Deploy Azure Hybrid Network Functions

The azure-native:hybridnetwork:NetworkFunction resource, part of the Pulumi Azure Native provider, deploys network functions by linking published definitions to target infrastructure. This guide focuses on three capabilities: containerized and VM-based deployments, open vs secret configuration, and infrastructure type targeting.

Network functions reference published definitions from vendors and target existing infrastructure like Azure Arc custom locations, resource groups, or Operator Nexus clusters. The examples are intentionally small. Combine them with your own network function definitions and infrastructure.

Deploy a network function with open configuration

Most deployments start by referencing a published network function definition and targeting specific infrastructure like Azure Arc Kubernetes.

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const networkFunction = new azure_native.hybridnetwork.NetworkFunction("networkFunction", {
    location: "eastus",
    networkFunctionName: "testNf",
    properties: {
        allowSoftwareUpdate: false,
        configurationType: "Open",
        deploymentValues: "{\"releaseName\":\"testReleaseName\",\"namespace\":\"testNamespace\"}",
        networkFunctionDefinitionVersionResourceReference: {
            id: "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
            idType: "Open",
        },
        nfviId: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation",
        nfviType: azure_native.hybridnetwork.NFVIType.AzureArcKubernetes,
        roleOverrideValues: [
            "{\"name\":\"testRoleOne\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"helmPackageVersion\":\"2.1.3\",\"values\":\"{\\\"roleOneParam\\\":\\\"roleOneOverrideValue\\\"}\"}}}",
            "{\"name\":\"testRoleTwo\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"releaseName\":\"overrideReleaseName\",\"releaseNamespace\":\"overrideNamespace\",\"values\":\"{\\\"roleTwoParam\\\":\\\"roleTwoOverrideValue\\\"}\"}}}",
        ],
    },
    resourceGroupName: "rg",
});

import pulumi
import pulumi_azure_native as azure_native

network_function = azure_native.hybridnetwork.NetworkFunction("networkFunction",
    location="eastus",
    network_function_name="testNf",
    properties={
        "allow_software_update": False,
        "configuration_type": "Open",
        "deployment_values": "{\"releaseName\":\"testReleaseName\",\"namespace\":\"testNamespace\"}",
        "network_function_definition_version_resource_reference": {
            "id": "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
            "id_type": "Open",
        },
        "nfvi_id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation",
        "nfvi_type": azure_native.hybridnetwork.NFVIType.AZURE_ARC_KUBERNETES,
        "role_override_values": [
            "{\"name\":\"testRoleOne\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"helmPackageVersion\":\"2.1.3\",\"values\":\"{\\\"roleOneParam\\\":\\\"roleOneOverrideValue\\\"}\"}}}",
            "{\"name\":\"testRoleTwo\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"releaseName\":\"overrideReleaseName\",\"releaseNamespace\":\"overrideNamespace\",\"values\":\"{\\\"roleTwoParam\\\":\\\"roleTwoOverrideValue\\\"}\"}}}",
        ],
    },
    resource_group_name="rg")

