Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Updated PE scope to create the PE next to the primary resource by default #4449

Merged
merged 3 commits into from
Feb 18, 2025

Conversation

AlexanderSehr
Copy link
Contributor

@AlexanderSehr AlexanderSehr commented Feb 14, 2025

Description

Background: #3835 (comment)
Linked to: Azure/Azure-Verified-Modules#1857

Changes the deployment so that the main resource's (e.g., Key Vaults) RG is used as the default location for the PE. The already implemented resourceGroupResourceId will continue to allow the user to specify a different RG (in a different subscription, if needed).

The primary change is from

    scope: resourceGroup(
      split(privateEndpoint.?resourceGroupResourceId ?? privateEndpoint.?subnetResourceId, '/')[2],
      split(privateEndpoint.?resourceGroupResourceId ?? privateEndpoint.?subnetResourceId, '/')[4]
    )

to

    scope: resourceGroup(
      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[2],
      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[4]
    )

I'll quote from @ahmadabdalla on this matter

In most scenarios, PEs are deployed alongside their main resource in their own RG vs. the VNET RG. Customer app teams may have subnet join permissions on a centralised VNET in a Landing zone, but may not have permissions to deploy into it. Also considering billing and resource lifecycle perspective.

cc: @JamesDawson

Ref: #4449

Pipeline Reference

Pipeline

Type of Change

  • Update to CI Environment or utilities (Non-module affecting changes)
  • Azure Verified Module updates:
    • Bugfix containing backwards-compatible bug fixes, and I have NOT bumped the MAJOR or MINOR version in version.json:
      • Someone has opened a bug report issue, and I have included "Closes #{bug_report_issue_number}" in the PR description.
      • The bug was found by the module author, and no one has opened an issue to report it yet.
    • Feature update backwards compatible feature updates, and I have bumped the MINOR version in version.json.
    • Breaking changes and I have bumped the MAJOR version in version.json.
    • Update to documentation

@AlexanderSehr AlexanderSehr self-assigned this Feb 14, 2025
@microsoft-github-policy-service microsoft-github-policy-service bot added the Needs: Triage 🔍 Maintainers need to triage still label Feb 14, 2025

Important

The "Needs: Triage 🔍" label must be removed once the triage process is complete!

Tip

For additional guidance on how to triage this issue/PR, see the BRM Issue Triage documentation.

Important

If this is a module-related PR, being submitted by the sole owner of the module, the AVM core team must review and approve it (as module owners can't approve their own PRs).

To indicate this PR needs the core team''s attention, apply the "Needs: Core Team 🧞" label!

The core team will only review and approve PRs that have this label applied!

ReneHezser
ReneHezser previously approved these changes Feb 18, 2025
Copy link
Contributor

@ReneHezser ReneHezser left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Contributor

@ReneHezser ReneHezser left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@AlexanderSehr AlexanderSehr marked this pull request as ready for review February 18, 2025 19:48
@AlexanderSehr AlexanderSehr requested review from a team as code owners February 18, 2025 19:48
@AlexanderSehr AlexanderSehr merged commit edcc22c into main Feb 18, 2025
5 checks passed
@AlexanderSehr AlexanderSehr deleted the users/alsehr/peRG branch February 18, 2025 19:48
@avm-team-linter avm-team-linter bot added the Needs: Core Team 🧞 This item needs the AVM Core Team to review it label Feb 18, 2025
anderseide pushed a commit to anderseide/avm-bicep-registry-modules that referenced this pull request Feb 19, 2025
…by default (Azure#4449)

## Description

Background:
Azure#3835 (comment)
Linked to: Azure/Azure-Verified-Modules#1857

Changes the deployment so that the main resource's (e.g., Key Vaults) RG
is used as the default location for the PE. The already implemented
`resourceGroupResourceId` will continue to allow the user to specify a
different RG (in a different subscription, if needed).

