From 04b989ac1bfc9f2fcd9d585ca00d3496a1b5cd2f Mon Sep 17 00:00:00 2001 From: Irinel Bogdan Date: Tue, 28 Jul 2026 12:51:20 +0300 Subject: [PATCH 1/4] Add virtual machine fqdn setup extension --- docs/modules/azure.md | 1 + .../main.tf | 59 +++++++++++++++++++ .../outputs.tf | 4 ++ .../variables.tf | 33 +++++++++++ .../versions.tf | 10 ++++ 5 files changed, 107 insertions(+) create mode 100644 src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf create mode 100644 src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf create mode 100644 src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf create mode 100644 src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf diff --git a/docs/modules/azure.md b/docs/modules/azure.md index fe4e166..98cdf42 100644 --- a/docs/modules/azure.md +++ b/docs/modules/azure.md @@ -25,6 +25,7 @@ lacks. Keep new inputs shaped the AVM way. | Module | What it does | |---|---| | [`azure-ptn-authorization-roledefinition-collection`](../../src/modules/azure-ptn-authorization-roledefinition-collection/) | Many role definitions from one map | +| [`azure-ptn-compute-virtualmachine-fqdn`](../../src/modules/azure-ptn-compute-virtualmachine-fqdn/) | Windows VM in-guest primary DNS suffix set via CustomScriptExtension with a deferred reboot, so the guest FQDN matches its public DNS name | | [`azure-ptn-network-dnszone-records`](../../src/modules/azure-ptn-network-dnszone-records/) | A, AAAA, CAA, CNAME, MX, NS, PTR, SRV and TXT records in an existing public zone | | [`azure-ptn-network-privatednszone-records`](../../src/modules/azure-ptn-network-privatednszone-records/) | A, AAAA, CNAME, MX, PTR, SRV and TXT records in an existing private zone | | [`azure-ptn-network-privatednszone-vnet-links`](../../src/modules/azure-ptn-network-privatednszone-vnet-links/) | Virtual network links across many zones | diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf b/src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf new file mode 100644 index 0000000..38b80b1 --- /dev/null +++ b/src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf @@ -0,0 +1,59 @@ +# ============================================================================= +# WINDOWS VM PRIMARY DNS SUFFIX + REBOOT +# ============================================================================= +# Sets the Windows *primary DNS suffix* via a CustomScriptExtension, then +# reboots, so the machine's own FQDN matches the public DNS name of its IP. +# Without it the guest FQDN stays the bare hostname, and anything that issues a +# ticket for the name you typed (Entra RDP being the motivating case) fails +# because the two names differ. +# +# The public IP and its DNS label are the CALLER's to create and attach - this +# module only touches the guest. provision_after_extensions holds the suffix +# step (and its reboot) until the named extensions finish, so it cannot land +# mid Entra-join. That is a stronger guarantee than depends_on, which only +# orders the ARM calls. +# ============================================================================= + +locals { + # Deferred so the extension reports success to Azure before the box goes down. + reboot_delay_seconds = 60 + + # Written to HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters - the + # same keys the Computer Name dialog writes. SyncDomainWithMembership=0 + # mirrors unticking "Change primary DNS suffix when domain membership + # changes". Idempotent: once the suffix is in place the script exits without + # rebooting. + set_dns_suffix_script = <<-PS + $ErrorActionPreference = 'Stop' + $suffix = '${var.dns_suffix}' + $key = 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' + $current = (Get-ItemProperty -Path $key -Name 'NV Domain' -ErrorAction SilentlyContinue).'NV Domain' + if ($current -eq $suffix) { + Write-Output "Primary DNS suffix already '$suffix' - nothing to do." + exit 0 + } + Set-ItemProperty -Path $key -Name 'Domain' -Value $suffix -Type String + Set-ItemProperty -Path $key -Name 'NV Domain' -Value $suffix -Type String + Set-ItemProperty -Path $key -Name 'SyncDomainWithMembership' -Value 0 -Type DWord + Write-Output "Primary DNS suffix set to '$suffix' (was '$current'). Rebooting in ${local.reboot_delay_seconds}s." + shutdown /r /t ${local.reboot_delay_seconds} /c "Applying primary DNS suffix" + exit 0 + PS +} + +resource "azurerm_virtual_machine_extension" "dns_suffix" { + name = "SetPrimaryDnsSuffix" + virtual_machine_id = var.virtual_machine_id + publisher = "Microsoft.Compute" + type = "CustomScriptExtension" + type_handler_version = "1.10" + auto_upgrade_minor_version = true + provision_after_extensions = var.provision_after_extensions + tags = var.tags + + # No -ExecutionPolicy flag: execution policy governs script *files*, not the + # inline script that -EncodedCommand runs, so it would be a no-op here. + settings = jsonencode({ + commandToExecute = "powershell.exe -NoProfile -EncodedCommand ${textencodebase64(local.set_dns_suffix_script, "UTF-16LE")}" + }) +} diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf b/src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf new file mode 100644 index 0000000..91fa395 --- /dev/null +++ b/src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf @@ -0,0 +1,4 @@ +output "extension_id" { + description = "Resource ID of the CustomScriptExtension that sets the primary DNS suffix." + value = azurerm_virtual_machine_extension.dns_suffix.id +} diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf b/src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf new file mode 100644 index 0000000..c7c1feb --- /dev/null +++ b/src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf @@ -0,0 +1,33 @@ +variable "virtual_machine_id" { + description = "Resource ID of the Windows virtual machine whose in-guest primary DNS suffix this extension sets." + type = string + + validation { + condition = can(regex("/providers/Microsoft.Compute/virtualMachines/", var.virtual_machine_id)) + error_message = "virtual_machine_id must be a Microsoft.Compute/virtualMachines resource ID." + } +} + +variable "dns_suffix" { + description = "Primary DNS suffix to write in-guest, e.g. westeurope.cloudapp.azure.com, so the machine's FQDN matches the public DNS name of its IP. Any lowercase DNS domain is accepted." + type = string + + validation { + condition = can(regex("^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}$", var.dns_suffix)) + error_message = "dns_suffix must be a valid lowercase DNS domain (e.g. westeurope.cloudapp.azure.com)." + } +} + +variable "provision_after_extensions" { + description = "Names of same-VM extensions this suffix step must provision after — the guest agent holds it (and its reboot) until they finish. Empty means no ordering constraint. Example: [\"AADLoginForWindows\"], so the reboot cannot land mid Entra-join." + type = list(string) + default = [] + nullable = false +} + +variable "tags" { + description = "Tags applied to the VM extension." + type = map(string) + default = {} + nullable = false +} diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf b/src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf new file mode 100644 index 0000000..e457b4a --- /dev/null +++ b/src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf @@ -0,0 +1,10 @@ +terraform { + required_version = ">= 1.15" + + required_providers { + azurerm = { + source = "hashicorp/azurerm" + version = ">= 4.81, < 5.0" + } + } +} From 9985c6bd80565f675f7d4301d6cf0d1a5d6e1b51 Mon Sep 17 00:00:00 2001 From: Irinel Bogdan Date: Tue, 28 Jul 2026 17:43:50 +0300 Subject: [PATCH 2/4] rename to relate only to windows fqdn --- docs/modules/azure.md | 2 +- .../main.tf | 0 .../outputs.tf | 0 .../variables.tf | 0 .../versions.tf | 0 5 files changed, 1 insertion(+), 1 deletion(-) rename src/modules/{azure-ptn-compute-virtualmachine-fqdn => azure-ptn-compute-virtualmachine-windows-fqdn}/main.tf (100%) rename src/modules/{azure-ptn-compute-virtualmachine-fqdn => azure-ptn-compute-virtualmachine-windows-fqdn}/outputs.tf (100%) rename