package main

import (
	hybridnetwork "github.com/pulumi/pulumi-azure-native-sdk/hybridnetwork/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := hybridnetwork.NewNetworkFunction(ctx, "networkFunction", &hybridnetwork.NetworkFunctionArgs{
			Location:            pulumi.String("eastus"),
			NetworkFunctionName: pulumi.String("testNf"),
			Properties: &hybridnetwork.NetworkFunctionValueWithoutSecretsArgs{
				AllowSoftwareUpdate: pulumi.Bool(false),
				ConfigurationType:   pulumi.String("Open"),
				DeploymentValues:    pulumi.String("{\"releaseName\":\"testReleaseName\",\"namespace\":\"testNamespace\"}"),
				NetworkFunctionDefinitionVersionResourceReference: hybridnetwork.OpenDeploymentResourceReference{
					Id:     "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
					IdType: "Open",
				},
				NfviId:   pulumi.String("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation"),
				NfviType: pulumi.String(hybridnetwork.NFVITypeAzureArcKubernetes),
				RoleOverrideValues: pulumi.StringArray{
					pulumi.String("{\"name\":\"testRoleOne\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"helmPackageVersion\":\"2.1.3\",\"values\":\"{\\\"roleOneParam\\\":\\\"roleOneOverrideValue\\\"}\"}}}"),
					pulumi.String("{\"name\":\"testRoleTwo\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"releaseName\":\"overrideReleaseName\",\"releaseNamespace\":\"overrideNamespace\",\"values\":\"{\\\"roleTwoParam\\\":\\\"roleTwoOverrideValue\\\"}\"}}}"),
				},
			},
			ResourceGroupName: pulumi.String("rg"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var networkFunction = new AzureNative.HybridNetwork.NetworkFunction("networkFunction", new()
    {
        Location = "eastus",
        NetworkFunctionName = "testNf",
        Properties = new AzureNative.HybridNetwork.Inputs.NetworkFunctionValueWithoutSecretsArgs
        {
            AllowSoftwareUpdate = false,
            ConfigurationType = "Open",
            DeploymentValues = "{\"releaseName\":\"testReleaseName\",\"namespace\":\"testNamespace\"}",
            NetworkFunctionDefinitionVersionResourceReference = new AzureNative.HybridNetwork.Inputs.OpenDeploymentResourceReferenceArgs
            {
                Id = "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
                IdType = "Open",
            },
            NfviId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation",
            NfviType = AzureNative.HybridNetwork.NFVIType.AzureArcKubernetes,
            RoleOverrideValues = new[]
            {
                "{\"name\":\"testRoleOne\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"helmPackageVersion\":\"2.1.3\",\"values\":\"{\\\"roleOneParam\\\":\\\"roleOneOverrideValue\\\"}\"}}}",
                "{\"name\":\"testRoleTwo\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"releaseName\":\"overrideReleaseName\",\"releaseNamespace\":\"overrideNamespace\",\"values\":\"{\\\"roleTwoParam\\\":\\\"roleTwoOverrideValue\\\"}\"}}}",
            },
        },
        ResourceGroupName = "rg",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.hybridnetwork.NetworkFunction;
import com.pulumi.azurenative.hybridnetwork.NetworkFunctionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var networkFunction = new NetworkFunction("networkFunction", NetworkFunctionArgs.builder()
            .location("eastus")
            .networkFunctionName("testNf")
            .properties(NetworkFunctionValueWithoutSecretsArgs.builder()
                .allowSoftwareUpdate(false)
                .configurationType("Open")
                .deploymentValues("{\"releaseName\":\"testReleaseName\",\"namespace\":\"testNamespace\"}")
                .networkFunctionDefinitionVersionResourceReference(OpenDeploymentResourceReferenceArgs.builder()
                    .id("/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1")
                    .idType("Open")
                    .build())
                .nfviId("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation")
                .nfviType("AzureArcKubernetes")
                .roleOverrideValues(                
                    "{\"name\":\"testRoleOne\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"helmPackageVersion\":\"2.1.3\",\"values\":\"{\\\"roleOneParam\\\":\\\"roleOneOverrideValue\\\"}\"}}}",
                    "{\"name\":\"testRoleTwo\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"releaseName\":\"overrideReleaseName\",\"releaseNamespace\":\"overrideNamespace\",\"values\":\"{\\\"roleTwoParam\\\":\\\"roleTwoOverrideValue\\\"}\"}}}")
                .build())
            .resourceGroupName("rg")
            .build());

    }
}

resources:
  networkFunction:
    type: azure-native:hybridnetwork:NetworkFunction
    properties:
      location: eastus
      networkFunctionName: testNf
      properties:
        allowSoftwareUpdate: false
        configurationType: Open
        deploymentValues: '{"releaseName":"testReleaseName","namespace":"testNamespace"}'
        networkFunctionDefinitionVersionResourceReference:
          id: /subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1
          idType: Open
        nfviId: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation
        nfviType: AzureArcKubernetes
        roleOverrideValues:
          - '{"name":"testRoleOne","deployParametersMappingRuleProfile":{"helmMappingRuleProfile":{"helmPackageVersion":"2.1.3","values":"{\"roleOneParam\":\"roleOneOverrideValue\"}"}}}'
          - '{"name":"testRoleTwo","deployParametersMappingRuleProfile":{"helmMappingRuleProfile":{"releaseName":"overrideReleaseName","releaseNamespace":"overrideNamespace","values":"{\"roleTwoParam\":\"roleTwoOverrideValue\"}"}}}'
      resourceGroupName: rg

The networkFunctionDefinitionVersionResourceReference points to a published definition version that describes what to deploy. The nfviType specifies the infrastructure type (AzureArcKubernetes, AzureCore, or AzureOperatorNexus), while nfviId identifies the target location. The deploymentValues property contains JSON configuration for Helm release names and namespaces. The roleOverrideValues array lets you customize individual roles within the network function, overriding Helm package versions or deployment parameters.

