search

puppetlabs / puppetlabs-azure_arm

The Puppet Azure ARM Module
Apache License 2.0
4 stars 16 forks source link

Virtual Network Peering not working #7

Closed lowerpuppet closed 6 years ago

lowerpuppet commented 6 years ago

What you expected to happen?

Calling azure_virtual_network_peering with the correct parameters would cause a virtual network peering resource to be created in Azure.

What happened?

Despite a success message, the peering object does not get created.

How to reproduce it?

Use the following parameters to attempt to create a virtual network peering resource:

          us55peerwitharm:
            ensure: present
            resource_group_name: mcsnus5network
            location: eastus2
            parameters: {}
            properties:
              remoteVirtualNetwork:
                id: /subscriptions/111-111-111-111/resourceGroups/armvnet3/providers/Microsoft.Network/virtualNetworks/arm-vnet
              allowVirtualNetworkAccess: true
              allowForwardedTraffic: true
              allowGatewayTransit: false
              useRemoteGateways: false
              remoteAddressSpace:
                addressPrefixes:
                  - 10.250.0.0/16

Anything else we need to know?

Creating a Virtual Network Peering object using the Python SDK and the same ARM template works just fine.

Logs:

Despite the below snippet indicating that creation was successful, no object was created.

Info: Called (Get) endpoint at https://management.azure.com/subscriptions/111-111-111-111/providers/Microsoft.Network/virtualNetworks?api-version=2018-04-01, success was true
Info: Checking if resource us55 of type <no value> exists, returning true
Info: properties setter called to change to {"addressSpace"=>{"addressPrefixes"=>["10.55.0.0/16"]}, "dhcpOptions"=>{"dnsServers"=>["10.238.1.53", "10.238.1.28", "150.228.8.17"]}, "subnets"=>[{"name"=>"us5infrastructure", "properties"=>{"addressPrefix"=>"10.55.1.0/24", "routeTable"=>{"id"=>"/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet"}}}, {"name"=>"us5dase", "properties"=>{"addressPrefix"=>"10.55.100.0/24", "routeTable"=>{"id"=>"/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet"}, "networkSecurityGroup"=>{"id"=>"/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/networkSecurityGroups/us5dase"}}}, {"name"=>"us5dapimgt", "properties"=>{"addressPrefix"=>"10.55.101.0/24", "routeTable"=>{"id"=>"/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet"}, "networkSecurityGroup"=>{"id"=>"/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/networkSecurityGroups/us5dapimgt"}}}, {"name"=>"us5dappgw", "properties"=>{"addressPrefix"=>"10.55.102.0/24", "routeTable"=>{"id"=>"/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet"}, "networkSecurityGroup"=>{"id"=>"/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/networkSecurityGroups/us5dappgw"}}}]}
Notice: /Stage[main]/Mrll_azure/Azure_virtual_network[us55]/properties: properties changed {
  'provisioningState' => 'Succeeded',
  'resourceGuid' => '3699b400-8c45-46b1-badc-2f7bc2ab30d3',
  'addressSpace' => {
    'addressPrefixes' => ['10.55.0.0/16']
  },
  'dhcpOptions' => {
    'dnsServers' => ['10.238.1.53', '10.238.1.28', '150.228.8.17']
  },
  'subnets' => [
    {
      'name' => 'us5infrastructure',
      'id' => '/subscriptions/111-111-111-111c/resourceGroups/mcsnus5network/providers/Microsoft.Network/virtualNetworks/us55/subnets/us5infrastructure',
      'etag' => 'W/"703f18ff-089b-4005-9e58-92619218337a"',
      'properties' => {
        'provisioningState' => 'Succeeded',
        'addressPrefix' => '10.55.1.0/24',
        'routeTable' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet'
        },
        'delegations' => []
      }
    },
    {
      'name' => 'us5dase',
      'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/virtualNetworks/us55/subnets/us5dase',
      'etag' => 'W/"703f18ff-089b-4005-9e58-92619218337a"',
      'properties' => {
        'provisioningState' => 'Succeeded',
        'addressPrefix' => '10.55.100.0/24',
        'networkSecurityGroup' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/networkSecurityGroups/us5dase'
        },
        'routeTable' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet'
        },
        'delegations' => []
      }
    },
    {
      'name' => 'us5dapimgt',
      'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/virtualNetworks/us55/subnets/us5dapimgt',
      'etag' => 'W/"703f18ff-089b-4005-9e58-92619218337a"',
      'properties' => {
        'provisioningState' => 'Succeeded',
        'addressPrefix' => '10.55.101.0/24',
        'networkSecurityGroup' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/networkSecurityGroups/us5dapimgt'
        },
        'routeTable' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet'
        },
        'delegations' => []
      }
    },
    {
      'name' => 'us5dappgw',
      'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/virtualNetworks/us55/subnets/us5dappgw',
      'etag' => 'W/"703f18ff-089b-4005-9e58-92619218337a"',
      'properties' => {
        'provisioningState' => 'Succeeded',
        'addressPrefix' => '10.55.102.0/24',
        'networkSecurityGroup' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/networkSecurityGroups/us5dappgw'
        },
        'routeTable' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet'
        },
        'delegations' => []
      }
    }],
  'virtualNetworkPeerings' => [
    {
      'name' => 'us55peerwitharm',
      'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/virtualNetworks/us55/virtualNetworkPeerings/us55peerwitharm',
      'etag' => 'W/"703f18ff-089b-4005-9e58-92619218337a"',
      'properties' => {
        'provisioningState' => 'Succeeded',
        'peeringState' => 'Initiated',
        'remoteVirtualNetwork' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/armvnet3/providers/Microsoft.Network/virtualNetworks/arm-vnet'
        },
        'allowVirtualNetworkAccess' => true,
        'allowForwardedTraffic' => true,
        'allowGatewayTransit' => false,
        'useRemoteGateways' => false,
        'remoteAddressSpace' => {
          'addressPrefixes' => ['10.250.0.0/16']
        },
        'routeServiceVips' => {

