I have an existing vNet and subnet and I'm trying to deploy a new NIC to the Subnet with the following bicep
param location string = resourceGroup().location
param nicName string
param vNetName string
param subnetName string
resource vnet 'Microsoft.Network/virtualNetworks#2021-02-01' existing = {
name: vNetName
scope: resourceGroup('myRgName')
}
resource subnet 'Microsoft.Network/virtualNetworks/subnets#2021-02-01' existing = {
parent: vnet
name: subnetName
}
resource nsg 'Microsoft.Network/networkSecurityGroups#2021-08-01' = {
name: '${nicName}-nsg'
location: location
}
resource nic 'Microsoft.Network/networkInterfaces#2021-08-01' = {
name: nicName
location: location
dependsOn: [
subnet
]
properties: {
ipConfigurations: [
{
name: 'ipConfig'
properties: {
privateIPAllocationMethod: 'Dynamic'
subnet: subnet
primary: true
privateIPAddressVersion: 'IPv4'
}
}
]
networkSecurityGroup: nsg
}
}
I compile the template and try to deploy but I'm getting the error Value for reference id is missing. Path properties.ipConfigurations[0].properties.subnet. which appears to be caused by the ARM not finding the subnet (which exists and I have access to).
The json portion of it looks like this
"subnet": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, 'myRgName'), 'Microsoft.Network/virtualNetworks/subnets', split(parameters('subnetName'), '/')[0], split(parameters('subnetName'), '/')[1]), '2021-02-01', 'full')]",
Use
subnet: {
id: subnet.id
}
for the subnet reference in the NIC's properties... you'll need the same for the networkSecurityGroup as Thomas mentioned.
Related
I have a Bicep template to create an Azure Storage Account
#description('the name of the storage account')
param name string
#description('the alias of the storage account')
param shortName string
#description('tags')
param tags object
#description('the name of the key vault resource where place output secrets')
param keyVaultName string
resource storageAccount 'Microsoft.Storage/storageAccounts#2022-09-01' = {
name: name
location: resourceGroup().location
sku: {
name: 'Standard_LRS'
tier: 'Standard'
}
kind: 'StorageV2'
tags: union(tags, {
type: 'storage-account'
})
}
Then, I need to get the keys
var keys = listkeys(storageAccount.id, storageAccount.apiVersion)
output keyObject object = keys[0]
output KeyValue string = keys[0].value
But everytime that I runs the template, I receive these errors:
{
"code": "DeploymentOutputEvaluationFailed",
"message": "Unable to evaluate template outputs: 'keyObject,keyValue'. Please see error details and deployment operations. Please see https://aka.ms/arm-common-errors for usage details.",
"details": [
{
"code": "DeploymentOutputEvaluationFailed",
"target": "keyObject",
"message": "The template output 'keyObject' is not valid: The language expression property '0' can't be evaluated, property name must be a string.."
},
{
"code": "DeploymentOutputEvaluationFailed",
"target": "keyValue",
"message": "The template output 'keyValue' is not valid: The language expression property '0' can't be evaluated, property name must be a string.."
}
]
}
The purpose of get keys is to save it into Azure Key Vault by using KeyValue var from previous step
resource keyVault 'Microsoft.KeyVault/vaults#2022-07-01' existing = {
name: keyVaultName
}
resource secret 'Microsoft.KeyVault/vaults/secrets#2022-07-01' = {
parent: keyVault
name: secretName
properties: {
value: KeyValue
contentType: 'plain/text'
}
}
So..
What's wrong with listKeys(...) method?
By following this tweet https://twitter.com/adotfrank/status/1341084692100108288?s=46&t=sWx0hvS0sS47llWLlbWZTw I found an alternative method to get keys.
Just referencing to a storage account object and use the method listKeys()
resource storageAccount 'Microsoft.Storage/storageAccounts#2022-09-01' = {
name: name
location: resourceGroup().location
sku: {
name: 'Standard_LRS'
tier: 'Standard'
}
kind: 'StorageV2'
tags: union(tags, {
type: 'storage-account'
})
}
var storageAccountKeys = storageAccount.listKeys()
Then, I can access to primary or secondary key with storageAccountKeys.keys[0].value
This fix solve my issue.
I am using below Bicep file for Azure role assignments . So here I have a Azuredevops pipeline which wil build the bicepfile to arm template and from pipeline variables, the paramaters.json file will be getting updated.
main.bicep
targetScope = 'resourceGroup'
#description('Principal type of the assignee.')