Deploy with secret configuration values

When network functions require passwords or API keys, the secret configuration type encrypts these values.

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const networkFunction = new azure_native.hybridnetwork.NetworkFunction("networkFunction", {
    location: "eastus",
    networkFunctionName: "testNf",
    properties: {
        allowSoftwareUpdate: false,
        configurationType: "Secret",
        networkFunctionDefinitionVersionResourceReference: {
            id: "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
            idType: "Open",
        },
        nfviId: "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation",
        nfviType: azure_native.hybridnetwork.NFVIType.AzureArcKubernetes,
        roleOverrideValues: [
            "{\"name\":\"testRoleOne\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"helmPackageVersion\":\"2.1.3\",\"values\":\"{\\\"roleOneParam\\\":\\\"roleOneOverrideValue\\\"}\"}}}",
            "{\"name\":\"testRoleTwo\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"releaseName\":\"overrideReleaseName\",\"releaseNamespace\":\"overrideNamespace\",\"values\":\"{\\\"roleTwoParam\\\":\\\"roleTwoOverrideValue\\\"}\"}}}",
        ],
        secretDeploymentValues: "{\"adminPassword\":\"password1\",\"userPassword\":\"password2\"}",
    },
    resourceGroupName: "rg",
});

import pulumi
import pulumi_azure_native as azure_native

network_function = azure_native.hybridnetwork.NetworkFunction("networkFunction",
    location="eastus",
    network_function_name="testNf",
    properties={
        "allow_software_update": False,
        "configuration_type": "Secret",
        "network_function_definition_version_resource_reference": {
            "id": "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
            "id_type": "Open",
        },
        "nfvi_id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation",
        "nfvi_type": azure_native.hybridnetwork.NFVIType.AZURE_ARC_KUBERNETES,
        "role_override_values": [
            "{\"name\":\"testRoleOne\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"helmPackageVersion\":\"2.1.3\",\"values\":\"{\\\"roleOneParam\\\":\\\"roleOneOverrideValue\\\"}\"}}}",
            "{\"name\":\"testRoleTwo\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"releaseName\":\"overrideReleaseName\",\"releaseNamespace\":\"overrideNamespace\",\"values\":\"{\\\"roleTwoParam\\\":\\\"roleTwoOverrideValue\\\"}\"}}}",
        ],
        "secret_deployment_values": "{\"adminPassword\":\"password1\",\"userPassword\":\"password2\"}",
    },
    resource_group_name="rg")

