanding please?
11 replies
Paul Bourke
@brk3
Has anyone used a shared level across multiple environments? E.g. say I have a network hub deployed at level2, and would like to reference that in both -env team1 and -env team2. Is this possible?
19 replies
Ryan Bartram
@rdbartram
FYI, a friend and I are working on rovergo tonight...we're going to try push that project forward and will stream about caf and how we use it in future streams...if you're interested and can help us maybe, then drop by https://www.twitch.tv/worxspace
5 replies
rahulkkeerthi
@rahulkkeerthi
Hi all, my function app is getting recreated after each plan even when no changes were made to it. Is there some that I have to change ? I want to set my function app os_type to windows. Thanks.
15 replies
Arnaud Lheureux
@arnaudlh
Preview Module 5.5.0 - Hi community we are preparing release of module 5.5.0 which includes lot of improvements tracked under this milestone: https://github.com/aztfmod/terraform-azurerm-caf/milestone/6?closed=1. Almost everything is currently already in master branch. The main reason while we move to 5.5.x instead of 5.4.x is because we are introducing configuration aliases for virtual wan. Since provider configuration aliases were introduce in 0.15 we will need to drop support of Terraform 0.13 and 0.14. If you have a test environment, dont hesitate to test the module and give us feedbacks :)
6 replies
nusrath432
@nusrath432

@arnaudlh Best practices - Design pattern for referencing resources within CAF. For example:

private_dns_zone_id = try(
local.combined_objects_private_dns[each.value.private_dns_zone.lz_key][each.value.private_dns_zone.key].id,
local.combined_objects_private_dns[local.client_config.landingzone_key][each.value.private_dns_zone.key].id,
each.value.private_dns_zone.id,
null
)

Q1. For local & lower landingzones, we are using remote_objects = {}. But when do we used local.combined_objects vs local.<resource>?
Q2. Do we have a pattern that works for all scenarios? if the reference objects exists remote state or local state or local code block or external resource?
Q3. Are we supporting patterns such as vnet_key or switch to vnet { key="" lz_key=""} or support both?

5 replies
Darryl Sw
@darryl-sw
Hi all, has anyone successfully integrated a policy engine (like Open Policy Agent) with Rover? I'm hoping to make use of it to prevent certain resources from being deployed with Rover.
2 replies
Sergi Asensio
@asensionacher

Hi, when I deploy an Access Policy in a Key Vault it appears as Unknown, instead of Application

creation_policies = {
      logged_in_user = {
        secret_permissions      = ["Set", "Get", "List", "Delete", "Purge"]
        certificate_permissions = ["managecontacts", "manageissuers"]
      }

      azuread_application = {
        object_id = "c432f4fc-a70e-4833-9d8e-fa44bcexxxxx"
        secret_permissions = ["Set", "Get", "List", "Delete", "Purge", "Recover"]
      }
    }

alt

How I have to do it as an application instead of unknown? Is it possible to use function app key name instead of the object_id?

4 replies
Himanshu Sharma
@hsharma1528
Hello All, I am planning to write my own tf file for Function App as the module within aztfmod doesn't work as expected for Windows function apps. How can a refer to the output of resources created by atfmod in my tf file? I have few more custom tf files to write for other services.
pp-csievering
@pp-csievering
Have a question about Dynamic Keyvault Secrets. Is it possible to reference a keyvault in another landing zone? I tried adding lz_key to the config and would still only find keyvaults in the same landing zone
4 replies
image.png
68747470733a2f2f66696c65732e6769747465722e696d2f3565346330333832643733343038636534666439663937382f73676a612f7468756d622f696d6167652e706e67.png
Soy Milk
@SoyMilkOR_twitter
Hi Folks, anybody know what keyvault_certificate_request module does/ how it works? More specifically for AGW aztfmod/terraform-azurerm-caf#267
3 replies
Soy Milk
@SoyMilkOR_twitter
Also, has anybody implemented through caf an app gateway with ssl certs that are already preexisting, and referencing it by the id ? from what i see, the examples are mostly generating a cert , putting it in keyvault and then referencing the object's key (CAF)
rahulkkeerthi
@rahulkkeerthi
This message was deleted
2 replies
Jonathan
@jonathan-opsguru
This message was deleted
2 replies
Kieran
@kiebrew
Am I right in saying that the supermodule doesn't currently support Azure Monitor Private Link Scope (AMPLS) for connecting to Azure Monitor? I can't see anything in the repo or examples
anasmohana
@anasmohana
Hi is there any documents on how I can deploy resources in multi subscription
1 reply
Kieran
@kiebrew