#allowed([
'Device'
'ForeignGroup'
'Group'
'ServicePrincipal'
'User'
])
param principalType string
#description('the id for the role defintion, to define what permission should be assigned')
param RoleDefinitionId string
#description('the id of the principal that would get the permission')
param principalId string
#description('the role deffinition is collected')
resource roleDefinition 'Microsoft.Authorization/roleDefinitions#2018-01-01-preview' existing = {
scope: resourceGroup()
name: RoleDefinitionId
}
resource RoleAssignment 'Microsoft.Authorization/roleAssignments#2020-10-01-preview' = {
name: guid(resourceGroup().id, RoleDefinitionId, principalId)
properties: {
roleDefinitionId: roleDefinition.id
principalId: principalId
principalType: principalType
}
}
paramters.json
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"principalType": {
"value": "#{principalType}#"
},
"RoleDefinitionId": {
"value": "#{RoleDefinitionId}#"
},
"principalId": {
"value": "#{principalId}#"
}
}
}
pipeline build task for creation deployment.
'az deployment group create --resource-group $(resourceGroup) --template-file $(System.DefaultWorkingDirectory)/template/main.json --parameters $(System.DefaultWorkingDirectory)/template/parameters.json'
When I triggered the pipeline firstime, i got output summary as below.
The deployment will update the following scope:
Scope: /subscriptions/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/resourceGroups/XXXXXXXXXXXXXXXXXXX-rg
+ Microsoft.Authorization/roleAssignments/xxxxxxxxxxxxxxxx [2020-10-01-preview]
apiVersion: "2020-10-01-preview"
id: "/subscriptions/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/resourceGroups/XXXXXXXXXXXXXXXXXXX-rg/providers/Microsoft.Authorization/roleAssignments/xxxxxxxxxxxxxxxxx"
name: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
properties.principalId: "xxxxxxxxxxxxx"
properties.roleDefinitionId: "/subscriptions/XXXXXXXXXXXXXXXXXXXXX/resourceGroups/XXXXXXXXXXXXXXXXXXX-rg/providers/Microsoft.Authorization/roleDefinitions/xxxxxxxxxxxxxxxxxxxxxxx"
type: "Microsoft.Authorization/roleAssignments"
And after that, if I retrigger the pipeline again without any change to the templates. Its showing as 1 to modify, but expected that the output will show as "no change". Because we havenet made any changes to the resource either from pipeline side or manually.
Scope: /subscriptions/xxxxxxxxxxxxxxxxxx/resourceGroups/xxxxxxxxxxxxxxxx-rg
~ Microsoft.Authorization/roleAssignments/xxxxxxxxxxxxxxxxxxxxxxx [2020-10-01-preview]
~ properties.roleDefinitionId: "/subscriptions/xxxxxxxxxxxxxxxxxxx/providers/Microsoft.Authorization/roleDefinitions/xxxxxxxxxxxxxxxxxxxxxxxxx" => "/subscriptions/xxxxxxxxxxxxxxxxxxxx/resourceGroups/xxxxxxxxxxxxxxx-rg/providers/Microsoft.Authorization/roleDefinitions/xxxxxxxxxxxxxxxxxxx"
x properties.principalType: "Group"
Resource changes: 1 to modify
iF i again deploy also, the next time again will show the same output as 1 to modify
What is the issue here, Why ARM deployment is showing changes eventhough there are no changes.
Azure built-in role definitions are defined at the subscription level unless it is a custom role that you've created at the another scope.
In your bicep file, you can change the scope of the roleDefinition resource:
#description('the role deffinition is collected')
resource roleDefinition 'Microsoft.Authorization/roleDefinitions#2018-01-01-preview' existing = {
scope: subscription()
name: RoleDefinitionId
}
or you could also use subscriptionResourceId:
resource RoleAssignment 'Microsoft.Authorization/roleAssignments#2020-10-01-preview' = {
name: guid(resourceGroup().id, RoleDefinitionId, principalId)
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', RoleDefinitionId)
principalId: principalId
principalType: principalType
}
}
After using terraform for a very long time, I decided to start learning azure bicep. So far I am trying to have a grip on the logic. So far I have playing around on deployment of a storage account and keyvault. What I am doing here is the following.
create a storage account
use existing key vault to store storage account connection string as secret
create a key based on the storage account name
And this works as I am expected.
