Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[PSRule] Fix Rule Azure.VM.AMA #3938

Closed
wants to merge 11 commits into from
Closed

[PSRule] Fix Rule Azure.VM.AMA #3938

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
2c8efd0
update
fabmas Sep 5, 2023
d4e3fb1
removed userAssignedIdentity
fabmas Sep 5, 2023
9f46381
readme updated
fabmas Sep 5, 2023
c771fa1
upd
fabmas Sep 5, 2023
7652539
upd
fabmas Sep 6, 2023
de77775
restored changes to original code
fabmas Sep 6, 2023
5e317b5
upd
fabmas Sep 6, 2023
ebda62c
upd
fabmas Sep 7, 2023
9248d69
upd
fabmas Sep 7, 2023
b853854
upd with GCS_AUTO_CONFIG for linux vm
fabmas Sep 7, 2023
27bf431
upd
fabmas Sep 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .ps-rule/min-suppress.Rule.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ spec:
rule:
- Azure.Resource.UseTags
- Azure.KeyVault.Logs
- Azure.VM.AMA
- Azure.Policy.ExemptionDescriptors
- Azure.Policy.Descriptors
- Azure.Policy.AssignmentDescriptors
Expand Down
3 changes: 3 additions & 0 deletions modules/compute/virtual-machine/.test/linux.atmg/main.test.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,9 @@ module testDeployment '../../main.bicep' = {
osType: 'Linux'
vmSize: 'Standard_DS2_v2'
configurationProfile: '/providers/Microsoft.Automanage/bestPractices/AzureBestPracticesProduction'
extensionMonitoringAgentConfig: {
enabled: true
}
disablePasswordAuthentication: true
publicKeys: [
{
Expand Down
3 changes: 3 additions & 0 deletions modules/compute/virtual-machine/.test/windows.atmg/main.test.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,9 @@ module testDeployment '../../main.bicep' = {
vmSize: 'Standard_DS2_v2'
adminPassword: password
configurationProfile: '/providers/Microsoft.Automanage/bestPractices/AzureBestPracticesProduction'
extensionMonitoringAgentConfig: {
enabled: true
}
tags: {
'hidden-title': 'This is visible in the resource name'
Environment: 'Non-Prod'
Expand Down
3 changes: 3 additions & 0 deletions modules/compute/virtual-machine/.test/windows.ssecmk/main.test.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,9 @@ module testDeployment '../../main.bicep' = {
name: '${uniqueString(deployment().name, location)}-test-${serviceShort}'
params: {
enableDefaultTelemetry: enableDefaultTelemetry
extensionMonitoringAgentConfig: {
enabled: true
}
location: location
name: '${namePrefix}${serviceShort}'
adminUsername: 'VMAdministrator'
Expand Down
24 changes: 24 additions & 0 deletions modules/compute/virtual-machine/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1599,6 +1599,9 @@ module virtualMachine './compute/virtual-machine/main.bicep' = {
configurationProfile: '/providers/Microsoft.Automanage/bestPractices/AzureBestPracticesProduction'
disablePasswordAuthentication: true
enableDefaultTelemetry: '<enableDefaultTelemetry>'
extensionMonitoringAgentConfig: {
enabled: true
}
location: '<location>'
name: 'cvmlinatmg'
publicKeys: [
Expand Down Expand Up @@ -1690,6 +1693,11 @@ module virtualMachine './compute/virtual-machine/main.bicep' = {
"enableDefaultTelemetry": {
"value": "<enableDefaultTelemetry>"
},
"extensionMonitoringAgentConfig": {
"value": {
"enabled": true
}
},
"location": {
"value": "<location>"
},
Expand Down Expand Up @@ -2443,6 +2451,9 @@ module virtualMachine './compute/virtual-machine/main.bicep' = {
adminPassword: '<adminPassword>'
configurationProfile: '/providers/Microsoft.Automanage/bestPractices/AzureBestPracticesProduction'
enableDefaultTelemetry: '<enableDefaultTelemetry>'
extensionMonitoringAgentConfig: {
enabled: true
}
location: '<location>'
name: 'cvmwinatmg'
tags: {
Expand Down Expand Up @@ -2515,6 +2526,11 @@ module virtualMachine './compute/virtual-machine/main.bicep' = {
"enableDefaultTelemetry": {
"value": "<enableDefaultTelemetry>"
},
"extensionMonitoringAgentConfig": {
"value": {
"enabled": true
}
},
"location": {
"value": "<location>"
},
Expand Down Expand Up @@ -2706,6 +2722,9 @@ module virtualMachine './compute/virtual-machine/main.bicep' = {
}
]
enableDefaultTelemetry: '<enableDefaultTelemetry>'
extensionMonitoringAgentConfig: {
enabled: true
}
location: '<location>'
name: 'cvmwincmk'
tags: {
Expand Down Expand Up @@ -2791,6 +2810,11 @@ module virtualMachine './compute/virtual-machine/main.bicep' = {
"enableDefaultTelemetry": {
"value": "<enableDefaultTelemetry>"
},
"extensionMonitoringAgentConfig": {
"value": {
"enabled": true
}
},
"location": {
"value": "<location>"
},
Expand Down
17 changes: 10 additions & 7 deletions modules/compute/virtual-machine/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -567,19 +567,21 @@ resource vm_logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2021
scope: az.resourceGroup(split(monitoringWorkspaceId, '/')[2], split(monitoringWorkspaceId, '/')[4])
}