Hey, we're trying to upgrade our rover version from aztfmod/rover:1.0.4-2108.1305 to the latest versin: aztfmod/rover:1.0.11-2112.0809

Getting a strange error which we can't quite figure out, it's worth noting that we haven't change any configuration code, we're simply changing the image version:

Error on or near line 391: Error running terraform plan; exiting with status 1
cleanup variables
clean_up backend_files
##[error]Bash exited with code '1'.
##[error]Bash wrote one or more lines to the standard error stream.
##[error]WARNING: The command requires the extension resource-graph. It will be installed first.

##[error]
Error: Error loading state error

  with data.terraform_remote_state.remote["launchpad"],
  on locals.remote_tfstates.tf line 19, in data "terraform_remote_state" "remote":
  19:   backend = var.landingzone.backend_type

error loading the remote state: blobs.Client#Get: Failure responding to
request: StatusCode=403 -- Original Error: autorest/azure: Service returned
an error. Status=403 Code="AuthorizationPermissionMismatch" Message="This
request is not authorized to perform this operation using this
permission.\nRequestId:xxxxxxxxxxxxxxxxxxxxxxx\nTime:2022-01-12T08:30:52.9562577Z"

Has anybody else come across this issue?

11 replies
Israel Ayongwa
@iayongwa
image.png
5 replies
Hello everyone, I ran into some errors while trying to deploy GitOps configuration for Azure https://github.com/Azure/caf-terraform-landingzones-starter/blob/starter/configuration/sandpit/pipelines/README-pipelines.md (3.3.3). Has anyone experienced something similar or knows a workaround? I've been looking at it since yesterday without success. Thanks.
anasmohana
@anasmohana
Hello everyone, any idea how to assign the role to the MSI for GitOps to multi subscription by another way can I assign MSI role in existing sub, thanks in advance
asid007
@asid007:matrix.org
[m]
hello everyone....I am new to this CAF based implementation of ESLZ through terraform. Can anyone provide some guidance about how we can setup Enterprise Scale Landing Zone using Terraform (Rover)? There are lot of documentation available but they are confusing as there are some old documents which are no where related now. Kindly provide some info how can we setup ESLZ using Terraform (Rover approach) where will have a management group structure setup, multiple subscriptions - connectivity, identity, management, landing zone etc? Thanks in advance.
1 reply
jasonhornatcrowe
@jasonhornatcrowe

Hello all, please forgive me if this has already been answered, but I am not finding in the examples the proper way to assign group owners... I have what I believe to be a legitimate configuration for the group:

azuread_groups = {
  architects = {
    name        = "AZ Group 1"
    description = "a super cool group"
    members = {
      user_principal_names = [
        "me@mycompany.com"
      ]
      group_names          = []
      object_ids           = []
      group_keys           = []

      service_principal_keys = []

    }
    owners = {
      user_principal_names = [
        "somebody_else@mycompany.com"
      ]
    }
    prevent_duplicate_name = true
  }
}

I can see that the member is getting applied correctly... but the owner object id in the plan is always the person etc. running the command... Anyone know what I am doing wrong here?

Thanks in advance!

