Azure / Azure/Azure-Verified-Modules

[Documentation Update]: clarify the private endpoints specification for ip_configuration

Open
#1,907 4 comments 0 reactions 1 assignee Claimed by @matt-FFFFFF View on GitHub
Language: Terraform :globe_with_meridians: Needs: Author Feedback :ear: Status: In Triage :mag: Status: No Recent Activity :zzz: Type: Documentation :page_facing_up:
Dominant language
PowerShell
Stars
580
Forks
161
Avg merge
11h 3m
Merged PRs (30d)
15

Description

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Description

The `ip_configuration` interface specification for private endpoints has some inconsistency, the approach of hard-coding `default` or the sub-resource name causes a bug with Azure Container Registry deployments using static IPs (see further down).

Ask:
> I think the change needed is only to docs as ACR can be treated as a special case, and computed based on the existing interface, but ideally https://github.com/Azure/terraform-azurerm-avm-res-containerregistry-registry/issues/40 should be assessed as a measure for success.

Guidance in Keyvault suggests member_name should be set to `default` - that aligns with Bicep and is _usually_ correct.

```terraform
dynamic "ip_configuration" {
for_each = each.value.ip_configurations

content {
name = ip_configuration.value.name
private_ip_address = ip_configuration.value.private_ip_address
member_name = "default"
subresource_name = "vault"
}
}
```

In the docs:
https://azure.github.io/Azure-Verified-Modules/specs/tf/interfaces/#private-endpoints

- The example resource block further on needs correction.
- The `InputExample` slightly further down also needs correction as it is contradictory to the variables spec.

The values can be computed for the ACR use-case, which I think is preferable to the alternative of changing the spec of the variable definition (needing grept updates & a change to the interface).

## Summary of ACR issue

The value of `default` doesn't work in the container registry case:

```
contains static ipconfigurations: [PrivateIPAddress: 10.x.x.x, GroupId: registry, MemberName: registry]
and its missing these membernames/groupids requested by Private Link service
[GroupId: registry, MemberName: registry_data_].
Private Endpoint needs to be reconfigured with missing memberNames.
```

& has been raised there (on an issue that I think should be re-opened)

https://github.com/Azure/terraform-azurerm-avm-res-containerregistry-registry/issues/40

## Cross check with Bicep

Bicep does similar, setting it to default:

https://github.com/Azure/bicep-registry-modules/blob/fed892ae1734b93109ed686c3aa10aee7ff24b8d/avm/res/network/private-endpoint/tests/e2e/max/main.test.bicep#L99C13-L99C34

...except where private link service is being used, in which case it is blank:

https://github.com/Azure/bicep-registry-modules/blob/fed892ae1734b93109ed686c3aa10aee7ff24b8d/avm/res/network/private-endpoint/tests/e2e/private-link/main.test.bicep#L63

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.