package main

import (
	hybridnetwork "github.com/pulumi/pulumi-azure-native-sdk/hybridnetwork/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := hybridnetwork.NewNetworkFunction(ctx, "networkFunction", &hybridnetwork.NetworkFunctionArgs{
			Location:            pulumi.String("eastus"),
			NetworkFunctionName: pulumi.String("testNf"),
			Properties: &hybridnetwork.NetworkFunctionValueWithSecretsArgs{
				AllowSoftwareUpdate: pulumi.Bool(false),
				ConfigurationType:   pulumi.String("Secret"),
				NetworkFunctionDefinitionVersionResourceReference: hybridnetwork.OpenDeploymentResourceReference{
					Id:     "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
					IdType: "Open",
				},
				NfviId:   pulumi.String("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation"),
				NfviType: pulumi.String(hybridnetwork.NFVITypeAzureArcKubernetes),
				RoleOverrideValues: pulumi.StringArray{
					pulumi.String("{\"name\":\"testRoleOne\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"helmPackageVersion\":\"2.1.3\",\"values\":\"{\\\"roleOneParam\\\":\\\"roleOneOverrideValue\\\"}\"}}}"),
					pulumi.String("{\"name\":\"testRoleTwo\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"releaseName\":\"overrideReleaseName\",\"releaseNamespace\":\"overrideNamespace\",\"values\":\"{\\\"roleTwoParam\\\":\\\"roleTwoOverrideValue\\\"}\"}}}"),
				},
				SecretDeploymentValues: pulumi.String("{\"adminPassword\":\"password1\",\"userPassword\":\"password2\"}"),
			},
			ResourceGroupName: pulumi.String("rg"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var networkFunction = new AzureNative.HybridNetwork.NetworkFunction("networkFunction", new()
    {
        Location = "eastus",
        NetworkFunctionName = "testNf",
        Properties = new AzureNative.HybridNetwork.Inputs.NetworkFunctionValueWithSecretsArgs
        {
            AllowSoftwareUpdate = false,
            ConfigurationType = "Secret",
            NetworkFunctionDefinitionVersionResourceReference = new AzureNative.HybridNetwork.Inputs.OpenDeploymentResourceReferenceArgs
            {
                Id = "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
                IdType = "Open",
            },
            NfviId = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation",
            NfviType = AzureNative.HybridNetwork.NFVIType.AzureArcKubernetes,
            RoleOverrideValues = new[]
            {
                "{\"name\":\"testRoleOne\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"helmPackageVersion\":\"2.1.3\",\"values\":\"{\\\"roleOneParam\\\":\\\"roleOneOverrideValue\\\"}\"}}}",
                "{\"name\":\"testRoleTwo\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"releaseName\":\"overrideReleaseName\",\"releaseNamespace\":\"overrideNamespace\",\"values\":\"{\\\"roleTwoParam\\\":\\\"roleTwoOverrideValue\\\"}\"}}}",
            },
            SecretDeploymentValues = "{\"adminPassword\":\"password1\",\"userPassword\":\"password2\"}",
        },
        ResourceGroupName = "rg",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.hybridnetwork.NetworkFunction;
import com.pulumi.azurenative.hybridnetwork.NetworkFunctionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var networkFunction = new NetworkFunction("networkFunction", NetworkFunctionArgs.builder()
            .location("eastus")
            .networkFunctionName("testNf")
            .properties(NetworkFunctionValueWithSecretsArgs.builder()
                .allowSoftwareUpdate(false)
                .configurationType("Secret")
                .networkFunctionDefinitionVersionResourceReference(OpenDeploymentResourceReferenceArgs.builder()
                    .id("/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1")
                    .idType("Open")
                    .build())
                .nfviId("/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation")
                .nfviType("AzureArcKubernetes")
                .roleOverrideValues(                
                    "{\"name\":\"testRoleOne\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"helmPackageVersion\":\"2.1.3\",\"values\":\"{\\\"roleOneParam\\\":\\\"roleOneOverrideValue\\\"}\"}}}",
                    "{\"name\":\"testRoleTwo\",\"deployParametersMappingRuleProfile\":{\"helmMappingRuleProfile\":{\"releaseName\":\"overrideReleaseName\",\"releaseNamespace\":\"overrideNamespace\",\"values\":\"{\\\"roleTwoParam\\\":\\\"roleTwoOverrideValue\\\"}\"}}}")
                .secretDeploymentValues("{\"adminPassword\":\"password1\",\"userPassword\":\"password2\"}")
                .build())
            .resourceGroupName("rg")
            .build());

    }
}

resources:
  networkFunction:
    type: azure-native:hybridnetwork:NetworkFunction
    properties:
      location: eastus
      networkFunctionName: testNf
      properties:
        allowSoftwareUpdate: false
        configurationType: Secret
        networkFunctionDefinitionVersionResourceReference:
          id: /subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1
          idType: Open
        nfviId: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation
        nfviType: AzureArcKubernetes
        roleOverrideValues:
          - '{"name":"testRoleOne","deployParametersMappingRuleProfile":{"helmMappingRuleProfile":{"helmPackageVersion":"2.1.3","values":"{\"roleOneParam\":\"roleOneOverrideValue\"}"}}}'
          - '{"name":"testRoleTwo","deployParametersMappingRuleProfile":{"helmMappingRuleProfile":{"releaseName":"overrideReleaseName","releaseNamespace":"overrideNamespace","values":"{\"roleTwoParam\":\"roleTwoOverrideValue\"}"}}}'
        secretDeploymentValues: '{"adminPassword":"password1","userPassword":"password2"}'
      resourceGroupName: rg

Setting configurationType to “Secret” enables the secretDeploymentValues property, which accepts JSON containing sensitive configuration like passwords. These values are encrypted and hidden from logs. The rest of the configuration mirrors open deployments, but sensitive data flows through the secret channel rather than the visible deploymentValues property.