So I wanted to take one step forward. and here is where I am a bit confused.
What I wanted to do, is to use the same bicep template, to create a new secret but in a different resource group into a different key vault.
Now according to my understand of azure documentation, the template comes with a default scope which in my specific case target my default subscription and to run my bicep template from the terminal I use the command
az deployment group create -f ./template.bicep -g <resource-group-name>
and this is my template:
// Default values I'm using to test
param keyVaultName string = '<keyvault-name>'
param managedIdentityName string = 'test-managed-identity'
param tenantCodes array = [
'elhm'
'feor'
]
// I'm using prefix so I dont need to create additional arrays
var keyVaultKeyPrefix = 'Client-Key-'
var storagePrefix = 'sthrideveur'
// Get a reference to key vault
resource keyVault 'Microsoft.KeyVault/vaults#2021-06-01-preview' existing = {
name: keyVaultName
}
// Create a managed identity
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities#2018-11-30' = {
name: managedIdentityName
location: resourceGroup().location
}
// Grant permissions to key vault
resource accessPolicy 'Microsoft.KeyVault/vaults/accessPolicies#2019-09-01' = {
name: '${keyVault.name}/add'
properties: {
accessPolicies: [
{
tenantId: subscription().tenantId
objectId: managedIdentity.properties.principalId
permissions: {
// minimum required permissions
keys: [
'get'
'unwrapKey'
'wrapKey'
]
}
}
]
}
}
// Create key vault keys
resource keyVaultKeys 'Microsoft.KeyVault/vaults/keys#2021-06-01-preview' = [for tenantCode in tenantCodes: {
name: '${keyVault.name}/${keyVaultKeyPrefix}${tenantCode}'
properties: {
keySize: 2048
kty: 'RSA'
// storage key should only needs these operations
keyOps: [
'unwrapKey'
'wrapKey'
]
}
}]
// Create storage accounts
resource storageAccount 'Microsoft.Storage/storageAccounts#2021-04-01' = [for tenantCode in tenantCodes: {
name: '${storagePrefix}${tenantCode}'
location: resourceGroup().location
kind: 'StorageV2'
sku: {
name: 'Standard_RAGRS'
}
// Assign the identity
identity: {
type: 'UserAssigned'
userAssignedIdentities: {
'${managedIdentity.id}': {}
}
}
properties: {
allowCrossTenantReplication: true
minimumTlsVersion: 'TLS1_2'
allowBlobPublicAccess: false
allowSharedKeyAccess: true
networkAcls: {
bypass: 'AzureServices'
virtualNetworkRules: []
ipRules: []
defaultAction: 'Allow'
}
supportsHttpsTrafficOnly: true
encryption: {
identity: {
// specify which identity to use
userAssignedIdentity: managedIdentity.id
}
keySource: 'Microsoft.Keyvault'
keyvaultproperties: {
keyname: '${keyVaultKeyPrefix}${tenantCode}'
keyvaulturi: keyVault.properties.vaultUri
}
services: {
file: {
keyType: 'Account'
enabled: true
}
blob: {
keyType: 'Account'
enabled: true
}
}
}
accessTier: 'Cool'
}
}]
// Store the connectionstrings in KV if specified
resource storageAccountConnectionStrings 'Microsoft.KeyVault/vaults/secrets#2019-09-01' = [ for (name, i) in tenantCodes :{
name: '${keyVault.name}/${storagePrefix}${name}'
properties: {
value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount[i].name};AccountKey=${listKeys(storageAccount[i].id, storageAccount[i].apiVersion).keys[0].value};EndpointSuffix=${environment().suffixes.storage}'
}
}]
according to the documentation here https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-resource-group?tabs=azure-cli
When I need to target a specific resource group, I can use the scope in the resource, so I create this:
resource keyvaultApi 'Microsoft.KeyVault/vaults#2021-06-01-preview' existing = {
name: keyVaultApiName
scope: resourceGroup('secondresourcegroup')
}
So far no errors, but the problem happens when I had to create a managed identity resource.
resource keyvaultApi 'Microsoft.KeyVault/vaults#2021-06-01-preview' existing = {
name: keyVaultApiName
scope: resourceGroup('secondresourcegroup')
}
resource managedIdentityTwo 'Microsoft.ManagedIdentity/userAssignedIdentities#2018-11-30' = {
name: managedIdentityNameTwo
location: resourceGroup().location
}
resource accessPolicyApi 'Microsoft.Media/videoAnalyzers/accessPolicies#2021-11-01-preview' = {
name: '${keyvaultApi.name}/add'
properties: {
accessPolicies: [
{
tenantId: subscription().tenantId
objectId: managedIdentityTwo.properties.principalId
permissions: {
// minimum required permissions
keys: [
'get'
'unwrapKey'
'wrapKey'
]
}
}
]
}
}
In the key vault I could declare the scope, but to the underlying resources, such as access policy etc, I cannot declare the scope. So how can bicep understand that those resources needs to target a specific resource group and specific key vault?