src/modules/{azure-ptn-compute-virtualmachine-fqdn => azure-ptn-compute-virtualmachine-windows-fqdn}/variables.tf (100%) rename src/modules/{azure-ptn-compute-virtualmachine-fqdn => azure-ptn-compute-virtualmachine-windows-fqdn}/versions.tf (100%) diff --git a/docs/modules/azure.md b/docs/modules/azure.md index 98cdf42..7d11f96 100644 --- a/docs/modules/azure.md +++ b/docs/modules/azure.md @@ -25,7 +25,7 @@ lacks. Keep new inputs shaped the AVM way. | Module | What it does | |---|---| | [`azure-ptn-authorization-roledefinition-collection`](../../src/modules/azure-ptn-authorization-roledefinition-collection/) | Many role definitions from one map | -| [`azure-ptn-compute-virtualmachine-fqdn`](../../src/modules/azure-ptn-compute-virtualmachine-fqdn/) | Windows VM in-guest primary DNS suffix set via CustomScriptExtension with a deferred reboot, so the guest FQDN matches its public DNS name | +| [`azure-ptn-compute-virtualmachine-windows-fqdn`](../../src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/) | Windows VM in-guest primary DNS suffix set via CustomScriptExtension with a deferred reboot, so the guest FQDN matches its public DNS name | | [`azure-ptn-network-dnszone-records`](../../src/modules/azure-ptn-network-dnszone-records/) | A, AAAA, CAA, CNAME, MX, NS, PTR, SRV and TXT records in an existing public zone | | [`azure-ptn-network-privatednszone-records`](../../src/modules/azure-ptn-network-privatednszone-records/) | A, AAAA, CNAME, MX, PTR, SRV and TXT records in an existing private zone | | [`azure-ptn-network-privatednszone-vnet-links`](../../src/modules/azure-ptn-network-privatednszone-vnet-links/) | Virtual network links across many zones | diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf similarity index 100% rename from src/modules/azure-ptn-compute-virtualmachine-fqdn/main.tf rename to src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/outputs.tf similarity index 100% rename from src/modules/azure-ptn-compute-virtualmachine-fqdn/outputs.tf rename to src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/outputs.tf diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf similarity index 100% rename from src/modules/azure-ptn-compute-virtualmachine-fqdn/variables.tf rename to src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf diff --git a/src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf similarity index 100% rename from src/modules/azure-ptn-compute-virtualmachine-fqdn/versions.tf rename to src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf From e1a7f3c4a7377a8ebbfe003bcd2b6095451eaca3 Mon Sep 17 00:00:00 2001 From: Irinel Bogdan Date: Wed, 29 Jul 2026 16:27:07 +0300 Subject: [PATCH 3/4] Reboot machine using azapi_resource_action --- docs/modules/azure.md | 2 +- .../main.tf | 64 ++++++++++--------- .../variables.tf | 7 ++ .../versions.tf | 4 ++ 4 files changed, 47 insertions(+), 30 deletions(-) diff --git a/docs/modules/azure.md b/docs/modules/azure.md index 7d11f96..9ddc591 100644 --- a/docs/modules/azure.md +++ b/docs/modules/azure.md @@ -25,7 +25,7 @@ lacks. Keep new inputs shaped the AVM way. | Module | What it does | |---|---| | [`azure-ptn-authorization-roledefinition-collection`](../../src/modules/azure-ptn-authorization-roledefinition-collection/) | Many role definitions from one map | -| [`azure-ptn-compute-virtualmachine-windows-fqdn`](../../src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/) | Windows VM in-guest primary DNS suffix set via CustomScriptExtension with a deferred reboot, so the guest FQDN matches its public DNS name | +| [`azure-ptn-compute-virtualmachine-windows-fqdn`](../../src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/) | Windows VM in-guest primary DNS suffix set via CustomScriptExtension (so the guest FQDN matches its public DNS name), then applied by an ARM restart the apply blocks on until the VM is running again | | [`azure-ptn-network-dnszone-records`](../../src/modules/azure-ptn-network-dnszone-records/) | A, AAAA, CAA, CNAME, MX, NS, PTR, SRV and TXT