CODEWITHSUNDEEP
azureazure-devopsazure-keyvaultazure-rm-template
Jan_V
Jan_V

Reputation: 4406

Linked ARM templates result in Invalid Template

Let's start with what I'm trying to accomplish.

What I'd like to do is create an ARM template where I'm retrieving secrets from the Azure Key Vault, without specifying too much details on the specific Key Vault. Sounds easy enough and probably something which is implemented in every production system.

Doing a quick search I discovered the syntax for such a thing is the following. 

"parameters": {
  "adminPassword": {
    "reference": {
      "keyVault": {
        "id": "[resourceId(subscription().subscriptionId,  parameters('vaultResourceGroup'), 'Microsoft.KeyVault/vaults', parameters('vaultName'))]"
      },
      "secretName": "[parameters('secretName')]"
    }
  },

From what I gather you need to add this in an external template as the used methods can't be used in the 'main' method.

So I started creating a 'main' ARM template and a new template called appservice.json which contains all of the stuff necessary for my App Service, including the appSettings block which need the secrets from Key Vault.

In my main template I've done the following, as described in the documentation.

{
      "apiVersion": "2017-05-10",
      "name": "linkedTemplate",
      "type": "Microsoft.Resources/deployments",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[uri(deployment().properties.templateLink.uri, 'appservice.json')]",
          "contentVersion": "1.0.0.0"
        },

However, when deploying I'm confronted with the following error.

"error": {
    "code": "InvalidTemplate",
    "message": "Unable to process template language expressions for resource '/subscriptions/ba49bae7-2b37-4504-914b-441763a2bcd3/resourceGroups/cfpexchange-jan-test/providers/Microsoft.Resources/deployments/linkedTemplate' at line '1' and column '1526'. 'The language expression property 'templateLink' doesn't exist, available properties are 'name, properties'.'"
  }

I also tried the following because I noticed IntelliSense in Visual Studio told me properties doesn't exits and I should use templateLink directly.

{
      "apiVersion": "2017-05-10",
      "name": "linkedTemplate",
      "type": "Microsoft.Resources/deployments",
      "properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[uri(deployment().templateLink.uri, 'appservice.json')]",
          "contentVersion": "1.0.0.0"
        },

This of course isn't right either.

   "error": {
    "code": "InvalidTemplate",
    "message": "Unable to process template language expressions for resource '/subscriptions/ba49bae7-2b37-4504-914b-441763a2bcd3/resourceGroups/cfpexchange-jan-test/providers/Microsoft.Resources/deployments/linkedTemplate' at line '1' and column '1526'. 'The language expression property 'templateLink' doesn't exist, available properties are 'name, properties'.'"
  }

And when using it as a variable, like in the documentation

"variables": {
    "sharedTemplateUrl": "[uri(deployment().properties.templateLink.uri, 'shared-resources.json')]"
  },
...
"properties": {
        "mode": "Incremental",
        "templateLink": {
          "uri": "[variables('sharedTemplateUrl')]",
          "contentVersion": "1.0.0.0"
        },

I'm also getting an error.

2018-07-04T19:14:34.4204720Z ##[error]Deployment template validation failed: 'The template variable 'sharedTemplateUrl' is not valid: The language expression property 'templateLink' doesn't exist, available properties are 'template, parameters, mode, debugSetting, provisioningState'.. Please see https://aka.ms/arm-template-expressions for usage details.'.

At this time I'm a bit lost. From what I understand from the documentation it appears I'm doing everything correct. Apparently I'm not. Any ideas on how to continue with this?

For completeness, the two actual files which I'm using at this time:

There have been multiple iterations on it in order to try and fix it, but as mentioned noting appeared to be working so far.

Upvotes: 1

Views: 2303

Answers (1)

4c74356b41
4c74356b41

Reputation: 72151

First of all, this is how you are supposed to use KV in a nested template. Example with Admin password:

"adminPassword": {
    "reference": {
        "keyVault": {
            "id": "kv_resource_id"
        },
        "secretName": "[concat('secret', copyindex(1))]"
    }
},

This section supposed to be in the nested template parameters WHEN you invoke it (just look at the example link).

Your error seems to be in the variable. So the templateLink property is only available when you deploy your main template from the url, if you use local file to deploy main template it wont work.

enter image description here

Compare this to remote template execution:

New-AzureRmResourceGroupDeployment -ResourceGroupName xxx -TemplateUri 'https://paste.ee/d/XI1Rc/0'

As this is a remote url, it should show you the same output, but this time with a templateLink property.

Name             Type                       Value
===============  =========================  ==========
test             Object                     {

"name": "theDeploymentName",
"properties": {
  "templateLink": {
    "uri": "theRemoteTemplateUri"
  },
  "template": {
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {},
    "variables": {},
    "resources": [],
    "outputs": {
      "test": {
        "type": "Object",
        "value": "[deployment()]"
      }
    }
  },
  "parameters": {},
  "mode": "Incremental",
  "provisioningState": "Accepted"
}
}

Upvotes: 1

Related Questions