        }
      }
    }],
  'enableDdosProtection' => false,
  'enableVmProtection' => false
} to {
  'addressSpace' => {
    'addressPrefixes' => ['10.55.0.0/16']
  },
  'dhcpOptions' => {
    'dnsServers' => ['10.238.1.53', '10.238.1.28', '150.228.8.17']
  },
  'subnets' => [
    {
      'name' => 'us5infrastructure',
      'properties' => {
        'addressPrefix' => '10.55.1.0/24',
        'routeTable' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet'
        }
      }
    },
    {
      'name' => 'us5dase',
      'properties' => {
        'addressPrefix' => '10.55.100.0/24',
        'routeTable' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet'
        },
        'networkSecurityGroup' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/networkSecurityGroups/us5dase'
        }
      }
    },
    {
      'name' => 'us5dapimgt',
      'properties' => {
        'addressPrefix' => '10.55.101.0/24',
        'routeTable' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet'
        },
        'networkSecurityGroup' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/networkSecurityGroups/us5dapimgt'
        }
      }
    },
    {
      'name' => 'us5dappgw',
      'properties' => {
        'addressPrefix' => '10.55.102.0/24',
        'routeTable' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/routeTables/directinternet'
        },
        'networkSecurityGroup' => {
          'id' => '/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/networkSecurityGroups/us5dappgw'
        }
      }
    }]
}
Info: Entered flush for resource us55 of type VirtualNetwork - creating ? false, deleting ? false
Info: Calling operation VirtualNetworks_CreateOrUpdate
Info: Getting oauth2 token
Info: Authentication succeeded
Info: Called (Put) endpoint at https://management.azure.com/subscriptions/111-111-111-111/resourceGroups/mcsnus5network/providers/Microsoft.Network/virtualNetworks/us55?api-version=2018-04-01, success was true
gregohardy commented 6 years ago

Thanks for the bug report! I've raised a ticket to get this fixed.

gregohardy commented 6 years ago

Hi @lowerpuppet.

We have tried out the peering here and this manifest was successful. There is no list operation in the spec for peers (a similar situation to subnets) which is why the instance isn't retrieved. It can be created okay with the manifest snippet below.

$base_name = 'smoke' $rg = "${base_name}-rg-name" $storage_account = "${base_name}saccount" $nsg = "${base_name}-nsg" $vnet = "${base_name}-vnet" $vnet1 = "${base_name}-vnet-1" $subnet = "${base_name}-subnet" $subnet1 = "${base_name}-subnet-1" $peer = "${base_name}-peer" $location = 'uksouth'

azure_virtual_network_peering { $peer: ensure              => present, properties => { remoteAddressSpace => {   addressPrefixes => '10.2.0.0/16', }, remoteVirtualNetwork => {    id   => "/subscriptions/111-111-111-111-111/resourceGroups/${rg}/providers/Microsoft.Network/virtualNetworks/${vnet1}"                          },

allowVirtualNetworkAccess => true, allowForwardedTraffic => true, allowGatewayTransit => false, useRemoteGateways => false, }, resource_group_name => "$rg", virtual_network_name => "$vnet", virtual_network_peering_parameters => "Create", }

lowerpuppet commented 6 years ago

Hurm. Wonder what the difference is.

Would it be possible for you to send me the debug output from the master of when you run this manifest so I might compare it to what’s happening when I deploy, please?