records in an existing public zone | | [`azure-ptn-network-privatednszone-records`](../../src/modules/azure-ptn-network-privatednszone-records/) | A, AAAA, CNAME, MX, PTR, SRV and TXT records in an existing private zone | | [`azure-ptn-network-privatednszone-vnet-links`](../../src/modules/azure-ptn-network-privatednszone-vnet-links/) | Virtual network links across many zones | diff --git a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf index 38b80b1..e4f8884 100644 --- a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf +++ b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf @@ -1,42 +1,23 @@ # ============================================================================= -# WINDOWS VM PRIMARY DNS SUFFIX + REBOOT +# WINDOWS VM PRIMARY DNS SUFFIX (Microsoft.Compute/virtualMachines/extensions) # ============================================================================= -# Sets the Windows *primary DNS suffix* via a CustomScriptExtension, then -# reboots, so the machine's own FQDN matches the public DNS name of its IP. -# Without it the guest FQDN stays the bare hostname, and anything that issues a -# ticket for the name you typed (Entra RDP being the motivating case) fails -# because the two names differ. -# -# The public IP and its DNS label are the CALLER's to create and attach - this -# module only touches the guest. provision_after_extensions holds the suffix -# step (and its reboot) until the named extensions finish, so it cannot land -# mid Entra-join. That is a stronger guarantee than depends_on, which only -# orders the ARM calls. +# Sets the guest primary DNS suffix via a CustomScriptExtension, then applies it +# with an ARM restart. The restart (not an in-guest `shutdown`) is deliberate: an +# in-guest reboot is invisible to ARM, so Terraform can't wait on it; azapi blocks +# on the restart LRO until the VM is running again. # ============================================================================= locals { - # Deferred so the extension reports success to Azure before the box goes down. - reboot_delay_seconds = 60 - - # Written to HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters - the - # same keys the Computer Name dialog writes. SyncDomainWithMembership=0 - # mirrors unticking "Change primary DNS suffix when domain membership - # changes". Idempotent: once the suffix is in place the script exits without - # rebooting. + # HKLM\...\Tcpip\Parameters - the keys the Computer Name dialog writes. The + # restart below applies them (the value is read at boot, however triggered). set_dns_suffix_script = <<-PS $ErrorActionPreference = 'Stop' $suffix = '${var.dns_suffix}' $key = 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' - $current = (Get-ItemProperty -Path $key -Name 'NV Domain' -ErrorAction SilentlyContinue).'NV Domain' - if ($current -eq $suffix) { - Write-Output "Primary DNS suffix already '$suffix' - nothing to do." - exit 0 - } Set-ItemProperty -Path $key -Name 'Domain' -Value $suffix -Type String Set-ItemProperty -Path $key -Name 'NV Domain' -Value $suffix -Type String Set-ItemProperty -Path $key -Name 'SyncDomainWithMembership' -Value 0 -Type DWord - Write-Output "Primary DNS suffix set to '$suffix' (was '$current'). Rebooting in ${local.reboot_delay_seconds}s." - shutdown /r /t ${local.reboot_delay_seconds} /c "Applying primary DNS suffix" + Write-Output "Primary DNS suffix set to '$suffix'. Reboot required to take effect." exit 0 PS } @@ -51,9 +32,34 @@ resource "azurerm_virtual_machine_extension" "dns_suffix" { provision_after_extensions = var.provision_after_extensions tags = var.tags - # No -ExecutionPolicy flag: execution policy governs script *files*, not the - # inline script that -EncodedCommand runs, so it would be a no-op here. + # -ExecutionPolicy is omitted: it governs script files, not the inline + # -EncodedCommand, so it would be a no-op here. settings = jsonencode({ commandToExecute = "powershell.exe -NoProfile -EncodedCommand ${textencodebase64(local.set_dns_suffix_script, "UTF-16LE")}" }) } + +# ----------------------------------------------------------------------------- +# Apply the suffix with an ARM restart (blocks until the VM is running again) +# ----------------------------------------------------------------------------- +# replace_triggered_by keys on .settings so the restart re-fires only when the +# suffix changes - not on tags/handler changes; the action is otherwise inert. + +resource "azapi_resource_action" "reboot" { + count = var.reboot ? 