module vm_microsoftMonitoringAgentExtension 'extension/main.bicep' = if (extensionMonitoringAgentConfig.enabled) {
name: '${uniqueString(deployment().name, location)}-VM-MicrosoftMonitoringAgent'
module vm_azureMonitorAgentExtension 'extension/main.bicep' = if (extensionMonitoringAgentConfig.enabled) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As per similar discussion for VMSS (ref #3918 (comment)) we won't be including this change into release 0.11 to avoid an additional breaking change. We should discuss and decide on if keeping both AMA and MMA extensions or if discontinuing support for MMA

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as for the other, I believe this can and should be merged

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ping @eriqua :D By now already have quite some conflicts

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Plus I believe @rahalan is already working on the migration into AVM. So it's high time this is merged.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ping @eriqua

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looping in @rahalan, AVM VM and VMSS module owner, to finalize the decision on if keeping the legacy MMA support or just remove it as part of migration to AVM.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Has to be merged into AVM module as soon as its PR is merged

name: '${uniqueString(deployment().name, location)}-VM-AzureMonitorAgent'
params: {
virtualMachineName: vm.name
name: 'MicrosoftMonitoringAgent'
publisher: 'Microsoft.EnterpriseCloud.Monitoring'
type: osType == 'Windows' ? 'MicrosoftMonitoringAgent' : 'OmsAgentForLinux'
name: 'AzureMonitorAgent'
publisher: 'Microsoft.Azure.Monitor'
type: osType == 'Windows' ? 'AzureMonitorWindowsAgent' : 'AzureMonitorLinuxAgent'
typeHandlerVersion: contains(extensionMonitoringAgentConfig, 'typeHandlerVersion') ? extensionMonitoringAgentConfig.typeHandlerVersion : (osType == 'Windows' ? '1.0' : '1.7')
autoUpgradeMinorVersion: contains(extensionMonitoringAgentConfig, 'autoUpgradeMinorVersion') ? extensionMonitoringAgentConfig.autoUpgradeMinorVersion : true
enableAutomaticUpgrade: contains(extensionMonitoringAgentConfig, 'enableAutomaticUpgrade') ? extensionMonitoringAgentConfig.enableAutomaticUpgrade : false
settings: {
workspaceId: !empty(monitoringWorkspaceId) ? vm_logAnalyticsWorkspace.properties.customerId : ''
GCS_AUTO_CONFIG: osType == 'Linux' ? true : null
}

tags: contains(extensionMonitoringAgentConfig, 'tags') ? extensionMonitoringAgentConfig.tags : {}
protectedSettings: {
workspaceKey: !empty(monitoringWorkspaceId) ? vm_logAnalyticsWorkspace.listKeys().primarySharedKey : ''
Expand All @@ -588,6 +590,7 @@ module vm_microsoftMonitoringAgentExtension 'extension/main.bicep' = if (extensi
}
}


module vm_dependencyAgentExtension 'extension/main.bicep' = if (extensionDependencyAgentConfig.enabled) {
name: '${uniqueString(deployment().name, location)}-VM-DependencyAgent'
params: {
Expand Down Expand Up @@ -674,7 +677,7 @@ module vm_azureDiskEncryptionExtension 'extension/main.bicep' = if (extensionAzu
}
dependsOn: [
vm_customScriptExtension
vm_microsoftMonitoringAgentExtension
vm_azureMonitorAgentExtension
]
}

Expand All @@ -693,7 +696,7 @@ module vm_backup '../../recovery-services/vault/backup-fabric/protection-contain
dependsOn: [
vm_aadJoinExtension
vm_domainJoinExtension
vm_microsoftMonitoringAgentExtension
vm_azureMonitorAgentExtension
vm_microsoftAntiMalwareExtension
vm_networkWatcherAgentExtension
vm_dependencyAgentExtension
Expand Down