Skip to content

Commit c282211

Browse files
jtracey93jtracey93
authored
fix: Private DNS Zones Bug (Azure#695) (Azure#891)
* accelerator files * updates to v0.2.0 of ptn * docs update * add output for names * fmt * bump to pdns 0.2.1 * hub MR changes * add rel notes draft * remove pdns module * doc updates * update params * fix psrule * readme updates * remove
1 parent d1edb92 commit c282211

34 files changed

+1042
-3167
lines changed

‎accelerator/.config/ALZ-Powershell-Auto.config.json

-80
Original file line numberDiff line numberDiff line change
@@ -603,16 +603,6 @@
603603
}
604604
]
605605
},
606-
"AK8sPrivateLink": {
607-
"source": "calculated",
608-
"pattern": "privatelink.{%Location%}.azmk8s.io",
609-
"targets": [
610-
{
611-
"Name": "parPrivateDnsZones.value[0]",
612-
"Destination": "Parameters"
613-
}
614-
]
615-
},
616606
"parAzBastionName": {
617607
"source": "calculated",
618608
"pattern": "alz-bastion-{%Location%}",
@@ -693,76 +683,6 @@
693683
}
694684
]
695685
},
696-
"AK8sPrivateLinkSecondary": {
697-
"source": "calculated",
698-
"pattern": "privatelink.{%SecondaryLocation%}.azmk8s.io",
699-
"targets": [
700-
{
701-
"Name": "parPrivateDnsZonesSecondaryLocation.value[0]",
702-
"Destination": "Parameters"
703-
}
704-
]
705-
},
706-
"BatchPrivateLink": {
707-
"source": "calculated",
708-
"pattern": "privatelink.{%Location%}.batch.azure.com",
709-
"targets": [
710-
{
711-
"Name": "parPrivateDnsZones.value[1]",
712-
"Destination": "Parameters"
713-
}
714-
]
715-
},
716-
"BatchPrivateLinkSecondary": {
717-
"source": "calculated",
718-
"pattern": "privatelink.{%SecondaryLocation%}.batch.azure.com",
719-
"targets": [
720-
{
721-
"Name": "parPrivateDnsZonesSecondaryLocation.value[1]",
722-
"Destination": "Parameters"
723-
}
724-
]
725-
},
726-
"KustoPrivateLink": {
727-
"source": "calculated",
728-
"pattern": "privatelink.{%Location%}.kusto.windows.net",
729-
"targets": [
730-
{
731-
"Name": "parPrivateDnsZones.value[2]",
732-
"Destination": "Parameters"
733-
}
734-
]
735-
},
736-
"KustoPrivateLinkSecondary": {
737-
"source": "calculated",
738-
"pattern": "privatelink.{%SecondaryLocation%}.kusto.windows.net",
739-
"targets": [
740-
{
741-
"Name": "parPrivateDnsZonesSecondaryLocation.value[2]",
742-
"Destination": "Parameters"
743-
}
744-
]
745-
},
746-
"BackupPrivateLink": {
747-
"source": "calculated",
748-
"pattern": "privatelink.{%Location%}.backup.windowsazure.com",
749-
"targets": [
750-
{
751-
"Name": "parPrivateDnsZones.value[3]",
752-
"Destination": "Parameters"
753-
}
754-
]
755-
},
756-
"BackupPrivateLinkSecondary": {
757-
"source": "calculated",
758-
"pattern": "privatelink.{%SecondaryLocation%}.backup.windowsazure.com",
759-
"targets": [
760-
{
761-
"Name": "parPrivateDnsZonesSecondaryLocation.value[3]",
762-
"Destination": "Parameters"
763-
}
764-
]
765-
},
766686
"ConnectivityResourceGroupName": {
767687
"source": "calculated",
768688
"pattern": "rg-{%Prefix%}-connectivity",

‎accelerator/.config/ALZ-Powershell.config.json

-40
Original file line numberDiff line numberDiff line change
@@ -603,46 +603,6 @@
603603
}
604604
]
605605
},
606-
"AK8sPrivateLink": {
607-
"Type": "Computed",
608-
"Value": "privatelink.{%Location%}.azmk8s.io",
609-
"Targets": [
610-
{
611-
"Name": "parPrivateDnsZones.value.[0]",
612-
"Destination": "Parameters"
613-
}
614-
]
615-
},
616-
"BatchPrivateLink": {
617-
"Type": "Computed",
618-
"Value": "privatelink.{%Location%}.batch.azure.com",
619-
"Targets": [
620-
{
621-
"Name": "parPrivateDnsZones.value.[1]",
622-
"Destination": "Parameters"
623-
}
624-
]
625-
},
626-
"KustoPrivateLink": {
627-
"Type": "Computed",
628-
"Value": "privatelink.{%Location%}.kusto.windows.net",
629-
"Targets": [
630-
{
631-
"Name": "parPrivateDnsZones.value.[2]",
632-
"Destination": "Parameters"
633-
}
634-
]
635-
},
636-
"BackupPrivateLink": {
637-
"Type": "Computed",
638-
"Value": "privatelink.{%Location%}.backup.windowsazure.com",
639-
"Targets": [
640-
{
641-
"Name": "parPrivateDnsZones.value.[3]",
642-
"Destination": "Parameters"
643-
}
644-
]
645-
},
646606
"UpstreamReleaseVersion": {
647607
"Type": "Computed",
648608
"Value": "{REPLACED_BY_ALZ_POWERSHELL_MODULE}",

‎docs/wiki/CustomerUsage.md

-1
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@ The following are the unique ID's (also known as PIDs) used in each of the modul
4848
| virtualNetworkPeer | ab8e3b12-b0fa-40aa-8630-e3f7699e2142 |
4949
| vwanConnectivity | 7f94f23b-7a59-4a5c-9a8d-2a253a566f61 |
5050
| vnetPeeringVwan | 7b5e6db2-1e8c-4b01-8eee-e1830073a63d |
51-
| privateDnsZones | 981733dd-3195-4fda-a4ee-605ab959edb6 |
5251
| hubSpoke - Orchestration | 50ad3b1a-f72c-4de4-8293-8a6399991beb |
5352
| hubPeeredSpoke - Orchestration | 8ea6f19a-d698-4c00-9afb-5c92d4766fd2 |
5453
| SubPlacementAll - Orchestration | bb800623-86ff-4ab4-8901-93c2b70967ae |

‎infra-as-code/bicep/modules/hubNetworking/README.md

-14
Original file line numberDiff line numberDiff line change
@@ -22,20 +22,6 @@ Module deploys the following resources:
2222
> - Although there are generated parameter markdowns for Azure Commercial Cloud, this same module can still be used in Azure China. Example parameter are in the [parameters](./parameters/) folder.
2323
>
2424
> - The file `parameters/hubNetworking.parameters.az.all.json` contains parameter values for SKUs that are compatible with availability zones for relevant resource types. In cases where you are deploying to a region that does not support availability zones, you should opt for the `parameters/hubNetworking.parameters.all.json` file.
25-
>
26-
> - When deploying using the `parameters/hubNetworking.parameters.all.json` you must update the `parPrivateDnsZones` parameter by replacing the `xxxxxx` placeholders with the deployment region or geo code, for Azure Backup. Failure to do so will cause these services to be unreachable over private endpoints.
27-
>
28-
> For example, if deploying to East US the following zone entries:
29-
> - `privatelink.xxxxxx.azmk8s.io`
30-
> - `privatelink.xxxxxx.backup.windowsazure.com`
31-
> - `privatelink.xxxxxx.batch.azure.com`
32-
>
33-
> Will become:
34-
> - `privatelink.eastus.azmk8s.io`
35-
> - `privatelink.eus.backup.windowsazure.com`
36-
> - `privatelink.eastus.batch.azure.com`
37-
>
38-
> See child module, [`privateDnsZones.bicep` docs](https://github.com/Azure/ALZ-Bicep/tree/main/infra-as-code/bicep/modules/privateDnsZones#dns-zones) for more info on how this works
3925
4026
To configure P2S VPN connections edit the vpnClientConfiguration value in the `parVpnGatewayConfig` parameter.
4127

‎infra-as-code/bicep/modules/hubNetworking/generateddocs/hubNetworking-multiRegion.bicep.md

+11-84
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,9 @@ parDisableBgpRoutePropagationSecondaryLocation | No | Switch to enable/dis
7676
parHubRouteTableLock | No | Resource Lock Configuration for Hub Route Table. - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock.
7777
parPrivateDnsZonesEnabled | No | Switch to enable/disable Private DNS Zones deployment.
7878
parPrivateDnsZonesResourceGroup | No | Resource Group Name for Private DNS Zones.
79-
parPrivateDnsZones | No | Array of DNS Zones to provision in Hub Virtual Network. Default: All known Azure Private DNS Zones
80-
parPrivateDnsZoneAutoMergeAzureBackupZone | No | Set Parameter to false to skip the addition of a Private DNS Zone for Azure Backup.
79+
parPrivateDnsZones | No | Array of DNS Zones to provision and link to Hub Virtual Networks. Default: All known Azure Private DNS Zones, baked into underlying AVM module see: https://github.com/Azure/bicep-registry-modules/tree/main/avm/ptn/network/private-link-private-dns-zones#parameter-privatelinkprivatednszones
8180
parVirtualNetworkIdToLinkFailover | No | Resource ID of Failover VNet for Private DNS Zone VNet Failover Links
81+
parVirtualNetworkResourceIdsToLinkTo | No | Array of Resource IDs of VNets to link to Private DNS Zones. Hub VNets are automatically included by module.
8282
parPrivateDNSZonesLock | No | Resource Lock Configuration for Private DNS Zone(s). - `kind` - The lock settings of the service which can be CanNotDelete, ReadOnly, or None. - `notes` - Notes about this lock.
8383
parVpnGatewayEnabled | No | Switch to enable/disable VPN virtual network gateway deployment.
8484
parVpnGatewayEnabledSecondaryLocation | No | Switch to enable/disable VPN virtual network gateway deployment in secondary location.
@@ -686,23 +686,19 @@ Resource Group Name for Private DNS Zones.
686686

