Manage Azure infrastructure as code via ARM
formae.SecretValue so their values are hashed at rest end-to-end (previously stored in cleartext on the read/actual-state path). Covers Azure::Compute::VirtualMachine and Azure::Compute::VirtualMachineScaleSet adminPassword, Azure::DBforPostgreSQL::FlexibleServer and Azure::Sql::Server administratorLoginPassword, Azure::KeyVault::Secret value, and Azure::KubernetesConfiguration::FluxConfiguration accessKey. Requires a formae agent on the matching release; minFormaeVersion is bumped to 0.88.0.Network::ApplicationGateway — Application Gateway v2 (L7 load balancer / HTTPS
ingress): gateway/frontend IP configurations, frontend ports, backend address
pools, backend HTTP settings, health probes, HTTP listeners, request routing
rules, SSL certificates (inline PFX or a Key Vault secret reference), an optional
user-assigned managed identity, and a firewallPolicyId to attach a WAF policy.Network::ApplicationGatewayWebApplicationFirewallPolicy — WAF policy
(policySettings, managed OWASP rule sets, custom rules).KeyVault::Certificate. Data-plane certificate lifecycle (vaultUri-based, like
KeyVault::Secret): import a BYO PFX/PEM (data + password, write-only) or
issue a self-signed cert via a minimal policy (issuerName / subject / keyType
/ validityMonths). The resolvable exposes id, secretId, and thumbprint, so
secretId can be wired into an Application Gateway or Front Door listener.Network::DnsZone and Network::DnsRecordSet — public DNS. One polymorphic
record-set resource covers A / CNAME / TXT via recordType.Microsoft.Cdn): Cdn::Profile,
Cdn::AFDEndpoint, Cdn::AFDOriginGroup, Cdn::AFDOrigin, Cdn::Route,
Cdn::AFDCustomDomain, and Cdn::Secret (BYO Key Vault TLS certificate).Microsoft.App): App::ManagedEnvironment and
App::ContainerApp (ingress, containers, scale; secrets are write-only).StatusMessage, so a retrying resource reports why it failed instead of a
bare error code.cdn-*) lane. cdn-route is excluded pending
a formae-core resolve-cache fix; certificate, cdn-afd-custom-domain,
cdn-secret, managed-environment, and container-app are excluded because
they need a real certificate/domain/data-plane role or are too slow to provision
in CI — all covered by mocked integration + marshaller round-trip tests and a
manual live gate.negationConditon default, Front Door provider-defaulted optional fields, Front
Door's canonical location ("Global"), and the Application Gateway
managed-identity type casing (userAssigned → UserAssigned) no longer
reconcile as phantom updates.CognitiveServices::Account, Compute::VirtualMachineExtension,
Dashboard::Grafana, Dashboard::GrafanaManagedPrivateEndpoint,
EventGrid::SystemTopic, EventHub::Namespace, Network::RouteTable, and
ServiceBus::Namespace.Compute::VirtualMachine now serializes SSH public keys on Read, and its OS /
configuration fields are marked create-only, so changing an immutable field
plans a replace instead of an update the provider would reject.KeyVault::Secret. Manage a secret inside an existing Key Vault, parented to a
KeyVault::Vault through its vaultUri. The secret value is write-only and
uses formae's opaque values, so it is masked in diffs and stored as a hash
rather than in cleartext: formae.value(x).opaque rotates the secret in place
when its value changes, while formae.value(x).opaque.setOnce seeds the secret
once and leaves it untouched on later edits to that value. Requires formae
0.86.2 or later, so an unchanged secret is not re-written when other fields on
the same resource change.Sql::Server, Sql::Database, Sql::FirewallRule, and
Sql::ServerAzureADAdministrator. Provision a logical SQL server together with
its databases, firewall rules, and Azure AD administrator from a single forma.ManagedCluster now exposes
oidcIssuerUrl and UserAssignedIdentity exposes tenantId through their
resolvables, and FederatedIdentityCredential.issuer accepts a resolvable.
Together these let you create an AKS cluster, a user-assigned identity, and the
federated credential linking them in one forma.Authorization::RoleAssignment,
Compute::VirtualMachine, ContainerService::ManagedCluster,
ContainerService::TrustedAccessRoleBinding,
KubernetesConfiguration::Extension, and
KubernetesConfiguration::FluxConfiguration are now marked create-only, so
changing them plans a replace instead of attempting an update the provider
would reject. Requires formae 0.86.0 or later.Network::LoadBalancer,
Network::PrivateEndpoint, Network::PrivateDnsZone,
Network::PrivateDnsZoneVirtualNetworkLink, Network::PrivateDnsZoneGroup,
Compute::Disk, Compute::VirtualMachineScaleSet, Storage::BlobContainer,
and ManagedIdentity::FederatedIdentityCredential. Enables provisioning
private-endpoint-fronted services (private DNS zones linked to VNets, app-side
private endpoints) and scaled compute backed by managed disks.AZURE:: instead of Azure::
(e.g. AZURE::Network::VirtualNetwork,
AZURE::ContainerService::ManagedCluster). Aligns with the casing used by the
AWS, GCP, and OCI plugins. CLI filters or queries that reference Azure resource
types by string need updating; resources already in inventory under the old
casing should be re-discovered after upgrade.MaintenanceConfiguration, Extension,
FluxConfiguration, and TrustedAccessRoleBinding can now be managed
alongside ManagedCluster. Use these for AKS maintenance windows, Kubernetes
extensions (Flux, Dapr, Azure ML), GitOps Flux v2 configuration, and granting
Azure services access to an AKS cluster.ManagedCluster now exposes kubeConfig and the cluster CA certificate
through its res resolvable. This lets you provision an AKS cluster and deploy
Kubernetes workloads onto it from the same forma without a manual kubeconfig
step, the same pattern as EKS auth via resolvables.