Align RBAC on Microsoft.Compute #367

MariusStorhaug · 2021-11-03T17:43:51Z

Change

- Removal failing, cannot find tags

Moved builtInRoleNames variable to .bicep/nested_rbac.json
Using declaration of existing resource + scope reference in roleAssignment resource declaration
Updated Readme

Type of Change

Please delete options that are not relevant.

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update (Wiki)

Checklist

I'm sure there are no other open Pull Requests for the same update/change
My corresponding pipelines / checks run clean and green without any errors or warnings
My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation (readme)
I did format my code

github-actions · 2021-11-03T17:48:13Z

Unit Test Results

  1 files ±0 1 suites ±0 15s ⏱️ +2s
  8 tests +4 8 ✔️ +4   0 💤 ±0 0 ❌ ±0
39 runs +4 8 ✔️ +4 31 💤 ±0 0 ❌ ±0

Results for commit 3d15aa3. ± Comparison against base commit c69e175.

This pull request removes 4 and adds 8 tests. Note that renamed tests count towards both.

/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.DesktopVirtualization/hostpools] used resource type [diagnosticsettings] should use on of the recent API version(s). Currently using [2017-05-01-preview]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.DesktopVirtualization/hostpools] used resource type [hostPools] should use on of the recent API version(s). Currently using [2021-07-12]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.DesktopVirtualization/hostpools] used resource type [locks] should use on of the recent API version(s). Currently using [2016-09-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.DesktopVirtualization/hostpools] used resource type [roleassignments] should use on of the recent API version(s). Currently using [2021-04-01-preview]

/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.Compute/virtualMachines] used resource type [diagnosticsettings] should use on of the recent API version(s). Currently using [2021-05-01-preview]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.Compute/virtualMachines] used resource type [locks] should use on of the recent API version(s). Currently using [2017-04-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.Compute/virtualMachines] used resource type [networkInterfaces] should use on of the recent API version(s). Currently using [2021-02-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.Compute/virtualMachines] used resource type [publicIPAddresses] should use on of the recent API version(s). Currently using [2021-02-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.Compute/virtualMachines] used resource type [roleassignments] should use on of the recent API version(s). Currently using [2020-04-01-preview]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.Compute/virtualMachines] used resource type [vaults/backupFabrics/protectionContainers/protectedItems] should use on of the recent API version(s). Currently using [2021-06-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.Compute/virtualMachines] used resource type [virtualMachines/extensions] should use on of the recent API version(s). Currently using [2021-04-01]
/home/runner/work/ResourceModules/ResourceModules/arm/.global/global.module.tests.ps1 ‑ Api version tests [All apiVersions in the template should be &#x27;recent&#x27;].In [Microsoft.Compute/virtualMachines] used resource type [virtualMachines] should use on of the recent API version(s). Currently using [2021-04-01]

♻️ This comment has been updated with latest results.

MariusStorhaug · 2021-11-03T19:41:41Z

@eriqua - Could you help clarify why the Images are failing? Its referring to an old storage account and probably looking for a VHD in that SA. Do we have a new one?

eriqua · 2021-11-04T00:34:59Z

@eriqua - Could you help clarify why the Images are failing? Its referring to an old storage account and probably looking for a VHD in that SA. Do we have a new one?

@MariusStorhaug For image dependencies I think what we did in the past was the following:

Deploy an image through the Microsoft.VirtualMachineImages\imageTemplates module
Wait for the image to be created
Reuse it in the Microsoft.Compute\images module as a reference.

The challenge I see is that the storage account + the image name seem to be not deterministic in their names. I guess the imageTemplate is not idempotent either. So rerunning its pipeline would just create a different image name. For this reason it does not make much sense to add it to the dependency pipeline. This case would probably be challenging even with the new testing approach, as we won't be able to predict the vhd reference. As a quick win I started the deployment of a new image which should eventually be available in https://r0jskwdzcal7ss9okmxiyua3.blob.core.windows.net/vhds/48f94fc5-604e-4db2-bca4-e5a09e05b212.vhd. I'd say let's try if that solves for now but also let's have a brainstorm with the group to see if a more structured solution can be targeted going forward.