Deploy a virtual machine network function on AzureCore

Virtual network functions run as VMs rather than containers, targeting Azure’s core infrastructure.

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const networkFunction = new azure_native.hybridnetwork.NetworkFunction("networkFunction", {
    location: "eastus",
    networkFunctionName: "testNf",
    properties: {
        allowSoftwareUpdate: false,
        configurationType: "Open",
        deploymentValues: "{\"virtualMachineName\":\"test-VM\",\"cpuCores\":4,\"memorySizeGB\":8,\"cloudServicesNetworkAttachment\":{\"attachedNetworkId\":\"test-csnet\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-cs-vlan\"},\"networkAttachments\":[{\"attachedNetworkId\":\"test-l3vlan\",\"defaultGateway\":\"True\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-vlan\"}],\"sshPublicKeys\":[{\"keyData\":\"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ==\"}],\"storageProfile\":{\"osDisk\":{\"createOption\":\"Ephemeral\",\"deleteOption\":\"Delete\",\"diskSizeGB\":10}},\"userData\":\"testUserData\",\"adminUsername\":\"testUser\",\"virtioInterface\":\"Transitional\",\"isolateEmulatorThread\":\"False\",\"bootMethod\":\"BIOS\",\"placementHints\":[]}",
        networkFunctionDefinitionVersionResourceReference: {
            id: "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
            idType: "Open",
        },
        nfviId: "/subscriptions/subid/resourceGroups/testResourceGroup",
        nfviType: azure_native.hybridnetwork.NFVIType.AzureCore,
    },
    resourceGroupName: "rg",
});

import pulumi
import pulumi_azure_native as azure_native

network_function = azure_native.hybridnetwork.NetworkFunction("networkFunction",
    location="eastus",
    network_function_name="testNf",
    properties={
        "allow_software_update": False,
        "configuration_type": "Open",
        "deployment_values": "{\"virtualMachineName\":\"test-VM\",\"cpuCores\":4,\"memorySizeGB\":8,\"cloudServicesNetworkAttachment\":{\"attachedNetworkId\":\"test-csnet\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-cs-vlan\"},\"networkAttachments\":[{\"attachedNetworkId\":\"test-l3vlan\",\"defaultGateway\":\"True\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-vlan\"}],\"sshPublicKeys\":[{\"keyData\":\"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ==\"}],\"storageProfile\":{\"osDisk\":{\"createOption\":\"Ephemeral\",\"deleteOption\":\"Delete\",\"diskSizeGB\":10}},\"userData\":\"testUserData\",\"adminUsername\":\"testUser\",\"virtioInterface\":\"Transitional\",\"isolateEmulatorThread\":\"False\",\"bootMethod\":\"BIOS\",\"placementHints\":[]}",
        "network_function_definition_version_resource_reference": {
            "id": "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
            "id_type": "Open",
        },
        "nfvi_id": "/subscriptions/subid/resourceGroups/testResourceGroup",
        "nfvi_type": azure_native.hybridnetwork.NFVIType.AZURE_CORE,
    },
    resource_group_name="rg")

