Quartz 5

Lab: IaC desired state and pipeline maintenance

Properties1
tagslab, az-400, iac, maintenance

4 min read

Lab: IaC desired state and pipeline maintenance

Outcome

Protect an IaC change with validation and preview, inspect a machine-configuration compliance result, create a governed on-demand environment only if your tenant permits it, and use pipeline data to make a retention and concurrency decision.

Before you begin

Use a disposable resource group. Azure Deployment Environments remains available but is in maintenance mode; do not choose it for new capabilities without checking its current service state. Azure Machine Configuration audits or configures operating-system settings as code; it does not replace ARM/Bicep provisioning.

Do

  1. Create an IaC repository with main.bicep, parameter files, and a pipeline that runs Bicep build/validation and az deployment group what-if against the training resource group. Require a pull request before deployment and use a protected environment for the apply stage.
  2. Deploy a small tagged resource. Change its tag manually in the portal, rerun what-if, and record the drift. Correct the source definition and redeploy; do not normalize drift with an undocumented portal edit.
  3. In a training VM or Arc-enabled machine, assign a built-in Azure Machine Configuration policy/assignment that you can safely inspect. Capture compliance. Change only the approved training setting to produce noncompliance, then restore it and wait for the reported state to recover. Do not invent a remediation path when the selected assignment audits only.
  4. If your organization has a Dev Center and permission, create an Azure Deployment Environments catalog with a Bicep main.bicep and environment.yaml. Sync the catalog, create a short-lived training environment, confirm project/environment-type governance, and configure automatic deletion. Otherwise, document this as a source-reviewed, unexecuted branch and keep the row covered rather than verified.
  5. From pipeline run history, calculate a seven-run baseline: failure count, median duration, queue time, and flaky-test count. Set a training threshold such as two failures in seven runs or queue time above five minutes. Compare a cold run with a dependency-cache run and record duration, not an assumed cost saving.
  6. Start two harmless queued runs. Record whether available parallel-job capacity or an agent capability causes queueing. Set the project retention policy for runs, artifacts, and test data; mark one training run retained indefinitely, then remove that mark after the review. Inventory a classic pipeline’s tasks, variables, approvals, schedules, artifacts, and retention before recreating each supported item in YAML. Classic release pipelines do not export to YAML as a whole.

Verify

Capture the pull-request what-if, protected apply, detected and corrected drift, Machine Configuration compliance before/after, ADE catalog/environment or explicit unexecuted-branch record, health table, queued-run evidence, retention setting, and Classic-to-YAML parity checklist.

Break and fix

  1. Remove a required Bicep parameter or introduce an invalid resource property. Confirm validation/what-if stops the apply, then restore the source.
  2. Change a training resource outside IaC. Diagnose the what-if difference and return it to declared state.
  3. Set a concurrency assumption that ignores agent capabilities. Diagnose whether the run waits for entitlement, a busy compatible agent, or no capable agent; correct the pool/demand or capacity plan.

Clean up

Delete the resource group, VM/Arc test assignment, ADE environment/catalog branch, training pipelines/runs/artifacts, and classic-pipeline copy if it was created only for migration rehearsal. Leave no indefinite-retention exception.

Scenario practice

  • Configure: Which responsibility belongs to Bicep/ARM provisioning, Terraform stateful multi-cloud deployment, and Machine Configuration guest settings?
  • Diagnose: A pipeline queue grows while agents appear online. What distinguishes parallel-job capacity exhaustion from an unmatched self-hosted capability demand?
  • Distinguish: Why is an ADE environment definition an on-demand environment template, not a substitute for a deployment pipeline or Machine Configuration assignment?

Sources and re-audit

Re-audit when Machine Configuration, ADE maintenance status, Azure Pipelines parallel-job/retention behavior, or Classic migration support changes.

bicep · azure-machine-configuration · azure-deployment-environments · pipeline-retention · All labs

Graph View

Backlinks