Skip to content

Spoke Canvas Upgrade Guides (v2.9.x and v2.10.0)

The spoke canvas used to be a separate product with its own versions (Glossary). These two guides belong to that product, when its configuration lived in a common.tf file in the spoke configuration repository.

Where this setting lives today

In the current platform the same settings are part of mcp.json and the spoke JSON: shared services in SpokeCommon.shared_services, and PIM behavior per group in PIMGroupConfig (nopim, self-approve, approval). See mcp.json and the Spoke JSON reference. Use these guides only if you still run the older, separate spoke canvas. The settings in common.tf are explained in Spoke common settings.

Read them in order. Each guide is for the version pair in its title.

Spoke canvas 2.9.0 and 2.9.1

Version 2.9.0 removed the old IP address management (IPAM) configuration and added spoke extensions that use shared services. In common.tf:

  1. Remove the ipaminfo object, and from every region entry the IPAM values (ipamspace, ipamblockprd, ipamblocknonprd, and the related lines).

  2. Add a shared_services object. Use the same subscription ID as the virtualhubsubscriptionid in the networking object:

    shared_services = {
  subscription_id = "<hub subscription id>"
}

Spoke canvas 2.9.1 and 2.10.0

Version 2.10.0 makes the PIM behavior of the spoke groups configurable. In common.tf, add the object pim_configurations with three named profiles:

pim_configurations = {

  nopim = {
    assignment    = "active"
    activation    = null
    approvals     = null
    notifications = null
  }

  self-approve = {
    assignment = "eligible"
    activation = {
      maximum_duration      = "PT8H"
      require_justification = true
      require_approval      = false
      require_mfa           = false
    }
    approvals     = null
    notifications = null
  }

  approval = {
    assignment = "eligible"
    activation = {
      maximum_duration      = "PT8H"
      require_justification = true
      require_approval      = true
      require_mfa           = false
    }
    approvals     = null
    notifications = null
  }

}

The profiles mean: nopim gives an active membership, self-approve gives an eligible membership that the user activates without approval, and approval gives an eligible membership that needs approval. The values are the ones shipped with the version. Check them against your own access policy (for example whether MFA is required on activation) before you apply them (Access and PIM).

What the common.tf settings do

The older spoke canvas read one common.tf file with the settings that are valid for every spoke. The upgrade steps above change it. The groups of settings are described in the module reference. A change of the secret validity period in it creates new secrets for all spoke service principals, so plan such a change like a rotation.