[ARO-21136] add network security perimeter to some resources #4396
Conversation
mrWinston
changed the title
|
Please rebase pull request. |
mrWinston
requested review from
bennerv,
cadenmarchese,
fahlmant,
hawkowl,
hlipsig,
jaitaiwan,
jharrington22,
kimorris27,
mociarain,
pepedocs,
rogbas,
sankur-codes,
tiguelu,
tsatam,
wanghaoran1988 and
yjst2012
as code owners
|
LGTM |
|
How did you validate these in INT? Do they result in something in the portal we can see? |
I validated it by running the RP deployment in int and then checking the int subscription to see if the NSPs were created and if the resources had been assigned correctly. Which they were. Additionally, the compliance dashboard showed the associated alerts as being resolved. |
|
I think you can just push an empty commit to make this check run. |
| return &arm.Resource{ | ||
| Resource: &armnetwork.NspAssociation{ | ||
| Properties: &armnetwork.NspAssociationProperties{ | ||
| AccessMode: pointerutils.ToPtr(armnetwork.AssociationAccessModeLearning), |
There was a problem hiding this comment.
minor: if some day we want to move this to enforce or audit... would it be worth to have it as a func parameter? I like how clean looks right now, so it's not a deal breaker.
| } | ||
| } | ||
|
|
||
| // networkSecurityPerimeterProfile creates a new nsp profile with the hardcoded name `default`. |
There was a problem hiding this comment.
reading the code, this func creates a resource with name nspname/default which is not exactly "hardcoded default".
| cosmosNSPProfile := g.networkSecurityPerimeterProfile("cosmos-nsp") | ||
| cosmosNSPAssociation := g.networkSecurityPerimeterAssociation("cosmos-nsp", "cosmos-nsp-association", "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]") | ||
|
|
||
| rs = append(rs, cosmosNSP, cosmosNSPProfile, cosmosNSPAssociation) |
There was a problem hiding this comment.
According to this https://learn.microsoft.com/en-us/azure/private-link/network-security-perimeter-concepts#onboarded-private-link-resources Cosmos DB is not GA, but on "Public Preview"... will it work in all of our regions?
Which issue this PR addresses:
Fixes: https://issues.redhat.com/browse/ARO-21136
What this PR does / why we need it:
Resources affected:
Test plan for issue:
[ ] Deploy and Test in CanaryCanary deployment will be run together with the associated sdp-pipelines and ARO-Pipelines release.