PF-190: Confirm support for Azure Government in pipelines#3188
PF-190: Confirm support for Azure Government in pipelines#3188gruntwork-ci wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughUpdated Azure Pipelines docs to describe sovereign cloud support for Azure OIDC, add a new Azure Government tutorial, add a tutorial sidebar link, and extend spellcheck terms for the new cloud names. ChangesAzure sovereign cloud documentation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/2.0/docs/pipelines/concepts/cloud-auth/azure.md`:
- Around line 155-157: The Azure provider guidance is incorrect for Azure Stack:
the `environment` attribute on `azurerm` and `azuread` should not be described
as supporting `stack`. Update the docs around the `environment` guidance to say
`stack` is a Pipelines-specific value, while local Terraform/Terragrunt runs
must use the standard provider environments (`public`, `usgovernment`, `china`,
`german`) and configure Azure Stack via `metadata_host`/`ARM_METADATA_HOST` or
the dedicated `azurestack` provider logic in the relevant docs section.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c91c03b8-d12c-440d-a44f-de117b412c32
📒 Files selected for processing (5)
cspell.jsondocs/2.0/docs/pipelines/concepts/cloud-auth/azure.mddocs/2.0/docs/pipelines/tutorials/deploying-to-azure-government.mdxdocs/2.0/reference/pipelines/configurations-as-code/api.mdxsidebars/docs.js
| Accepted values (lowercase, matching the azurerm provider): `public`, `usgovernment`, `china`, `german`, `stack`. | ||
|
|
||
| To make local Terragrunt runs target the same cloud as Pipelines, pass the same value to the `environment` attribute of your `azurerm` and `azuread` provider blocks (typically generated by your `root.hcl`). The OpenTofu/Terraform state backend (`backend "azurerm"`) must also be configured for the target cloud. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major
🧩 Analysis chain
🌐 Web query:
azure rm terraform provider environment attribute valid values stack AzureStack
💡 Result:
When using the Terraform AzureRM provider (hashicorp/azurerm), the environment attribute is intended for standard Azure cloud environments [1][2][3]. Valid values for this attribute are public, usgovernment, german, and china [1][2][3]. The environment attribute is not used to target Azure Stack Hub [1]. Instead, to connect to Azure Stack Hub, you should use the dedicated hashicorp/azurestack provider [4][5]. If you are using the azurestack provider: - Do not use the environment attribute for Azure Stack Hub connectivity. - Instead, use the metadata_host attribute to specify the FQDN hostname of your Azure Metadata Service (e.g., management.region.mystack.ca) [4][6]. - This value can also be configured via the ARM_METADATA_HOST environment variable [4][7]. In specialized scenarios where users have attempted to force the azurerm provider to work with non-public Azure clouds (like Azure Stack) by setting environment="STACK", this is generally considered an unsupported or undocumented workaround that typically requires additional configuration via external environment variables (such as AZURE_ENVIRONMENT_FILEPATH) to define custom endpoints [8]. For stable production use, the official azurestack provider remains the supported path for Azure Stack Hub [4][5].
Citations:
- 1: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs
- 2: https://registry.terraform.io/providers/hashicorp/azurerm/2.93.1/docs
- 3: https://registry.terraform.io/providers/hashicorp/azurerm/3.49.0/docs
- 4: https://registry.terraform.io/providers/hashicorp/azurestack/latest/docs
- 5: https://techcommunity.microsoft.com/t5/azure-stack-blog/azure-stack-hub-infrastructure-as-code-using-terraform/ba-p/1374530
- 6: https://registry.terraform.io/providers/hashicorp/azurestack/latest/docs/guides/1.0-upgrade-guide
- 7: https://registry.terraform.io/providers/hashicorp/azurestack/latest/docs/guides/service_principal_client_secret
- 8: Support for custom Azure environments hashicorp/terraform-provider-azurerm#6816
🌐 Web query:
azuread terraform provider environment attribute valid values stack AzureStack
💡 Result:
The azuread Terraform provider's environment attribute does not include a specific "AzureStack" value. The environment attribute in the azuread provider is used to define the Azure cloud environment (e.g., global, usgovernmentl4, china) to which the provider connects [1][2][3]. For scenarios involving Azure Stack, the azuread provider is generally not the intended provider for managing Azure Stack resources; instead, the azurestack provider is used [4]. In the azurestack provider, there is no direct environment attribute equivalent to the azuread provider's cloud selection [4]. Instead, you must explicitly configure the metadata_host attribute to point to the Azure Metadata Service endpoint for your specific Azure Stack instance (e.g., https://management.westus.mydomain.ca) [4][5]. In summary: 1. The azuread provider's environment attribute supports: global (or public), usgovernmentl4 (or usgovernment), usgovernmentl5 (or dod), germany (or german), and china [1][3]. 2. There is no AzureStack value for this attribute in the azuread provider [1][2][3]. 3. For Azure Stack, use the azurestack provider and configure the metadata_host argument [4].