Because when I run the terminal command, I am targeting a specific resource group, so I don't really understand how I can use one template to target different resource groups and resources accordingly.
I hope I made my point clear, and please if I didn't, just feel free to ask me more informations.
Thank you so much for your time and help
UPDATE:
When I try to run the code as it is, I get the following error:
{"status":"Failed","error":{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"NotFound","message":"{\r\n \"error\": {\r\n \"code\": \"ParentResourceNotFound\",\r\n \"message\": \"Can not perform requested operation on nested resource. Parent resource 'secondkeyvault' not found.\"\r\n }\r\n}"}]}}
UPDATE:
So I followed the Daniel lead and in a second template I deployed the code I needed for the second template as follow:
template2.bicep
param deploymentIdOne string = newGuid()
param deploymentIdTwo string = newGuid()
output deploymentIdOne string = '${deploymentIdOne}-${deploymentIdTwo}'
output deploymentIdTwo string = deploymentIdTwo
// Default values I'm using to test
param keyVaultApiName string = 'secondkeyvaultapi'
param managedIdentityNameTwo string = 'second-second-identity'
var keyVaultKeyPrefixTw = 'Client-Key-'
param tenantCodes array = [
'tgrf'
]
resource keyvaultApi 'Microsoft.KeyVault/vaults#2021-06-01-preview' existing = {
name: keyVaultApiName
}
resource managedIdentityTwo 'Microsoft.ManagedIdentity/userAssignedIdentities#2018-11-30' = {
name: managedIdentityNameTwo
location: resourceGroup().location
}
resource accessPolicyApi 'Microsoft.KeyVault/vaults/accessPolicies#2019-09-01' = {
name: '${keyvaultApi.name}/add'
properties: {
accessPolicies: [
{
tenantId: subscription().tenantId
objectId: managedIdentityTwo.properties.principalId
permissions: {
// minimum required permissions
keys: [
'get'
'unwrapKey'
'wrapKey'
]
}
}
]
}
}
// Store the connectionstrings in KV if specified
resource clientApiKeys 'Microsoft.KeyVault/vaults/secrets#2019-09-01' = [ for name in tenantCodes :{
name: '${keyvaultApi.name}/${keyVaultKeyPrefixTw}${name}'
properties: {
value: '${deploymentIdOne}-${deploymentIdTwo}'
}
}]
and in my main template I added the module:
module clientKeyApi 'template2.bicep' = {
name: 'testfrgs'
scope: 'secondresourcegroup'
}
But there is something that is not clear 100% to me.
How does it work to override all the for loop and parameters name I have declared in my template2.bicep , and yet the module require a scope subscription, if I declare the scope, wouldn't this override the default value?
Sorry guys for the newbie questions, I am trying to break my mindset from terraform and understand better how bicep work.
Any explanation would be amazing and helpful
You can't specify scope on the resource, but you can specify it on a module. You'll need to turn the resource that adds the access policy to the keyvault into a separate module, then specify scope on the module. You can also make the scope for your deployment subscription, but then you'll need to break everything that targets a specific resource group into modules, as well.
This is due to how ARM deployments work. The default scope for an ARM deployment is at the resource group level. You can't point a resource at a different resource group because it's outside the scope of the deployment.
Modules, however, run as sub-deployments and therefore can have a different scope set.