4 replies
Israel Ayongwa
@iayongwa

Hi, Just wanted to ask if anyone else has come across the same issue. I have tried to deploy https://github.com/Azure/caf-terraform-landingzones-starter/tree/starter/configuration/sandpit/level1/gitops/azure_devops. and get below error when running PLAN: on /home/vscode/.terraform.cache/modules/caf/modules/security/keyvault_access_policies/policies.tf line 12, in module "azuread_apps":
│ 12: object_id = var.azuread_apps[try(try(each.value.azuread_app_lz_key, each.value.lz_key),var.client_config.landingzone_key)][each.value.azuread_app_key].azuread_service_principal.object_id
│ ├────────────────
│ │ each.value is object with 3 attributes
│ │ each.value.lz_key is "launchpad"
│ │ var.azuread_apps is object with 1 attribute "azdo-contoso"
│ │ var.client_config.landingzone_key is "azdo-contoso"

│ The given key does not identify an element in this collection value.

Hello forum. I ran into a similar error like the one quoted here. The proposed solution by Luke to set azure_devops to "level1" and launchpad level to "lower" is incorporated in the new stable release. Has anyone experienced this? So I have been trying to 'customize' the starter template a bit to suit my needs by commenting out deployments to level3 and level4 which I do not need. I don't know if that has anything to do with this error. Thanks in advance for any tips or advice.

3 replies
image.png
bobbyDazzle
@bobbyDazzle5_twitter

Evening all, hopefully someone can help me here. I've been using Terraform since the early days, probably started with v0.8 and loved it from day one. Deployed to AWS, Azure, VMWare and various other providers in all sorts of environments. So I'm very comfortable with it.

However, I'm struggling with the CAF. Not necessarily the actual module (it's complex but I know when I sit down and work through it I'll be fine). The issue is the actual implementation of it for real-world deployments. I'm really struggling following all the different repos and examples. Seems that there's always some other example or repo lurking that only serves to make me 'unlearn what I have just learnt' .

Is anyone aware of any good content that brings all this together and may help bridge the gap? I've not been able to put my finger on why I'm struggling having this all sink in.

Thanks all.....

20 replies
Happy Elegance
@happyelegance

Hello everyone, I have a question I hope someone can help me out with. Our environment does not use Rover.

I created the azuread group in a shared.tfstate file. But for different environments stored in env.tfstate I'd like to create the role assignments and pass the group_key. I want to reference this group through terraform_remote_state. I folowed the pattern in that doc: https://github.com/Azure/caf-terraform-landingzones/blob/master/documentation/code_architecture/service_composition.md
I added the data "terraform_remote..." and the local variable for azuread_groups in my main.tf. But when I try to reference the group in my env.tfvar it doesn't know about it. Any help would be appreciated.
Thanks in advance!

azuread_groups = {
  group_key = {
     id   = "data.terraform_remote_state.shared.outputs.objects.test.azuread_groups.group_key.id"
  }
}
#shared.tf
azuread_groups = {
  group_key = {
    name        = "Test Group"
    description = "Test Group"
    members = {
      user_principal_names = []
      group_names          = []
      object_ids           = []
      group_keys           = []
      service_principal_keys = []
    }
    owners = {
      user_principal_names = []
      service_principal_keys = []
    }
    prevent_duplicate_name = false
  }
}

# main.tf
data "terraform_remote_state" "shared" {
  backend = "azurerm" 
  config = {
    ...
    key = "shared.tfstate"
  }
}

#env.tf
locals { 
...
   azuread_groups = data.terraform_remote_state.shared.outputs.azuread_groups
...
10 replies
Shane Holder
@sholder_twitter

Hi, I've stood up the CAF demo environment through Level 2 and used the 100-single-linux-vm to stand a VM up in Level 3. I then wanted to tear down the level 3 vm, change some stuff and re-run it. When I ran the rover destroy process I received errors from KeyVault.

Error: purging of Secret "xyzzy-vm-examplevm1-ssh-public-key-openssh" (Key Vault "https://xyzzy-kv-vmlinuxakv.vault.azure.net/") : keyvault.BaseClient#PurgeDeletedSecret: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="Operation \"purge\" is not allowed because purge protection is enabled for this vault. Key Vault service will automatically purge it after the retention period has passed.\r\nVault: xyzzy-kv-vmlinuxakv;location=eastus2"

What is the proper recovery process when an error like this occurs? Also is this an error that should be reported somewhere?

