Azure / Azure/arm-template-whatif

what-if doesn't reliably find issues in templates

Open
#307 0 comments 0 reactions 0 assignees View on GitHub
Needs Triage :mag:
Dominant language
HTML
Stars
101
Forks
21
Avg merge
3h 35m
Merged PRs (30d)
1

Description

**Describe the bug**

@satyavel asked if I could raise this after I ranted on Twitter.

https://twitter.com/satya_vel/status/1641508989233147905

I fear I'm not going to do a tremendous job of sharing details, but I'll try. Let me tell you a story. I decided to add a Cosmos DB to my blog to experiment.

**To Reproduce**
Repeat what I've done in my PRs

**Expected behavior**

I run what-if on my blog for PRs to detect infra changes: https://github.com/johnnyreilly/blog.johnnyreilly.com/blob/3c4838eebae2f81bb30a99443aa794d12a42a08f/.github/workflows/build-and-deploy-static-web-app.yml#L61

I'd expect for invalid templates to fail the build, thus preventing me from merging broken templates. If you look at these PRs:

https://github.com/johnnyreilly/blog.johnnyreilly.com/pull/490
https://github.com/johnnyreilly/blog.johnnyreilly.com/pull/496
https://github.com/johnnyreilly/blog.johnnyreilly.com/pull/497

There were no issues raised by what-if. I merged the PRs, things broke (and are still broken BTW)

Here's an example pipeline run: https://github.com/johnnyreilly/blog.johnnyreilly.com/actions/runs/4555716391/jobs/8035142644

**Screenshots**

Examples of errors in the portal:

```
Unable to process template language expressions for resource '/subscriptions/26178455-cfd9-4d36-bab5-35896b6d2dd1/resourceGroups/rg-blog-johnnyreilly-com/providers/Microsoft.Resources/deployments/eng-contributor-00000000-0000-0000-0000-000000000002-fdc0f550-79f0-4c06-9ad9-be0f13ce344b' at line '1' and column '1367'. 'The language expression property 'userId' doesn't exist, available properties are 'name, principalId, roleDefinitionId'.'
```

![image](https://user-images.githubusercontent.com/1010525/228936521-61e6b923-2d3b-4245-aca2-f07b807da870.png)

```
The provided deployment name 'eng-contributor-00000000-0000-0000-0000-000000000002-fdc0f550-79f0-4c06-9ad9-be0f13ce344b' has a length of '89' which exceeds the maximum length of '64'. Please see https://aka.ms/arm-deploy for usage details. (Code: InvalidDeployment)
```
![image](https://user-images.githubusercontent.com/1010525/228936896-93298ef9-f73b-470d-8548-c2155be2c40e.png)

**Client** [e.g. PowerShell, CLI, API)
See https://github.com/johnnyreilly/blog.johnnyreilly.com/blob/3c4838eebae2f81bb30a99443aa794d12a42a08f/.github/workflows/build-and-deploy-static-web-app.yml#L61

**Additional context**
Add any other context about the problem here.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the what-if invocation at line 61 of the linked build-and-deploy workflow, then compare its behavior with the linked pull requests and pipeline run. Reproduce the reported template errors and determine why they are not reported. Done means invalid templates reliably fail the build with actionable what-if issues.

Written by the indexing model from the issue text.

Assessment

Domain
ci-cd, cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.