package main

import (
	hybridnetwork "github.com/pulumi/pulumi-azure-native-sdk/hybridnetwork/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := hybridnetwork.NewNetworkFunction(ctx, "networkFunction", &hybridnetwork.NetworkFunctionArgs{
			Location:            pulumi.String("eastus"),
			NetworkFunctionName: pulumi.String("testNf"),
			Properties: &hybridnetwork.NetworkFunctionValueWithoutSecretsArgs{
				AllowSoftwareUpdate: pulumi.Bool(false),
				ConfigurationType:   pulumi.String("Open"),
				DeploymentValues:    pulumi.String("{\"virtualMachineName\":\"test-VM\",\"cpuCores\":4,\"memorySizeGB\":8,\"cloudServicesNetworkAttachment\":{\"attachedNetworkId\":\"test-csnet\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-cs-vlan\"},\"networkAttachments\":[{\"attachedNetworkId\":\"test-l3vlan\",\"defaultGateway\":\"True\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-vlan\"}],\"sshPublicKeys\":[{\"keyData\":\"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ==\"}],\"storageProfile\":{\"osDisk\":{\"createOption\":\"Ephemeral\",\"deleteOption\":\"Delete\",\"diskSizeGB\":10}},\"userData\":\"testUserData\",\"adminUsername\":\"testUser\",\"virtioInterface\":\"Transitional\",\"isolateEmulatorThread\":\"False\",\"bootMethod\":\"BIOS\",\"placementHints\":[]}"),
				NetworkFunctionDefinitionVersionResourceReference: hybridnetwork.OpenDeploymentResourceReference{
					Id:     "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
					IdType: "Open",
				},
				NfviId:   pulumi.String("/subscriptions/subid/resourceGroups/testResourceGroup"),
				NfviType: pulumi.String(hybridnetwork.NFVITypeAzureCore),
			},
			ResourceGroupName: pulumi.String("rg"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var networkFunction = new AzureNative.HybridNetwork.NetworkFunction("networkFunction", new()
    {
        Location = "eastus",
        NetworkFunctionName = "testNf",
        Properties = new AzureNative.HybridNetwork.Inputs.NetworkFunctionValueWithoutSecretsArgs
        {
            AllowSoftwareUpdate = false,
            ConfigurationType = "Open",
            DeploymentValues = "{\"virtualMachineName\":\"test-VM\",\"cpuCores\":4,\"memorySizeGB\":8,\"cloudServicesNetworkAttachment\":{\"attachedNetworkId\":\"test-csnet\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-cs-vlan\"},\"networkAttachments\":[{\"attachedNetworkId\":\"test-l3vlan\",\"defaultGateway\":\"True\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-vlan\"}],\"sshPublicKeys\":[{\"keyData\":\"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ==\"}],\"storageProfile\":{\"osDisk\":{\"createOption\":\"Ephemeral\",\"deleteOption\":\"Delete\",\"diskSizeGB\":10}},\"userData\":\"testUserData\",\"adminUsername\":\"testUser\",\"virtioInterface\":\"Transitional\",\"isolateEmulatorThread\":\"False\",\"bootMethod\":\"BIOS\",\"placementHints\":[]}",
            NetworkFunctionDefinitionVersionResourceReference = new AzureNative.HybridNetwork.Inputs.OpenDeploymentResourceReferenceArgs
            {
                Id = "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
                IdType = "Open",
            },
            NfviId = "/subscriptions/subid/resourceGroups/testResourceGroup",
            NfviType = AzureNative.HybridNetwork.NFVIType.AzureCore,
        },
        ResourceGroupName = "rg",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.hybridnetwork.NetworkFunction;
import com.pulumi.azurenative.hybridnetwork.NetworkFunctionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var networkFunction = new NetworkFunction("networkFunction", NetworkFunctionArgs.builder()
            .location("eastus")
            .networkFunctionName("testNf")
            .properties(NetworkFunctionValueWithoutSecretsArgs.builder()
                .allowSoftwareUpdate(false)
                .configurationType("Open")
                .deploymentValues("{\"virtualMachineName\":\"test-VM\",\"cpuCores\":4,\"memorySizeGB\":8,\"cloudServicesNetworkAttachment\":{\"attachedNetworkId\":\"test-csnet\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-cs-vlan\"},\"networkAttachments\":[{\"attachedNetworkId\":\"test-l3vlan\",\"defaultGateway\":\"True\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-vlan\"}],\"sshPublicKeys\":[{\"keyData\":\"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ==\"}],\"storageProfile\":{\"osDisk\":{\"createOption\":\"Ephemeral\",\"deleteOption\":\"Delete\",\"diskSizeGB\":10}},\"userData\":\"testUserData\",\"adminUsername\":\"testUser\",\"virtioInterface\":\"Transitional\",\"isolateEmulatorThread\":\"False\",\"bootMethod\":\"BIOS\",\"placementHints\":[]}")
                .networkFunctionDefinitionVersionResourceReference(OpenDeploymentResourceReferenceArgs.builder()
                    .id("/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1")
                    .idType("Open")
                    .build())
                .nfviId("/subscriptions/subid/resourceGroups/testResourceGroup")
                .nfviType("AzureCore")
                .build())
            .resourceGroupName("rg")
            .build());