1 : 0 + + type = "Microsoft.Compute/virtualMachines@2024-07-01" + resource_id = var.virtual_machine_id + action = "restart" + method = "POST" + + timeouts { + create = "15m" + } + + lifecycle { + replace_triggered_by = [azurerm_virtual_machine_extension.dns_suffix.settings] + } + + depends_on = [azurerm_virtual_machine_extension.dns_suffix] +} diff --git a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf index c7c1feb..66bbd99 100644 --- a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf +++ b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf @@ -31,3 +31,10 @@ variable "tags" { default = {} nullable = false } + +variable "reboot" { + description = "Reboot the VM (via an ARM restart) after writing the suffix so it takes effect, and block the apply until the restart completes and the VM is running again. When it's false the module only writes the registry and the suffix stays inactive until the VM is rebooted by other means." + type = bool + default = true + nullable = false +} diff --git a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf index e457b4a..952ca6d 100644 --- a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf +++ b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf @@ -6,5 +6,9 @@ terraform { source = "hashicorp/azurerm" version = ">= 4.81, < 5.0" } + azapi = { + source = "Azure/azapi" + version = ">= 2.0, < 3.0" + } } } From 8d17a59e01dbca6e624d66356b06b3733774ef64 Mon Sep 17 00:00:00 2001 From: Irinel Bogdan Date: Mon, 10 Aug 2026 11:04:51 +0300 Subject: [PATCH 4/4] Use azapi to install extension --- .../main.tf | 56 ++++++++++++------- .../outputs.tf | 2 +- .../variables.tf | 8 +++ .../versions.tf | 7 +-- 4 files changed, 47 insertions(+), 26 deletions(-) diff --git a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf index e4f8884..1e0ba80 100644 --- a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf +++ b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/main.tf @@ -2,9 +2,12 @@ # WINDOWS VM PRIMARY DNS SUFFIX (Microsoft.Compute/virtualMachines/extensions) # ============================================================================= # Sets the guest primary DNS suffix via a CustomScriptExtension, then applies it -# with an ARM restart. The restart (not an in-guest `shutdown`) is deliberate: an -# in-guest reboot is invisible to ARM, so Terraform can't wait on it; azapi blocks -# on the restart LRO until the VM is running again. +# with an ARM restart. Both are azapi: the extension is an azapi_resource and the +# restart an azapi_resource_action, so the module depends only on azapi. +# +# The restart (not an in-guest `shutdown`) is deliberate: an in-guest reboot is +# invisible to ARM, so Terraform can't wait on it; azapi blocks on the restart +# LRO until the VM is running again. # ============================================================================= locals { @@ -20,30 +23,41 @@ locals { Write-Output "Primary DNS suffix set to '$suffix'. Reboot required to take effect." exit 0 PS -} - -resource "azurerm_virtual_machine_extension" "dns_suffix" { - name = "SetPrimaryDnsSuffix" - virtual_machine_id = var.virtual_machine_id - publisher = "Microsoft.Compute" - type = "CustomScriptExtension" - type_handler_version = "1.10" - auto_upgrade_minor_version = true - provision_after_extensions = var.provision_after_extensions - tags = var.tags # -ExecutionPolicy is omitted: it governs script files, not the inline # -EncodedCommand, so it would be a no-op here. - settings = jsonencode({ - commandToExecute = "powershell.exe -NoProfile -EncodedCommand ${textencodebase64(local.set_dns_suffix_script, "UTF-16LE")}" - }) + command_to_execute = "powershell.exe -NoProfile -EncodedCommand ${textencodebase64(local.set_dns_suffix_script, "UTF-16LE")}" +} + +resource "azapi_resource" "dns_suffix" { + type = "Microsoft.Compute/virtualMachines/extensions@2024-07-01" + name = "SetPrimaryDnsSuffix" + parent_id = var.virtual_machine_id + location = var.location + tags = var.tags + + # settings is a native object - azapi serializes the whole body to JSON, so no + # jsonencode() wrapper is needed around it. + body = { + properties = { + publisher = "Microsoft.Compute" + type = "CustomScriptExtension" + typeHandlerVersion = "1.10" + autoUpgradeMinorVersion = true + provisionAfterExtensions = var.provision_after_extensions + settings = { + commandToExecute = local.command_to_execute + } + } + } } # ----------------------------------------------------------------------------- # Apply the suffix with an ARM restart (blocks until the VM is running again) # ----------------------------------------------------------------------------- -# replace_triggered_by keys on .settings so the restart re-fires only when the -# suffix changes - not on tags/handler changes; the action is otherwise inert. +# replace_triggered_by keys on the extension's body, which carries the settings +# (and thus the suffix). It changes iff the script/suffix changes; tags are a +# separate top-level attribute, not part of body, so they don't re-fire it. resource "azapi_resource_action" "reboot" { count = var.reboot ? 1 : 0 @@ -58,8 +72,8 @@ resource "azapi_resource_action" "reboot" { } lifecycle { - replace_triggered_by = [azurerm_virtual_machine_extension.dns_suffix.settings] + replace_triggered_by = [azapi_resource.dns_suffix.body] } - depends_on = [azurerm_virtual_machine_extension.dns_suffix] + depends_on = [azapi_resource.dns_suffix] } diff --git a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/outputs.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/outputs.tf index 91fa395..e0052a6 100644 --- a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/outputs.tf +++ b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/outputs.tf @@ -1,4 +1,4 @@ output "extension_id" { description = "Resource ID of the CustomScriptExtension that sets the primary DNS suffix." - value = azurerm_virtual_machine_extension.dns_suffix.id + value = azapi_resource.dns_suffix.id } diff --git a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf index 66bbd99..a49d754 100644 --- a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf +++ b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/variables.tf @@ -8,6 +8,14 @@ variable "virtual_machine_id" { } } +# azapi does not infer the extension's location from the parent VM, so the +# caller must pass the VM's region. A VM extension is location-tracked and must +# sit in the same region as its VM, so this has to equal the VM's location. +variable "location" { + description = "Azure region of the target VM. A VM extension is a location-tracked resource and must match the VM's region (e.g. westeurope)." + type = string +} + variable "dns_suffix" { description = "Primary DNS suffix to write in-guest, e.g. westeurope.cloudapp.azure.com, so the machine's FQDN matches the public DNS name of its IP. Any lowercase DNS domain is accepted." type = string diff --git a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf index 952ca6d..95be4f0 100644 --- a/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf +++ b/src/modules/azure-ptn-compute-virtualmachine-windows-fqdn/versions.tf @@ -2,10 +2,9 @@ terraform { required_version = ">= 1.15" required_providers { - azurerm = { - source = "hashicorp/azurerm" - version = ">= 4.81, < 5.0" - } + # The extension is an azapi_resource and the reboot an azapi_resource_action, + # so this module speaks only azapi. The parent VM stays an azurerm resource + # in the CALLER - only its id and location are passed in as strings. azapi = { source = "Azure/azapi" version = ">= 2.0, < 3.0"