Azure / Azure/Azure-Verified-Modules
[Documentation Update]: clarify the private endpoints specification for ip_configuration
- Dominant language
- PowerShell
- Stars
- 580
- Forks
- 161
- Avg merge
- 11h 3m
- Merged PRs (30d)
- 15
Description
### Check for previous/existing GitHub issues
- [x] I have checked for previous/existing GitHub issues
### Description
The `ip_configuration` interface specification for private endpoints has some inconsistency, the approach of hard-coding `default` or the sub-resource name causes a bug with Azure Container Registry deployments using static IPs (see further down).
Ask:
> I think the change needed is only to docs as ACR can be treated as a special case, and computed based on the existing interface, but ideally https://github.com/Azure/terraform-azurerm-avm-res-containerregistry-registry/issues/40 should be assessed as a measure for success.
Guidance in Keyvault suggests member_name should be set to `default` - that aligns with Bicep and is _usually_ correct.
```terraform
dynamic "ip_configuration" {
for_each = each.value.ip_configurations
content {
name = ip_configuration.value.name
private_ip_address = ip_configuration.value.private_ip_address
member_name = "default"
subresource_name = "vault"
}
}
```
In the docs:
https://azure.github.io/Azure-Verified-Modules/specs/tf/interfaces/#private-endpoints
- The example resource block further on needs correction.
- The `InputExample` slightly further down also needs correction as it is contradictory to the variables spec.
The values can be computed for the ACR use-case, which I think is preferable to the alternative of changing the spec of the variable definition (needing grept updates & a change to the interface).
## Summary of ACR issue
The value of `default` doesn't work in the container registry case:
```
contains static ipconfigurations: [PrivateIPAddress: 10.x.x.x, GroupId: registry, MemberName: registry]
and its missing these membernames/groupids requested by Private Link service
[GroupId: registry, MemberName: registry_data_].
Private Endpoint needs to be reconfigured with missing memberNames.
```
& has been raised there (on an issue that I think should be re-opened)
https://github.com/Azure/terraform-azurerm-avm-res-containerregistry-registry/issues/40
## Cross check with Bicep
Bicep does similar, setting it to default:
https://github.com/Azure/bicep-registry-modules/blob/fed892ae1734b93109ed686c3aa10aee7ff24b8d/avm/res/network/private-endpoint/tests/e2e/max/main.test.bicep#L99C13-L99C34
...except where private link service is being used, in which case it is blank:
https://github.com/Azure/bicep-registry-modules/blob/fed892ae1734b93109ed686c3aa10aee7ff24b8d/avm/res/network/private-endpoint/tests/e2e/private-link/main.test.bicep#L63
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.