fix: avm/res/web/static-site fixes for pdns & Identity Var
#4693
Conversation
avm-team-linter
bot
added
the
Needs: Core Team 🧞
microsoft-github-policy-service
bot
added
the
Needs: Triage 🔍
|
Important The "Needs: Triage 🔍" label must be removed once the triage process is complete! Tip For additional guidance on how to triage this issue/PR, see the BRM Issue Triage documentation. |
microsoft-github-policy-service
bot
added
the
Type: AVM 🅰️ ✌️ Ⓜ️
|
Important If this is a module-related PR, being submitted by the sole owner of the module, the AVM core team must review and approve it (as module owners can't approve their own PRs). To indicate this PR needs the core team''s attention, apply the "Needs: Core Team 🧞" label! The core team will only review and approve PRs that have this label applied! |
ChrisSidebotham
changed the title
avm/res/web/static-site Private DNS Zone Group Fix avm/res/web/static-site fixes for pdns & Identity Var
avm/res/web/static-site/main.bicep
Outdated
| @@ -301,7 +319,23 @@ module staticSite_privateEndpoints 'br/public:avm/res/network/private-endpoint:0 | |||
| 'Full' | |||
| ).location | |||
| lock: privateEndpoint.?lock ?? lock | |||
| privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup | |||
| // privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup | |||
There was a problem hiding this comment.
This looks like the change is still tested. Should the PR be in draft?
There was a problem hiding this comment.
No, I just hadn't removed this, my bad
| @@ -257,6 +267,14 @@ resource staticSite_roleAssignments 'Microsoft.Authorization/roleAssignments@202 | |||
| } | |||
| ] | |||
|
|
|||
| module staticSite_privateDnsZone 'br/public:avm/res/network/private-dns-zone:0.7.0' = if (!empty(privateEndpoints) && createPrivateDnsZone == 'Enabled') { | |||
There was a problem hiding this comment.
Considering the amount of properties one is able to configure in the module I wonder if we may need to introduce a parameterObject for them - like done e.g. for the nicConfigurations parameter in the VM module.
Just thinking out loud here. If you cannot configure it to you needs you're essentially required to idempotently redeploy the DNS Zone after the deployment with another deployment. Maybe that's ok and intended - but wanted to raise the thought :)
There was a problem hiding this comment.
So on this thought, for a VM the NIC is required, I guess here we do follow a smiliar pattern except the PDNS Zone is only needed for private endpoints to work. Typically the DNS Zone should sit with the rest of the DNS Zone and be configured with a vnet link.
In this current implemntation the app will still not be routable as the DNS Zone has not been linked to a Virtual Network, I need to update this so it accepts some properties. My view is this should be the bare minimal requirements to ensure PE connectivity is established and routable but any extensive configuration should be done in a dedicated module for the staticSite zone. il make an update to this today
There was a problem hiding this comment.
Additional param added for virtualNetworkResourceId
There was a problem hiding this comment.
I wonder if that's something we should chat about some time - just to ensure we're all on the same page. The next maintainer call would come to mind 💪
…NS Zone configuration
…teDnsZoneResourceId parameters to clarify requirements
| @@ -367,3 +401,83 @@ type privateEndpointOutputType = { | |||
| @description('The IDs of the network interfaces associated with the private endpoint.') | |||
| networkInterfaceResourceIds: string[] | |||
| } | |||
|
|
|||
| // @description('An AVM-aligned type for a private endpoint. To be used if the private endpoint\'s default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like \'vault\' for key vault).') | |||
| // type privateEndpointSingleServiceType = { | |||
Description
Closes #4345
Closes #4701
Configured DNS Record in test:
New DNS Zone:
Pipeline Reference
Type of Change
version.json:version.json.version.json.Checklist
Set-AVMModulelocally to generate the supporting module files.