-Richard

From: Greg Hardy notifications@github.com Reply-To: puppetlabs/puppetlabs-azure_arm reply@reply.github.com Date: Monday, July 23, 2018 at 10:03 AM To: puppetlabs/puppetlabs-azure_arm puppetlabs-azure_arm@noreply.github.com Cc: Richard Lawson Richard.Lawson@merrillcorp.com, Mention mention@noreply.github.com Subject: [External] Re: [puppetlabs/puppetlabs-azure_arm] Virtual Network Peering not working (#7)

Hi @lowerpuppethttps://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Flowerpuppet&data=02%7C01%7C%7C1d78ce52c0be40bebe7e08d5f0ad788c%7C617c6097e5ba42f8b13111b4d05a73ca%7C0%7C0%7C636679550196082697&sdata=Nz3mjHvpj2C5gSGNJGa2v%2B0HkAvrqCQlmX4a7WjCcQY%3D&reserved=0.

We have tried out the peering here and this manifest was successful. There is no list operation in the spec for peers (a similar situation to subnets) which is why the instance isn't retrieved. It can be created okay with the manifest snippet below.

$base_name = 'smoke' $rg = "${base_name}-rg-name" $storage_account = "${base_name}saccount" $nsg = "${base_name}-nsg" $vnet = "${base_name}-vnet" $vnet1 = "${base_name}-vnet-1" $subnet = "${base_name}-subnet" $subnet1 = "${base_name}-subnet-1" $peer = "${base_name}-peer" $location = 'uksouth'

azure_virtual_network_peering { $peer: ensure              => present, properties => { remoteAddressSpace => {   addressPrefixes => '10.2.0.0/16', }, remoteVirtualNetwork => {    id   => "/subscriptions/111-111-111-111-111/resourceGroups/${rg}/providers/Microsoft.Network/virtualNetworks/${vnet1}"                          },

allowVirtualNetworkAccess => true, allowForwardedTraffic => true, allowGatewayTransit => false, useRemoteGateways => false, }, resource_group_name => "$rg", virtual_network_name => "$vnet", virtual_network_peering_parameters => "Create", }

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fpuppetlabs%2Fpuppetlabs-azure_arm%2Fissues%2F7%23issuecomment-407089832&data=02%7C01%7C%7C1d78ce52c0be40bebe7e08d5f0ad788c%7C617c6097e5ba42f8b13111b4d05a73ca%7C0%7C0%7C636679550196082697&sdata=sDo4cGmlaT4ivcjwnNP%2FrzZuG31oe9cHh0U88BfjPeo%3D&reserved=0, or mute the threadhttps://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAdzfTAo2MQSO5i5ONk46op0tuzN5q_gSks5uJeXJgaJpZM4VLOWu&data=02%7C01%7C%7C1d78ce52c0be40bebe7e08d5f0ad788c%7C617c6097e5ba42f8b13111b4d05a73ca%7C0%7C0%7C636679550196082697&sdata=Iq1g2Bhh%2F33rYEg%2FzgUNszp1jaLyzQROJaI0dRZJDBg%3D&reserved=0.

lowerpuppet commented 6 years ago

Okay, already I’m highly confused. :)

You have in your manifest:

virtual_network_peering_parameters: create

We don’t have that. I tried adding it to my manifest and got:

Error: Could not retrieve catalog from remote server: Error 500 on SERVER: Server Error: no parameter named 'virtual_network_peering_parameters'

I took a look at the documentation at:

https://github.com/puppetlabs/puppetlabs-azure_arm/blob/master/azure_virtual_network_peering.md

I can see “virtual_network_peering_parameters” listed there, but not in the format you used, and certainly nothing that can be passed the value of “Create”.

So I’m confuzzled. Do you have a different version of the azure_arm module than we do?

Richard Lawson Cloud Services Engineer Merrill Corporation

One Merrill Circle St Paul, MN 55108

richard.lawson@merrillcorp.commailto:richard.lawson@merrillcorp.com

(651) 632-1347

From: Greg Hardy notifications@github.com Reply-To: puppetlabs/puppetlabs-azure_arm reply@reply.github.com Date: Monday, July 23, 2018 at 10:03 AM To: puppetlabs/puppetlabs-azure_arm puppetlabs-azure_arm@noreply.github.com Cc: Richard Lawson Richard.Lawson@merrillcorp.com, Mention mention@noreply.github.com Subject: [External] Re: [puppetlabs/puppetlabs-azure_arm] Virtual Network Peering not working (#7)

azure_virtual_network_peering { $peer: ensure              => present, properties => { remoteAddressSpace => {   addressPrefixes => '10.2.0.0/16', }, remoteVirtualNetwork => {    id   => "/subscriptions/111-111-111-111-111/resourceGroups/${rg}/providers/Microsoft.Network/virtualNetworks/${vnet1}"                          },

allowVirtualNetworkAccess => true, allowForwardedTraffic => true, allowGatewayTransit => false, useRemoteGateways => false, }, resource_group_name => "$rg", virtual_network_name => "$vnet", virtual_network_peering_parameters => "Create", }

lowerpuppet commented 6 years ago

Greg,

Thanks to your handy example, we got virtual network peering to work.