Hein Tonny Køien
@heintonny
Hi. Thanks for grate work with Enterprise Scale and CAF. When we use Enteprise Scale (ES) Management to deploy Log Analytics workspace and diagnostic_definitions, what would be the best /recomended aproach to deploy Azure CAF resources with this diagnostics profiles? I can't find any "link" between ES output and CAF input (or visa versa) to do this "out-of-the-box". I guess we can leave it to ES policies to deploy diagnostic profiles, but I think it would be better to do the linking directly when we create CAF resources. Apriciate your thoughts and recomendations?
6 replies
florentvaldelievre
@florentvaldelievre

Hi, I have question regarding ip_groups scope and landing zone. See below my issue:

lz_1
   ip_groups.tfvars
lz_2
   firewall_policies.tfvars

firewall_policies.tfvars contains a list of firewall rules.
Can I reference source_ip_groups_keys with keys defined in lz_1 or keys only works withing the same landing zone ?
I have tried to add lz1 tfstate in the lz2 landingzone block, but it still can't recognize the group key defined in lz_1

// lz_2/configuration.tfvars
landingzone = {
  backend_type        = "azurerm"
  global_settings_key = "foundations"
  level               = "level2"
  key                 = "lz_2"
  tfstates = {
    lz1 = {
      level   = "current"
      tfstate = "lz1.tfstate"
    }
  }
}
10 replies
Roland
@schoenr79

Hi everyone,
what could cause the problem that i am not able do access global_settings from level0 in the higher level1 / eslz?

│ Error: Unsupported attribute │ │ on enterprise_scale.tf line 10, in module "enterprise_scale": │ 10: default_location = local.global_settings.regions[local.global_settings.default_region] │ ├──────────────── │ │ local.global_settings is object with no attributes │ │ This object does not have an attribute named "regions".

2 replies
Ronaldschouw
@Ronaldschouw

Hi, I wrote our image gallery module in level1. Its it working fine. We are using our own harded RHEL images.
The output in the tstate file is as follow:

    "shared_image_gallery": {
      "value": {
        "rhel84": {
          "id": "/subscriptions/xxxxxx/resourceGroups/mcdta-rg-image-gallery-ocpe/providers/Microsoft.Compute/galleries/RedHat/images/RHEL_8/versions/8.4.0"
        }

The id of the image is used to create a virtual machine in level2.
A snip of the tfvar file of the virtual server.

        os_disk = {
          name                    = "idm1-os"
          caching                 = "ReadWrite"
          storage_account_type    = "Standard_LRS"
          disk_size_gb            = "40"
          disk_encryption_set_key = "set1"
        }
        custom_image_ids = {
          lz_key           = "shared_image_gallery"
          custom_image_key = "rhel84"
         }

And the config to read the lower tfstate file.

landingzone = {
  backend_type        = "azurerm"
  global_settings_key = "management"
  level               = "level2"
  key                 = "identity_virtual_host"
  tfstates = {
    identity_network = {
      level   = "current"
      tfstate = "identity_network.tfstate"
    }
    shared_image_gallery = {
      level   = "lower"
      tfstate = "shared_image_gallery.tfstate"
    }
  }
}

Unfortunately, the custom_image_ids is not handled properly in the module. I think the problem is in the module of the virtualserver. This one looks like this:

source_image_id = try(each.value.custom_image_id,var.custom_image_ids[each.value.lz_key][each.value.custom_image_key].id, null)

If the module terraform-azurerm-caf/modules/compute/virtual_machine/vm_linux.tf is modified as follows, will the variable from the lower tfstate file be retrieved correctly? Are we missing a landingzone_key ?

source_image_id = try(each.value.custom_image_id,try(var.custom_image_ids[var.client_config.landingzone_key][each.value.lz_key][each.value.custom_image_key].id,var.custom_image_ids[each.value.lz_key][each.value.custom_image_key].id))

Nevertheless, if the custom_image_id is used with the full id:/subscription/.. from the azure configuration, everything works properly. But then we have added a static value to a variable configuration.
How can the module be adapted?
It will help us a lot

6 replies
Joseph Perez
@zepperez
Hello, I'm looking to see if we can deploy resources without using the dev container. Can anyone provide guidance on how it works? Thanks!
Sebastian Gräf
@segraef
image.png

Hi there,

After deploying launchpad level0 via rover ignite from contoso-2201 it fails with

Apply complete! Resources: 146 added, 0 changed, 0 destroyed.