The primary change is from
```bicep
    scope: resourceGroup(
      split(privateEndpoint.?resourceGroupResourceId ?? privateEndpoint.?subnetResourceId, '/')[2],
      split(privateEndpoint.?resourceGroupResourceId ?? privateEndpoint.?subnetResourceId, '/')[4]
    )
```
to
```bicep
    scope: resourceGroup(
      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[2],
      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[4]
    )
```

I'll quote from @ahmadabdalla on this matter
> In most scenarios, PEs are deployed alongside their main resource in
their own RG vs. the VNET RG. Customer app teams may have subnet join
permissions on a centralised VNET in a Landing zone, but may not have
permissions to deploy into it. Also considering billing and resource
lifecycle perspective.

cc: @JamesDawson

Ref: Azure#4449

## Pipeline Reference

<!-- Insert your Pipeline Status Badge below -->

| Pipeline |
| -------- |
|          |

## Type of Change

<!-- Use the checkboxes [x] on the options that are relevant. -->

- [ ] Update to CI Environment or utilities (Non-module affecting
changes)
- [ ] Azure Verified Module updates:
- [ ] Bugfix containing backwards-compatible bug fixes, and I have NOT
bumped the MAJOR or MINOR version in `version.json`:
- [ ] Someone has opened a bug report issue, and I have included "Closes
#{bug_report_issue_number}" in the PR description.
- [ ] The bug was found by the module author, and no one has opened an
issue to report it yet.
- [ ] Feature update backwards compatible feature updates, and I have
bumped the MINOR version in `version.json`.
- [x] Breaking changes and I have bumped the MAJOR version in
`version.json`.
  - [ ] Update to documentation
@AlexanderSehr AlexanderSehr linked an issue Feb 21, 2025 that may be closed by this pull request
1 task
anderseide pushed a commit to anderseide/avm-bicep-registry-modules that referenced this pull request Feb 23, 2025
…by default (Azure#4449)

## Description

Background:
Azure#3835 (comment)
Linked to: Azure/Azure-Verified-Modules#1857

Changes the deployment so that the main resource's (e.g., Key Vaults) RG
is used as the default location for the PE. The already implemented
`resourceGroupResourceId` will continue to allow the user to specify a
different RG (in a different subscription, if needed).

The primary change is from
```bicep
    scope: resourceGroup(
      split(privateEndpoint.?resourceGroupResourceId ?? privateEndpoint.?subnetResourceId, '/')[2],
      split(privateEndpoint.?resourceGroupResourceId ?? privateEndpoint.?subnetResourceId, '/')[4]
    )
```
to
```bicep
    scope: resourceGroup(
      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[2],
      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[4]
    )
```

I'll quote from @ahmadabdalla on this matter
> In most scenarios, PEs are deployed alongside their main resource in
their own RG vs. the VNET RG. Customer app teams may have subnet join
permissions on a centralised VNET in a Landing zone, but may not have
permissions to deploy into it. Also considering billing and resource
lifecycle perspective.

cc: @JamesDawson

Ref: Azure#4449

## Pipeline Reference

<!-- Insert your Pipeline Status Badge below -->

| Pipeline |
| -------- |
|          |

## Type of Change

<!-- Use the checkboxes [x] on the options that are relevant. -->

- [ ] Update to CI Environment or utilities (Non-module affecting
changes)
- [ ] Azure Verified Module updates:
- [ ] Bugfix containing backwards-compatible bug fixes, and I have NOT
bumped the MAJOR or MINOR version in `version.json`:
- [ ] Someone has opened a bug report issue, and I have included "Closes
#{bug_report_issue_number}" in the PR description.
- [ ] The bug was found by the module author, and no one has opened an
issue to report it yet.
- [ ] Feature update backwards compatible feature updates, and I have
bumped the MINOR version in `version.json`.
- [x] Breaking changes and I have bumped the MAJOR version in
`version.json`.
  - [ ] Update to documentation
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Needs: Core Team 🧞 This item needs the AVM Core Team to review it Needs: Triage 🔍 Maintainers need to triage still
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[AVM Module Issue]: avm/res/web/site with slots returns invalid output
2 participants