Some feedback:

The documentation says that “virtual_network_peering_parameters” is required and should be a string value, but gives no indication what values should be used.

Most importantly, you can deploy virtual_network_peering without the “virtual_network_peering_parameter” set, and no error message is displayed. It simply fails to do anything. That was the “null” message that Microsoft was seeing. I guess without a “create” or “update” setting, the ARM template sent to Azure by Puppet is simply “noop”.

It would be kinda nice if “ensure => present” would mean this “virtual_network_peering_parameters” automatically gets set to “create”.

Anyway, thanks a ton Greg. This will probably help us figure out the other deploys that weren’t working (like the value of DNS servers, for one; once deployed, we couldn’t get those to ever change. I bet there’s an “update” setting we’re not configuring there as well.

Thanks Greg, this was good progress.

-Richard

From: Greg Hardy notifications@github.com Reply-To: puppetlabs/puppetlabs-azure_arm reply@reply.github.com Date: Monday, July 23, 2018 at 10:03 AM To: puppetlabs/puppetlabs-azure_arm puppetlabs-azure_arm@noreply.github.com Cc: Richard Lawson Richard.Lawson@merrillcorp.com, Mention mention@noreply.github.com Subject: [External] Re: [puppetlabs/puppetlabs-azure_arm] Virtual Network Peering not working (#7)

Hi @lowerpuppethttps://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Flowerpuppet&data=02%7C01%7C%7C1d78ce52c0be40bebe7e08d5f0ad788c%7C617c6097e5ba42f8b13111b4d05a73ca%7C0%7C0%7C636679550196082697&sdata=Nz3mjHvpj2C5gSGNJGa2v%2B0HkAvrqCQlmX4a7WjCcQY%3D&reserved=0.

We have tried out the peering here and this manifest was successful. There is no list operation in the spec for peers (a similar situation to subnets) which is why the instance isn't retrieved. It can be created okay with the manifest snippet below.

$base_name = 'smoke' $rg = "${base_name}-rg-name" $storage_account = "${base_name}saccount" $nsg = "${base_name}-nsg" $vnet = "${base_name}-vnet" $vnet1 = "${base_name}-vnet-1" $subnet = "${base_name}-subnet" $subnet1 = "${base_name}-subnet-1" $peer = "${base_name}-peer" $location = 'uksouth'

azure_virtual_network_peering { $peer: ensure              => present, properties => { remoteAddressSpace => {   addressPrefixes => '10.2.0.0/16', }, remoteVirtualNetwork => {    id   => "/subscriptions/111-111-111-111-111/resourceGroups/${rg}/providers/Microsoft.Network/virtualNetworks/${vnet1}"                          },

allowVirtualNetworkAccess => true, allowForwardedTraffic => true, allowGatewayTransit => false, useRemoteGateways => false, }, resource_group_name => "$rg", virtual_network_name => "$vnet", virtual_network_peering_parameters => "Create", }

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fpuppetlabs%2Fpuppetlabs-azure_arm%2Fissues%2F7%23issuecomment-407089832&data=02%7C01%7C%7C1d78ce52c0be40bebe7e08d5f0ad788c%7C617c6097e5ba42f8b13111b4d05a73ca%7C0%7C0%7C636679550196082697&sdata=sDo4cGmlaT4ivcjwnNP%2FrzZuG31oe9cHh0U88BfjPeo%3D&reserved=0, or mute the threadhttps://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAdzfTAo2MQSO5i5ONk46op0tuzN5q_gSks5uJeXJgaJpZM4VLOWu&data=02%7C01%7C%7C1d78ce52c0be40bebe7e08d5f0ad788c%7C617c6097e5ba42f8b13111b4d05a73ca%7C0%7C0%7C636679550196082697&sdata=Iq1g2Bhh%2F33rYEg%2FzgUNszp1jaLyzQROJaI0dRZJDBg%3D&reserved=0.

gregohardy commented 6 years ago

No problem. I'll raise a ticket about the virtual_network_peering_parameters. We'll do some digging in Azure API about the parameter and see what we can generate for the example. Let us know if you have any problems.