Outputs:

diagnostics = <sensitive>
global_settings = <sensitive>
launchpad_identities = <sensitive>
objects = <sensitive>
tfstates = <sensitive>
Terraform apply return code: 0
@calling get_storage_id
@calling upload_tfstate
Moving launchpad to the cloud
ERROR: argument --ids: expected at least one argument

Examples from AI knowledge base:
az storage account show --ids /subscriptions/{SubID}/resourceGroups/{ResourceGroup}/providers/Microsoft.Storage/storageAccounts/{StorageAccount}
Show properties for a storage account by resource ID.

az storage account show --resource-group MyResourceGroup --name MyStorageAccount
Show properties for a storage account using an account name and resource group.

https://docs.microsoft.com/en-US/cli/azure/storage/account#az_storage_account_show
Read more about the command in reference docs
Error on or near line 142; exiting with status 1
Error on or near line 142; exiting with status 1

@calling clean_up_variables
cleanup variables
clean_up backend_files
vscode@7b5da0201736:/tf/caf/$

My details:

aztfmod/rover:1.1.3-2201.2106

When I execute the rover command again it fails again.
Any idea what I'm missing or is this error known?

Not sure how to check the logs in the rover to actually see what's happening ;)
nusrath432
@nusrath432
Application Gateway - Backend Pools and Targets - How can we set multiple Backend Pools with mutiple Rules/Targets for a given App GW - The code seems to be picking only on Backend Pool with name as App GW name instead of picking name from value.backend_pool.name
Ref: locals.backend_pools.tf:L28 - Anyone has an example block please
1 reply
tpatrizio
@tpatrizio
Hi everyone, I'm looking for someone who can share his experience deploying rover as a GitLab runner. I saw the documentation will be updated in the next months but I'm wondering if someone has already had a chance to test this setup. I'd also like to have your opinion about the possibility to store terraform state in GitLab instead of Azure storage account. Thanks a lot for your time
jleonelion
@jleonelion
@arnaudlh @LaurentLesle - partitioning TF code into levels is a great design pattern, but I am having a tough time keeping the resource types intended for each level at their respective level. As a specific example, I want to create a policy that requires all VMs within a particular region send their logs to the log analytics workspace for that region. Policies are level1 and common logging services level2. This creates a problem in that the policy (level1) needs to reference a resource at level2. Only work-around I can think of is creating the policy at level2 (or create the LAW at level0 or level1). Both of these approaches break the proposed design pattern and roles intended for the levels. Hoping you or other members of the channel can advise if I am misunderstanding the intent of each level.
5 replies
jbla9028
@jbla9028
I think we may be running into a similar issue. I have concerns about how large certain states may get. We are trying to break up into layers but finding some difficulties joining layers since there are no way to connect layers without using resource Ids as far as we can see?
8 replies
Roland
@schoenr79
I am looking for an example, how to implement network peering across different subscriptsion. What is the best way to implement that?
3 replies
tpatrizio
@tpatrizio
Hi all, what about the rovergo project? is there someone who can share his experience in using it as a replacement of the traditional rover implementation?
12 replies
Shane Holder
@sholder_twitter
Hello, I am running into an issue with running the level1 platform_subscriptions step of the enterprise framework (2201). The rover plan is says that it needs to create the launchpad subscription which is the same subscription as our TF states, are they supposed to be the same or different? The other subscriptions we have also already exist, management, identity, connectivity however the rover plan shows that these subs already exist and all it wants to do is create the alias. Is there a recovery from this?
1 reply