How to use Azure IPAM from deployment pipeline

[fajterini]

Hi All,

Can someone help me how to use this IPAM solution with landingzone deployment pipeline.
Just thinking loud before implementation :(

1.) Create new Vnet:
i will request vnet address space with API call to /api/spaces/$space/blocks/$block/reservations
I will receive response with IP range (cidr), (status : wait ) and tag : X-IPAM-RES-ID=hqXyBYkH6MH55X8cF4AV3p
then I create new Vnet with tag from this response.
This is working :)

2.) Rerun pipeline, same settings /24
how to verify vnet is created with correct settings ? I will need verify setting in IPAM with this API call
$requestUrlvNet = "https://$appName.azurewebsites.net/api/spaces/$space/blocks/$block/networks? Expand=true"
and compare this to current status in azure. If network is already created skip vnet creation ?

Permission needed ?
For reservations any valid user in tenant can create reservations ?
For get Vnet probably higher rights on Azure or IPAM are needed ? but If I would have enough rights on subscription this should work ?

[DCMattyG]

Hey @fajterini, thanks for starting a discussion around this!

Couple of items to help me answer this as well as I can....

1. Have you seen the example Bicep templates for ESLZ we have in the examples folder of this repo as of yet?
2. What type of pipeline are you using? Are we talking about ADO, GitHub Actions, something else perhaps?

Tagging @hbendana on this for visibility/input.

[fajterini]

Hi @DCMattyG

1.) Yes, and my question is based on this example the problem is if you would run the bicep deployment multiple times I expect it would allways use fetchAddressPrefix module to request new subnet and modify existing vnet with this value. But I haven't run the code but I expect this is what the code is doing.
2.) Azure Devops Yaml pipeline :)

We use Infrastracture as a code in this case each new landing zone have all resources set in parameters file. When changes to LZ are made this is done by code and new run of this pipeline. I our scenario when we start deployment we need to find address space for vnet in case of fist run IPAM create reservation, in case of rerun (we need to get the same subnet). But I thinkin if IPAM cannot give us this information we will run some powershell code to check if vnet is already create in this environment.

last question, how is lifecycle of IP registration defined ? If I would make multiple requests for Ip reservation use only one, will they be cleared and available after some time ?

Thanks :)

[JCuijon]

Hi All,

I have the same issue as described.

When creating the virtual network initially using bicep and Azure IPAM a reservation is made and consumed by the virtual network. So as expected.
When we rerun the deployment within an hour after deployment it runs without issue and this is because the deploymentScript resource still exists and bicep sees this and just skips it.

However if we rerun the deployment after that hour a new reservation is created but the code stops because it cannot be consumed by the (existing) virtual network and bicep throws an error.

Now a quick fix would be extending the deploymentScript retentionInterval property but that would leave an otherwise unused/sporadically used resource.
Is there a better way of solving this problem? Should we use the "networks" api endpoint to first check if the vnet exists in Azure IPAM?

Thanks in advance