umarmohamedusman / aro-reference-architecture Goto Github PK

Hi there!,

In the line 73 of the frontdoor.azcli deployment there is a readme that says:

# Currently there is a bug in Az CLI that is unable to approve a Private Endpoint in a Private Link Service
# Bug Link: https://github.com/Azure/azure-cli/issues/19908
# Following command expected to fail with 'child_name_1'
# Check out: https://docs.microsoft.com/en-us/azure/frontdoor/standard-premium/concept-private-link
# For now go through Portal, find Private Link Service (under spoke rg) in this case aro-pls, then go to 'Private endpoint connections', select the connection and Approve
# Connection status should change from Pending to Approved

This can be done by cli if you change the line 72 from:

privatelink_pe_id=$(az network private-link-service show -n $AFD_PLS_NAME -g $SPOKERGNAME --query 'privateEndpointConnections[0].privateEndpoint.id' -o tsv)

to (sorry, my variables are a little different, but the important is the query)

privatelink_pe_id=$(az network private-link-service show -n $AFD_PLS_NAME -g $RG_VNET --query 'privateEndpointConnections[0].id' -o tsv -o tsv)

You should use the PrivateEndpointConnection id instead of PrivateEndpoint id, because you should approve the connection.

Just done by me now without issues.

Ref:
https://learn.microsoft.com/en-us/cli/azure/network/private-link-service?view=azure-cli-latest#az-network-private-link-service-show
https://learn.microsoft.com/en-us/cli/azure/network/private-endpoint-connection?view=azure-cli-latest#az-network-private-endpoint-connection-approve

https://github.com/Azure/Enterprise-Scale-for-AKS/blob/main/Scenarios/AKS-Secure-Baseline-PrivateCluster/Bicep/07-workload.md

Secret store CSI driver deployment on ARO and application integration

Research and come up with optimal way to integrate Azure Storage with ARO

Hi Umar and team,
I apologise for creating an issue but I wasn't exactly sure how to contact you by other means. I would like to bring your attention to a repo that I have been working on which was inspired by your ARO reference architecture write up. I took a different approach and started to learn bicep and have written some modules to deploy ARO and the other Azure resources. The modules are able to be run as an azcli command or I have managed to create a method to deploy it all from github actions.

It would be great if you could take a look. Hope to speak soon.

https://github.com/grantomation/aro-automated-architecture

Cheers,
Grant

Please feel free to close this non-issue :)

Provision Azure Application Gateway and Web Application Firewall and integrate with private ARO cluster.
Expose private web application deployed on ARO to internet securely through App GW (reverse proxy)