687687
![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square)
688688

689-
Array of DNS Zones to provision in Hub Virtual Network. Default: All known Azure Private DNS Zones
689+
Array of DNS Zones to provision and link to Hub Virtual Networks. Default: All known Azure Private DNS Zones, baked into underlying AVM module see: https://github.com/Azure/bicep-registry-modules/tree/main/avm/ptn/network/private-link-private-dns-zones#parameter-privatelinkprivatednszones
690690

691-
- Default value: `[format('privatelink.{0}.azmk8s.io', toLower(parameters('parLocation')))] [format('privatelink.{0}.batch.azure.com', toLower(parameters('parLocation')))] [format('privatelink.{0}.kusto.windows.net', toLower(parameters('parLocation')))] [format('privatelink.{0}.backup.windowsazure.com', toLower(parameters('parLocation')))] privatelink.adf.azure.com privatelink.afs.azure.net privatelink.agentsvc.azure-automation.net privatelink.analysis.windows.net privatelink.api.azureml.ms privatelink.azconfig.io privatelink.azure-api.net privatelink.azure-automation.net privatelink.azurecr.io privatelink.azure-devices.net privatelink.azure-devices-provisioning.net privatelink.azuredatabricks.net privatelink.azurehdinsight.net privatelink.azurehealthcareapis.com privatelink.azurestaticapps.net privatelink.azuresynapse.net privatelink.azurewebsites.net privatelink.batch.azure.com privatelink.blob.core.windows.net privatelink.cassandra.cosmos.azure.com privatelink.cognitiveservices.azure.com privatelink.database.windows.net privatelink.datafactory.azure.net privatelink.dev.azuresynapse.net privatelink.dfs.core.windows.net privatelink.dicom.azurehealthcareapis.com privatelink.digitaltwins.azure.net privatelink.directline.botframework.com privatelink.documents.azure.com privatelink.eventgrid.azure.net privatelink.file.core.windows.net privatelink.gremlin.cosmos.azure.com privatelink.guestconfiguration.azure.com privatelink.his.arc.azure.com privatelink.dp.kubernetesconfiguration.azure.com privatelink.managedhsm.azure.net privatelink.mariadb.database.azure.com privatelink.media.azure.net privatelink.mongo.cosmos.azure.com privatelink.monitor.azure.com privatelink.mysql.database.azure.com privatelink.notebooks.azure.net privatelink.ods.opinsights.azure.com privatelink.oms.opinsights.azure.com privatelink.pbidedicated.windows.net privatelink.postgres.database.azure.com privatelink.prod.migration.windowsazure.com privatelink.purview.azure.com privatelink.purviewstudio.azure.com privatelink.queue.core.windows.net privatelink.redis.cache.windows.net privatelink.redisenterprise.cache.azure.net privatelink.search.windows.net privatelink.service.signalr.net privatelink.servicebus.windows.net privatelink.siterecovery.windowsazure.com privatelink.sql.azuresynapse.net privatelink.table.core.windows.net privatelink.table.cosmos.azure.com privatelink.tip1.powerquery.microsoft.com privatelink.token.botframework.com privatelink.vaultcore.azure.net privatelink.web.core.windows.net privatelink.webpubsub.azure.com`
692-
693-
### parPrivateDnsZoneAutoMergeAzureBackupZone
691+
### parVirtualNetworkIdToLinkFailover
694692

695693
![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square)
696694

697-
Set Parameter to false to skip the addition of a Private DNS Zone for Azure Backup.
698-
699-
- Default value: `True`
695+
Resource ID of Failover VNet for Private DNS Zone VNet Failover Links
700696

701-
### parVirtualNetworkIdToLinkFailover
697+
### parVirtualNetworkResourceIdsToLinkTo
702698

703699
![Parameter Setting](https://img.shields.io/badge/parameter-optional-green?style=flat-square)
704700

705-
Resource ID of Failover VNet for Private DNS Zone VNet Failover Links
701+
Array of Resource IDs of VNets to link to Private DNS Zones. Hub VNets are automatically included by module.
706702

