Skip to content

Support deployment in Azure Government#3396

Open
JimmyHarper wants to merge 10 commits intomicrosoft:mainfrom
JimmyHarper:gov-mods
Open

Support deployment in Azure Government#3396
JimmyHarper wants to merge 10 commits intomicrosoft:mainfrom
JimmyHarper:gov-mods

Conversation

@JimmyHarper
Copy link
Copy Markdown

Modifications to support deployment in Azure Government (items 6 and 7 still need work):

1. Allow usage of E32as VMs (E32s not available in Azure Gov). 
	○ Update the following files to include 'Standard_E32as_v5' and 'Standard_E32as_v6' in the allowed VM sizes
		§ Main.bicep
		§ Host.bicep

2. Allow deployment to US Government Virginia region
	○ Update the following files to include 'usgovvirginia' in the allowed locations
		§ Main.azd.bicep
		§ Main.bicep
		§ Host.bicep

3. Add an `azureEnvironment` parameter to the Bicep layer to allow for logon to AzureGovernment cloud
	○ main.bicep: Add `param azureEnvironment string = 'AzureCloud'` and pass it to the host module
	○ host.bicep: Accept the parameter and append `-azureEnvironment ${azureEnvironment}` to the `commandToExecute` for Bootstrap.ps1
	○ main.bicepparam / main.parameters.json: Add the new parameter
	○ Bootstrap.ps1: Accept and propagate
		§ Add `[string]$azureEnvironment` to the `param` block
		§ Add `[System.Environment]::SetEnvironmentVariable('azureEnvironment', $azureEnvironment, ...)` so downstream scripts can read `$Env:azureEnvironment`
		§ Update line 156: `Connect-AzAccount -Identity` → `Connect-AzAccount -Identity -Environment $azureEnvironment`
		
4. Update all `Connect-AzAccount` calls (7 files) to use azureEnvironment parameter. Add `-Environment $Env:azureEnvironment` to each:
	○ LocalBoxLogonScript.ps1 - Line 15
	○ WinGet.ps1 - Line 13
	○ Send-PesterResult.ps1 - Line 17
	○ common.tests.ps1 - Line 3
	○ azlocal.tests.ps1 - Line 11
	○ preprovision.ps1 - Line 16
	
5. Configure to use azureEnvironment parameter for all 'az login` calls (5 files). Insert `az cloud set --name $Env:azureEnvironment` before each `az login`:
	○ Configure-AKSWorkloadCluster.ps1 - Line 17
	○ Configure-VMLogicalNetwork.ps1 - Line 14
	○ Configure-SQLManagedInstance.ps1 - Line 65
	○ Send-PesterResult.ps1 - Line 56
	○ preprovision.ps1 - Line 29
	
6. Update Set-AzLocalDeployPrereqs function.
	○ This is necessary because the Set-AzLocalDeployPrereqs function is hardcoded to use public cloud. This should be updated to use a CloudEnv parameter.
	○ Current workaround is to add the function to New-LocalBoxCluster.ps1 and hardcode to AzureUSGovernment
	○ Also had to Add ConvertFrom-SecureStringToPlainText function to New-LocalBoxCluster.ps1
	
7. Fix hardcoded Azure Public endpoints
	○ azlocal.json: 5 instances of `.vault.azure.net` (lines 478, 492, 505, 510, 515) and 1 instance of `core.windows.net` (line 481).
	○ dataController.parameters.json: line 33 hardcodes `https://login.microsoftonline.com`.
	○ Currently have these hard-coded to use Government endpoints. Need to understand how to implement suggested solution
	Endpoint	Azure Public	Azure US Government
	Key Vault	.vault.azure.net	.vault.usgovcloudapi.net
	Login	login.microsoftonline.com	login.microsoftonline.us
	Storage	core.windows.net	core.usgovcloudapi.net
	○ Suggestion solution - not sure where to add this
		§ Rather than hardcoding Gov endpoints, use PowerShell's built-in cloud metadata:
			$azEnv = Get-AzEnvironment -Name $Env:azureEnvironment
			$kvSuffix = $azEnv.AzureKeyVaultDnsSuffix        # vault.azure.net or vault.usgovcloudapi.net
			$storageSuffix = $azEnv.StorageEndpointSuffix     # core.windows.net or core.usgovcloudapi.net
			$loginEndpoint = $azEnv.ActiveDirectoryAuthority  # https://login.microsoftonline.com/ or .us/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant