|
| 1 | + |
| 2 | +# Guidance on Applying Tags in Solution Templates |
| 3 | + |
| 4 | +## What are Tags in this context and why are they useful? |
| 5 | + |
| 6 | +Tags are arbitrary name=value pairs that can be associated with most Azure resources. Azure features such as Azure Policy can use Tags to enforce cloud governance policies. For more about tags, see [Use tags to organize your Azure resources and management hierarchy](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources). |
| 7 | + |
| 8 | +## Step 1: Audit Resources Created in the Offer |
| 9 | + |
| 10 | +To determine the resources that will be created in your offer, use the following commands based on the template type: |
| 11 | + |
| 12 | +### For ARM Templates: |
| 13 | +Use the command below to list resource types: |
| 14 | + |
| 15 | +```bash |
| 16 | +# Navigate to the offer folder |
| 17 | +cd offer-folder |
| 18 | +grep -rh "\"type\": \"Microsoft" --exclude="createUiDefinition.json" | sort | uniq | sed 's/^[ \t]*//' |
| 19 | +``` |
| 20 | + |
| 21 | +### For Bicep Templates: |
| 22 | +Use the command below to list resource types and remove duplicates: |
| 23 | + |
| 24 | +```bash |
| 25 | +# Navigate to the offer folder |
| 26 | +cd offer-folder |
| 27 | +grep -rh "^resource" | grep "Microsoft." | sort | uniq | sed 's/^[ \t]*//' |
| 28 | +``` |
| 29 | + |
| 30 | +Identify which resources support tags and which do not. For resources not listed below, consult the ARM definition at [Azure Resource Manager templates](https://learn.microsoft.com/en-us/azure/templates/) to determine if tagging is supported. If the definition does not include a tags property, the resource does not support tags and tagging is not required for deployments. |
| 31 | + |
| 32 | +### Resources that Support Tags: |
| 33 | + |
| 34 | +The top-level resources will be listed in the Tag UI control. Sub-resources will inherit the same tags as their parent resources. |
| 35 | + |
| 36 | +For example, in the UI definition, customers can specify tags for `Microsoft.KeyVault/vaults`, but not for `Microsoft.KeyVault/vaults/secrets`. For the deployment of `Microsoft.KeyVault/vaults/secrets`, the same tags applied to `Microsoft.KeyVault/vaults` will be used. This approach ensures a consistent tagging experience with Key Vault deployments in the Azure portal. |
| 37 | + |
| 38 | +- Microsoft.Network/dnszones |
| 39 | +- Microsoft.Network/networkInterfaces |
| 40 | +- Microsoft.Network/networkSecurityGroups |
| 41 | +- Microsoft.Network/publicIPAddresses |
| 42 | +- Microsoft.Network/privateEndpoints |
| 43 | +- Microsoft.Storage/storageAccounts |
| 44 | +- Microsoft.KeyVault/vaults |
| 45 | + - Microsoft.KeyVault/vaults/secrets |
| 46 | +- Microsoft.Network/virtualNetworks |
| 47 | +- Microsoft.Compute/virtualMachines |
| 48 | +- Microsoft.Compute/virtualMachines/extensions |
| 49 | +- Microsoft.Resources/deploymentScripts |
| 50 | +- Microsoft.ManagedIdentity/userAssignedIdentities |
| 51 | +- Microsoft.Resources/deployments |
| 52 | +- Microsoft.Network/applicationGateways |
| 53 | + |
| 54 | +### Resources that Do Not Support Tags: |
| 55 | + |
| 56 | +- Microsoft.Storage/storageAccounts/fileServices |
| 57 | +- Microsoft.Storage/storageAccounts/fileServices/shares |
| 58 | +- Microsoft.Network/networkSecurityGroups/securityRules |
| 59 | +- Microsoft.Network/dnsZones/A |
| 60 | +- Microsoft.Network/dnszones/CNAME |
| 61 | +- Microsoft.Network/virtualNetworks/subnets |
| 62 | +- Microsoft.Authorization/roleAssignments |
| 63 | +- Microsoft.Network/loadBalancers/backendAddressPools |
| 64 | +- Microsoft.Network/applicationGateways/backendHttpSettingsCollection |
| 65 | +- Microsoft.Network/applicationGateways/frontendIPConfigurations |
| 66 | +- Microsoft.Network/applicationGateways/frontendPorts |
| 67 | +- Microsoft.Network/applicationGateways/gatewayIPConfigurations |
| 68 | +- Microsoft.Network/applicationGateways/httpListeners |
| 69 | +- Microsoft.Network/applicationGateways/probes |
| 70 | +- Microsoft.Network/applicationGateways/requestRoutingRules |
| 71 | + |
| 72 | +## Step 2: Tag UI Control |
| 73 | + |
| 74 | +Incorporate the [Microsoft.Common.TagsByResource UI element](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/microsoft-common-tagsbyresource?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef0) to include resources that support tags. |
| 75 | + |
| 76 | +## Step 3: Update the Template |
| 77 | + |
| 78 | +Refer to this [pull request](https://github.com/oracle/weblogic-azure/pull/327/) as a guide for how to apply tags to the resource deployments. |
| 79 | + |
| 80 | +Notes: |
| 81 | + |
| 82 | +For AKS, make sure the tag is applied to agent pool and node pool. The whole structure looks like: |
| 83 | + |
| 84 | +```bicep |
| 85 | +resource symbolicname 'Microsoft.ContainerService/managedClusters@2024-06-02-preview' = { |
| 86 | + name: 'string' |
| 87 | + location: 'string' |
| 88 | + tags: { |
| 89 | + tagName1: 'tagValue1' |
| 90 | + tagName2: 'tagValue2' |
| 91 | + } |
| 92 | +
|
| 93 | + ... |
| 94 | +
|
| 95 | + agentPoolProfiles: { |
| 96 | +
|
| 97 | + ... |
| 98 | +
|
| 99 | + tags: { |
| 100 | + tagName1: 'tagValue1' |
| 101 | + tagName2: 'tagValue2' |
| 102 | + } |
| 103 | + } |
| 104 | +} |
| 105 | +
|
| 106 | +``` |
| 107 | + |
| 108 | +See [Microsoft.ContainerService managedClusters - Bicep](https://learn.microsoft.com/en-us/azure/templates/microsoft.containerservice/managedclusters?pivots=deployment-language-bicep) for more information. |
| 109 | + |
| 110 | +## Step 4: Testing |
| 111 | + |
| 112 | +1. **Create a Test Offer:** Set up a test offer to validate the tagging process. |
| 113 | + |
| 114 | +2. **Tag Settings:** |
| 115 | + - Apply a uniform tag to all resources. |
| 116 | + - Create specific tags for each resource, setting the tag value to the resource type (e.g., "tag1=storage account"). |
| 117 | + |
| 118 | +3. **Deploy the Offer:** |
| 119 | + |
| 120 | +4. **Verify Tags:** Use the following command to verify that the resources have the correct tags applied: |
| 121 | + |
| 122 | + ```bash |
| 123 | + az resource list --resource-group <resource-group-name> --query "[].{Name:name, Type:type, Tags:tags}" -o json |
| 124 | + ``` |
| 125 | + |
| 126 | + For example: |
| 127 | + |
| 128 | + ```shell |
| 129 | + az resource list --resource-group haiche-sn-tag-test --query "[].{Name:name, Type:type, Tags:tags}" -o json |
| 130 | + [ |
| 131 | + { |
| 132 | + "Name": "0733ecolvm", |
| 133 | + "Tags": { |
| 134 | + "Tag0": "All", |
| 135 | + "Tag6": "storage account" |
| 136 | + }, |
| 137 | + "Type": "Microsoft.Storage/storageAccounts" |
| 138 | + }, |
| 139 | + { |
| 140 | + "Name": "olvm_PublicIP", |
| 141 | + "Tags": { |
| 142 | + "Tag0": "All", |
| 143 | + "Tag4": "public ip address" |
| 144 | + }, |
| 145 | + "Type": "Microsoft.Network/publicIPAddresses" |
| 146 | + }, |
| 147 | + { |
| 148 | + "Name": "wls-nsg", |
| 149 | + "Tags": { |
| 150 | + "Tag0": "All", |
| 151 | + "Tag3": "network security group" |
| 152 | + }, |
| 153 | + "Type": "Microsoft.Network/networkSecurityGroups" |
| 154 | + }, |
| 155 | + { |
| 156 | + "Name": "olvm_VNET", |
| 157 | + "Tags": { |
| 158 | + "Tag0": "All", |
| 159 | + "Tag8": "virtual network" |
| 160 | + }, |
| 161 | + "Type": "Microsoft.Network/virtualNetworks" |
| 162 | + }, |
| 163 | + { |
| 164 | + "Name": "olvm_NIC", |
| 165 | + "Tags": { |
| 166 | + "Tag0": "All", |
| 167 | + "Tag2": "network interface" |
| 168 | + }, |
| 169 | + "Type": "Microsoft.Network/networkInterfaces" |
| 170 | + }, |
| 171 | + { |
| 172 | + "Name": "WeblogicServerVM", |
| 173 | + "Tags": { |
| 174 | + "Tag0": "All", |
| 175 | + "Tag7": "virtual machine" |
| 176 | + }, |
| 177 | + "Type": "Microsoft.Compute/virtualMachines" |
| 178 | + }, |
| 179 | + { |
| 180 | + "Name": "WeblogicServerVM_OsDisk_1_d1fed748ccaa4cac81df9179e6dff325", |
| 181 | + "Tags": { |
| 182 | + "Tag0": "All", |
| 183 | + "Tag7": "virtual machine" |
| 184 | + }, |
| 185 | + "Type": "Microsoft.Compute/disks" |
| 186 | + } |
| 187 | + ] |
| 188 | + ``` |
| 189 | + |
| 190 | +## Step 4: Known issues |
| 191 | + |
| 192 | +The tag is not applied to resources that are not deployed through our template, so we cannot apply tags to them from the template. |
| 193 | + |
| 194 | +Known resources: |
| 195 | + |
| 196 | +- Microsoft.Compute/virtualMachines/extensions |
| 197 | + - OmsAgentForLinux |
| 198 | + - MDE.Linux |
| 199 | +- Microsoft.AlertsManagement/prometheusRuleGroups |
| 200 | +- Microsoft.Insights/dataCollectionEndpoints |
| 201 | +- Microsoft.Insights/dataCollectionRules |
0 commit comments