707703
### parPrivateDNSZonesLock
708704

@@ -1140,83 +1136,14 @@ outBastionNsgNameSecondaryLocation | string |
11401136
"value": "[resourceGroup().name]"
11411137
},
11421138
"parPrivateDnsZones": {
1143-
"value": [
1144-
"[format('privatelink.{0}.azmk8s.io', toLower(parameters('parLocation')))]",
1145-
"[format('privatelink.{0}.batch.azure.com', toLower(parameters('parLocation')))]",
1146-
"[format('privatelink.{0}.kusto.windows.net', toLower(parameters('parLocation')))]",
1147-
"[format('privatelink.{0}.backup.windowsazure.com', toLower(parameters('parLocation')))]",
1148-
"privatelink.adf.azure.com",
1149-
"privatelink.afs.azure.net",
1150-
"privatelink.agentsvc.azure-automation.net",
1151-
"privatelink.analysis.windows.net",
1152-
"privatelink.api.azureml.ms",
1153-
"privatelink.azconfig.io",
1154-
"privatelink.azure-api.net",
1155-
"privatelink.azure-automation.net",
1156-
"privatelink.azurecr.io",
1157-
"privatelink.azure-devices.net",
1158-
"privatelink.azure-devices-provisioning.net",
1159-
"privatelink.azuredatabricks.net",
1160-
"privatelink.azurehdinsight.net",
1161-
"privatelink.azurehealthcareapis.com",
1162-
"privatelink.azurestaticapps.net",
1163-
"privatelink.azuresynapse.net",
1164-
"privatelink.azurewebsites.net",
1165-
"privatelink.batch.azure.com",
1166-
"privatelink.blob.core.windows.net",
1167-
"privatelink.cassandra.cosmos.azure.com",
1168-
"privatelink.cognitiveservices.azure.com",
1169-
"privatelink.database.windows.net",
1170-
"privatelink.datafactory.azure.net",
1171-
"privatelink.dev.azuresynapse.net",
1172-
"privatelink.dfs.core.windows.net",
1173-
"privatelink.dicom.azurehealthcareapis.com",
1174-
"privatelink.digitaltwins.azure.net",
1175-
"privatelink.directline.botframework.com",
1176-
"privatelink.documents.azure.com",
1177-
"privatelink.eventgrid.azure.net",
1178-
"privatelink.file.core.windows.net",
1179-
"privatelink.gremlin.cosmos.azure.com",
1180-
"privatelink.guestconfiguration.azure.com",
1181-
"privatelink.his.arc.azure.com",
1182-
"privatelink.dp.kubernetesconfiguration.azure.com",
1183-
"privatelink.managedhsm.azure.net",
1184-
"privatelink.mariadb.database.azure.com",
1185-
"privatelink.media.azure.net",
1186-
"privatelink.mongo.cosmos.azure.com",
1187-
"privatelink.monitor.azure.com",
1188-
"privatelink.mysql.database.azure.com",
1189-
"privatelink.notebooks.azure.net",
1190-
"privatelink.ods.opinsights.azure.com",
1191-
"privatelink.oms.opinsights.azure.com",
1192-
"privatelink.pbidedicated.windows.net",
1193-
"privatelink.postgres.database.azure.com",
1194-
"privatelink.prod.migration.windowsazure.com",
1195-
"privatelink.purview.azure.com",
1196-
"privatelink.purviewstudio.azure.com",
1197-
"privatelink.queue.core.windows.net",
1198-
"privatelink.redis.cache.windows.net",
1199-
"privatelink.redisenterprise.cache.azure.net",
1200-
"privatelink.search.windows.net",
1201-
"privatelink.service.signalr.net",
1202-
"privatelink.servicebus.windows.net",
1203-
"privatelink.siterecovery.windowsazure.com",
1204-
"privatelink.sql.azuresynapse.net",
1205-
"privatelink.table.core.windows.net",
1206-
"privatelink.table.cosmos.azure.com",
1207-
"privatelink.tip1.powerquery.microsoft.com",
1208-
"privatelink.token.botframework.com",
1209-
"privatelink.vaultcore.azure.net",
1210-
"privatelink.web.core.windows.net",
1211-
"privatelink.webpubsub.azure.com"
1212-
]
1213-
},
1214-
"parPrivateDnsZoneAutoMergeAzureBackupZone": {
1215-
"value": true
1139+
"value": []
12161140
},
12171141
"parVirtualNetworkIdToLinkFailover": {
12181142
"value": ""
12191143
},
1144+
"parVirtualNetworkResourceIdsToLinkTo": {
1145+
"value": []
1146+
},
12201147
"parPrivateDNSZonesLock": {
12211148
"value": {
12221149
"kind": "None",

0 commit comments

Comments
 (0)