PowerShell module to support deploying into an existing virtual network

[philipstreet]

⚠️ Problem

The Microsoft documentation says you can create your own vnet & peering to use for a FinOps Hub (https://learn.microsoft.com/en-gb/cloud-computing/finops/toolkit/hubs/private-networking#finops-hub-virtual-network) but the toolkit does not appear to provide the ability to deploy/upgrade a FinOps Hub into an existing vnet. Have I missed something?

🛠️ Solution

Update Deploy-FinOpsHub command with additional parameters to allow the user to specify:

• the resource group & virtual network (or resourceID) to be used by the FinOps Hub.
• resourceIDs of Private DNS Zones to be linked to the Private Endpoints created on deployed resources.

ℹ️ Additional context

My company has strict controls on who/how virtual networks, peering & Private DNS Zones are created, so these cannot be performed by 3rd-party toolkits.

🙋‍♀️ Ask for the community

We could use your help:

1. Please vote this issue up (👍) to prioritize it.
2. Leave comments to help us solidify the vision.

[flanakin]

Brett Wilson (@MSBrett) FYI - I love this idea 🙂

[MSBrett]

Closing as not planned based on the FinOps hub network ownership boundary.

FinOps Toolkit must exclusively create and manage the hub virtual network, its three subnets, private DNS, routing, and related resources. Deploying the hub into a customer-owned VNet would make customer-specific network configuration and lifecycle behavior part of the Toolkit support contract.

PR #2270 documents the supported approach: keep the Toolkit-managed hub network isolated, create customer-managed private endpoints in the customer's own VNet as the preferred access topology, and use VNet peering only as a secondary option.