This is a case where Terraform is more straightforward, since it calls the Azure APIs directly instead of using the ARM deployment model. Terraform doesn't care about deployment scopes because it doesn't use them.
hy
i have an openstack deployed on my laptop. i'm trying to create a stack with heat.
i have created a keypair openstack keypair create heat_key > heat_key.priv
which is recognized by nova nova keypair-list give the following output :
+----------+------+-------------------------------------------------+
| Name | Type | Fingerprint |
+----------+------+-------------------------------------------------+
| heat_key | ssh | 0b:7a:36:20:e2:e3:19:3b:ab:a1:95:ac:67:41:67:d7 |
+----------+------+-------------------------------------------------+
this is my simple HOT template :
heat_template_version: 2013-05-23
description: Hot Template to deploy a single server
parameters:
image_id:
type: string
description: Image ID
key_name:
type: string
description: name of keypair to enable ssh to the instance
resources:
test_stack:
type: OS::Nova::Server
properties:
name: "test_stack"
image: { get_param: image_id }
flavor: "ds1G"
key_name:{ get_param: key_name }
outputs:
test_stack_ip:
description: IP of the server
value: { get_attr: [ test_stack, first_address ] }
when i try to create the stack
openstack stack create -t myTemp.hot --parameter key_name=heat_key --parameter image_id=trusty-server-cloudimg-amd64-disk1 test_stack
i get the following error
ERROR: Property error: : resources.test_stack.properties: : Unknown Property key_name:{ get_param
i have tried with different versions of templates but i get the same error
any idea why this is happening?
WORST part about the YAML file is, it is SPACE sensitive, so we need to be really careful while editing or copying conetent of HEAT templete. There is no space between "key_name" and "{" which is why it is failing.
key_name:{ get_param: key_pair_name }
Just put an extra space between these and it will work. I tested it :-)
key_name: { get_param: key_pair_name }
I was able to do it by providing the details in parameters . PFB Sample script which worked for me.
heat_template_version: 2016-10-14
description: Admin VM - Test Heat
parameters:
image_name_1:
type: string
label: Centos-7.0
description: Centos Linux 7.0
default: Centos-7.0
network_id_E1:
type: string
label: 58e867ce-841c-48cf-8116-e72d998dbc89
description: Admin External Network
default: Admin
network_id_E1:
type: string
label: 4f69c8e5-8f52-4804-89e0-2c8232f9f3aa
description: Internal-1 Network
default: SR-IOV Interface
network_id_I2:
type: string
label: 28120cdb-7e8b-4e8b-821f-7c7d8df37c1d
description: Internal-2 Network
default: Internal-2
KeyName:
type: string
default: IO_Perf_Cnt
description: Name of an existing key pair to use for the instance
constraints:
- custom_constraint: nova.keypair
description: Must name a public key (pair) known to Nova
resources:
AdminVM1:
type: OS::Nova::Server
properties:
availability_zone: naz3
image: { get_param: image_name_1 }
flavor: 4vcpu_8192MBmem_40GBdisk
key_name: { get_param: KeyName }
networks:
- network: { get_param : network_id_E1 }
Try to change the parameter name key_name to some other name and execute it
heat_template_version: 2015-10-15
description: Hot Template to deploy a single server
parameters:
image_id:
type: string
description: Image ID
key_pair_name:
type: string
description: name of keypair to enable ssh to the instance
resources:
test_stack:
type: OS::Nova::Server
properties:
name: "test_stack"
image: { get_param: image_id }
flavor: "ds1G"
key_name: { get_param: key_pair_name }
outputs:
test_stack_ip:
description: IP of the server
value: { get_attr: [ test_stack, first_address ] }
Integrating cloudify with openstack nova-network, if nova-network dosn't support floating-ip, how to define the openstack-nova-net-manager-blueprint.yaml?
1.cloudify-manager-blueprints version: cloudify-manager-blueprints-3.2.1
https://github.com/cloudify-cosmo/cloudify-manager-blueprints/tree/3.2.1-build
2.the blueprint DSL like this:
enter image description here
how to solve this problem? thanks for your kindly help!
The floating IP is used to connect to the manager once it has been already bootstrapped.
In case you do not have a floating IP, you can bypass it with one of two options:
Create manually an IP connected to the external network and use it as an external resource, so you it would look like:
manager_server_ip:
type: string
default: 1.1.1.1
manager_server:
type: cloudify.openstack.nodes.Server
properties:
resource_id: { get_input: manager_server_name }
manager_server_ip: { get_input: manager_server_ip }
install_agent: false
server:
image: { get_input: image_id }
flavor: { get_input: flavor_id }
openstack_config: { get_property: [openstack_configuration, openstack_config] }
relationships:
- target: management_security_group
type: cloudify.openstack.server_connected_to_security_group
- target: management_keypair
type: cloudify.openstack.server_connected_to_keypair
Just create a regular IP on the some network that will let you connect the manager after bootstrap