Citations:
- 1: https://registry.terraform.io/providers/hashicorp/azuread/2.37.1/docs
- 2: https://registry.terraform.io/providers/hashicorp/azuread/3.2.0/docs
- 3: https://registry.terraform.io/providers/hashicorp/azuread/latest/docs
- 4: https://registry.terraform.io/providers/hashicorp/azurestack/latest/docs
- 5: https://registry.terraform.io/providers/hashicorp/azurestack/latest/docs/guides/service_principal_client_secret
Correct the Terraform provider guidance for Azure Stack (stack).
The documentation incorrectly states that stack is a valid value for the environment attribute in the azurerm and azuread providers. Official Terraform provider documentation confirms that environment only supports public, usgovernment, china, and german.
For Azure Stack environments, local runs must not use environment = "stack". Instead, users should configure the metadata_host attribute (or set the ARM_METADATA_HOST environment variable) to point to their Azure Stack endpoint, or use the dedicated azurestack provider logic.
Update the text to clarify that while Pipelines accepts stack, local configurations require custom metadata settings rather than a shared environment value.
Suggested doc fix
-Accepted values (lowercase, matching the azurerm provider): `public`, `usgovernment`, `china`, `german`, `stack`.
-
-To make local Terragrunt runs target the same cloud as Pipelines, pass the same value to the `environment` attribute of your `azurerm` and `azuread` provider blocks (typically generated by your `root.hcl`). The OpenTofu/Terraform state backend (`backend "azurerm"`) must also be configured for the target cloud.
+Accepted values for Pipelines are: `public`, `usgovernment`, `china`, `german`, `stack`.
+
+To make local Terragrunt runs target the same cloud as Pipelines, configure `azurerm`, `azuread`, and the `azurerm` backend using the provider/backend settings they document for that cloud. Built-in sovereign clouds can use the `environment` attribute; Azure Stack/custom clouds require configuring the `metadata_host` attribute (or the `ARM_METADATA_HOST` environment variable) as documented by the providers, rather than passing `stack` to `environment`.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| Accepted values (lowercase, matching the azurerm provider): `public`, `usgovernment`, `china`, `german`, `stack`. | |
| To make local Terragrunt runs target the same cloud as Pipelines, pass the same value to the `environment` attribute of your `azurerm` and `azuread` provider blocks (typically generated by your `root.hcl`). The OpenTofu/Terraform state backend (`backend "azurerm"`) must also be configured for the target cloud. | |
| Accepted values for Pipelines are: `public`, `usgovernment`, `china`, `german`, `stack`. | |
| To make local Terragrunt runs target the same cloud as Pipelines, configure `azurerm`, `azuread`, and the `azurerm` backend using the provider/backend settings they document for that cloud. Built-in sovereign clouds can use the `environment` attribute; Azure Stack/custom clouds require configuring the `metadata_host` attribute (or the `ARM_METADATA_HOST` environment variable) as documented by the providers, rather than passing `stack` to `environment`. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/2.0/docs/pipelines/concepts/cloud-auth/azure.md` around lines 155 - 157,
The Azure provider guidance is incorrect for Azure Stack: the `environment`
attribute on `azurerm` and `azuread` should not be described as supporting
`stack`. Update the docs around the `environment` guidance to say `stack` is a
Pipelines-specific value, while local Terraform/Terragrunt runs must use the
standard provider environments (`public`, `usgovernment`, `china`, `german`) and
configure Azure Stack via `metadata_host`/`ARM_METADATA_HOST` or the dedicated
`azurestack` provider logic in the relevant docs section.
|
|
||
| There are three places where the Azure cloud environment must be set for a working Azure Government setup: | ||
|
|
||
| 1. **Entra ID application registrations**: created in the [Azure Government portal](https://portal.azure.us), not the public Azure portal. |
There was a problem hiding this comment.
Is this not going to be bootstrapped the same way it is for non-government set ups? It doesn't seem like we assume that for the AWS gov cloud setup.
2 participants
Implements plan for Linear issue PF-190.
Plan source: https://github.com/gruntwork-io-team/linear-claude-plans/blob/main/plans/PF-190.md
Claude's implementation summary
Related PRs in this change set
Summary by CodeRabbit
Documentation
Chores