MariusStorhaug · 2021-11-04T08:35:19Z

@eriqua or @MrMCake : Do you know what pipeline to run to get the dependencies for VM up and running. Yesterday it was refering to a management-rg, looking for a Recovery Services Vault. I could not find one in the new env. Any suggestions?

eriqua · 2021-11-04T09:32:19Z

@eriqua or @MrMCake : Do you know what pipeline to run to get the dependencies for VM up and running. Yesterday it was refering to a management-rg, looking for a Recovery Services Vault. I could not find one in the new env. Any suggestions?

We have only 1 dependency pipeline, but the RSV is missing for the VM backup to work. I'll let you know once I'll be able to add it

UPDATE: @MariusStorhaug RSV has been added to the dependency workflow and already in place in the validation-rg. Name: adp-sxx-az-rsv-x-001

arm/Microsoft.Compute/virtualMachines/.parameters/parameters.json

eriqua

🆗

Marius added 9 commits November 3, 2021 17:40

availabilitySets

55d1ed1

diskEncryptionSets

c50aec5

galleries

daaa29c

cleanup

570f5b4

galleryImage

26bb65c

images

57aae99

proximityPlacementGroups

4b14f1f

virtualMachines

a555f66

vmss

78f02a6

MariusStorhaug linked an issue Nov 3, 2021 that may be closed by this pull request

Move builtInRoleNames variable into rbac module #202

Closed

MariusStorhaug requested a review from eriqua November 3, 2021 19:32

Test with validation-rg

87a3ac0

Testing with new vhd reference

bc42914

MariusStorhaug self-assigned this Nov 4, 2021

eriqua reviewed Nov 4, 2021

View reviewed changes

arm/Microsoft.Compute/virtualMachines/.parameters/parameters.json Outdated Show resolved Hide resolved

Adjusting VM dependencies

cead957

eriqua reviewed Nov 4, 2021

View reviewed changes

arm/Microsoft.Compute/virtualMachines/.parameters/parameters.json Show resolved Hide resolved

New KeyEncryptionKeyURL

3d15aa3

MariusStorhaug enabled auto-merge (squash) November 4, 2021 20:56

MariusStorhaug requested a review from eriqua November 4, 2021 20:56

eriqua approved these changes Nov 5, 2021

View reviewed changes

MariusStorhaug merged commit 2c233ee into main Nov 5, 2021

AlexanderSehr deleted the users/mast/MS.Compute_RBAC branch November 5, 2021 15:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Align RBAC on Microsoft.Compute #367

Align RBAC on Microsoft.Compute #367

MariusStorhaug commented Nov 3, 2021 •

edited

Loading

github-actions bot commented Nov 3, 2021 •

edited

Loading

MariusStorhaug commented Nov 3, 2021

eriqua commented Nov 4, 2021

MariusStorhaug commented Nov 4, 2021

eriqua commented Nov 4, 2021 •

edited

Loading

eriqua left a comment

Align RBAC on Microsoft.Compute #367

Align RBAC on Microsoft.Compute #367

Conversation

MariusStorhaug commented Nov 3, 2021 • edited Loading

Change

Type of Change

Checklist

github-actions bot commented Nov 3, 2021 • edited Loading

Unit Test Results

MariusStorhaug commented Nov 3, 2021

eriqua commented Nov 4, 2021

MariusStorhaug commented Nov 4, 2021

eriqua commented Nov 4, 2021 • edited Loading

eriqua left a comment

Choose a reason for hiding this comment

MariusStorhaug commented Nov 3, 2021 •

edited

Loading

github-actions bot commented Nov 3, 2021 •

edited

Loading

eriqua commented Nov 4, 2021 •

edited

Loading