chore: upgrade to azurerm 4.x (~> 4.20) - #11
Merged
Conversation
Phase 1 fleet upgrade. - terraform >= 1.10, azurerm ~> 4.20, azapi ~> 2.0, popsrox ~> 1.0 - versions.tf updated in root and all 4 examples - azurerm_subnet.private_endpoint_network_policies_enabled (bool) → private_endpoint_network_policies (string enum) per the 4.x schema - No retention_policy blocks on azurerm_monitor_diagnostic_setting in this overlay - No enable_https_traffic_only / allow_blob_public_access / enable_rbac_authorization usage - Bumped VERSION to 2.0.0 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 1 fleet upgrade —
azurerm3.x → 4.x.Provider constraints
terraform >= 1.10(was>= 1.9)azurerm ~> 4.20(was~> 3.116)azapi ~> 2.0(newly declared for fleet alignment)popsrox ~> 1.0(unchanged)Updated in root
versions.tfand every exampleversions.tf.Codemod applied
azurerm_subnet.private_endpoint_network_policies_enabled = true→azurerm_subnet.private_endpoint_network_policies = "Enabled"inresources.template.private.endpoints.tf. 4.x replaced the bool argumentwith a string enum (
Enabled/Disabled/NetworkSecurityGroupEnabled/RouteTableEnabled).Audited (no changes needed)
enable_https_traffic_only,allow_blob_public_access, orenable_rbac_authorizationusage anywhere in the module.azurerm_monitor_diagnostic_settingresources, so noretention_policyblock removals required.
azurerm_app_service/azurerm_app_service_planusage.Version
VERSIONset to2.0.0(new file). Major bump due to provider major andTerraform CLI floor raise.
Validation
terraform fmt -recursive -check -diff— clean.Success! The configuration is valid.againstazurerm v4.42.0,azapi v2.9.0,popsrox v1.0.9.examples/Commerical/completepulls interraform-az-overlays-storageaccountand
terraform-az-overlays-containerregistry(sibling Phase 1 PRs).Those still pin
azurerm ~> 3.116onmain, so the unioned constraintis unsatisfiable until they merge. HCL in this repo is correct; the example
will go green once siblings ship.
Consumer-facing breaking change
azurerm4.x requires an explicit subscription (ARM_SUBSCRIPTION_IDenv varor
subscription_idinprovider "azurerm"). Module repos don't declare aprovider block, so this is a consumer concern — but downstream callers need to
set it before upgrading.
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com