    }
}

resources:
  networkFunction:
    type: azure-native:hybridnetwork:NetworkFunction
    properties:
      location: eastus
      networkFunctionName: testNf
      properties:
        allowSoftwareUpdate: false
        configurationType: Open
        deploymentValues: '{"virtualMachineName":"test-VM","cpuCores":4,"memorySizeGB":8,"cloudServicesNetworkAttachment":{"attachedNetworkId":"test-csnet","ipAllocationMethod":"Dynamic","networkAttachmentName":"test-cs-vlan"},"networkAttachments":[{"attachedNetworkId":"test-l3vlan","defaultGateway":"True","ipAllocationMethod":"Dynamic","networkAttachmentName":"test-vlan"}],"sshPublicKeys":[{"keyData":"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ=="}],"storageProfile":{"osDisk":{"createOption":"Ephemeral","deleteOption":"Delete","diskSizeGB":10}},"userData":"testUserData","adminUsername":"testUser","virtioInterface":"Transitional","isolateEmulatorThread":"False","bootMethod":"BIOS","placementHints":[]}'
        networkFunctionDefinitionVersionResourceReference:
          id: /subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1
          idType: Open
        nfviId: /subscriptions/subid/resourceGroups/testResourceGroup
        nfviType: AzureCore
      resourceGroupName: rg

When nfviType is set to AzureCore, the deploymentValues JSON contains VM-specific configuration: virtualMachineName, cpuCores, memorySizeGB, and networkAttachments. The cloudServicesNetworkAttachment defines management network connectivity, while the networkAttachments array specifies data plane VLANs. The storageProfile configures the OS disk, and sshPublicKeys enables SSH access. The nfviId references a resource group rather than a custom location.

Deploy to Azure Operator Nexus infrastructure

Azure Operator Nexus provides telco-grade infrastructure for network functions requiring carrier-class reliability.

import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

const networkFunction = new azure_native.hybridnetwork.NetworkFunction("networkFunction", {
    location: "eastus",
    networkFunctionName: "testNf",
    properties: {
        allowSoftwareUpdate: false,
        configurationType: "Open",
        deploymentValues: "{\"virtualMachineName\":\"test-VM\",\"extendedLocationName\":\"test-cluster\",\"cpuCores\":4,\"memorySizeGB\":8,\"cloudServicesNetworkAttachment\":{\"attachedNetworkId\":\"test-csnet\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-cs-vlan\"},\"networkAttachments\":[{\"attachedNetworkId\":\"test-l3vlan\",\"defaultGateway\":\"True\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-vlan\"}],\"sshPublicKeys\":[{\"keyData\":\"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ==\"}],\"storageProfile\":{\"osDisk\":{\"createOption\":\"Ephemeral\",\"deleteOption\":\"Delete\",\"diskSizeGB\":10}},\"userData\":\"testUserData\",\"adminUsername\":\"testUser\",\"virtioInterface\":\"Transitional\",\"isolateEmulatorThread\":\"False\",\"bootMethod\":\"BIOS\",\"placementHints\":[]}",
        networkFunctionDefinitionVersionResourceReference: {
            id: "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
            idType: "Open",
        },
        nfviId: "/subscriptions/subid/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation",
        nfviType: azure_native.hybridnetwork.NFVIType.AzureOperatorNexus,
    },
    resourceGroupName: "rg",
});

import pulumi
import pulumi_azure_native as azure_native

network_function = azure_native.hybridnetwork.NetworkFunction("networkFunction",
    location="eastus",
    network_function_name="testNf",
    properties={
        "allow_software_update": False,
        "configuration_type": "Open",
        "deployment_values": "{\"virtualMachineName\":\"test-VM\",\"extendedLocationName\":\"test-cluster\",\"cpuCores\":4,\"memorySizeGB\":8,\"cloudServicesNetworkAttachment\":{\"attachedNetworkId\":\"test-csnet\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-cs-vlan\"},\"networkAttachments\":[{\"attachedNetworkId\":\"test-l3vlan\",\"defaultGateway\":\"True\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-vlan\"}],\"sshPublicKeys\":[{\"keyData\":\"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ==\"}],\"storageProfile\":{\"osDisk\":{\"createOption\":\"Ephemeral\",\"deleteOption\":\"Delete\",\"diskSizeGB\":10}},\"userData\":\"testUserData\",\"adminUsername\":\"testUser\",\"virtioInterface\":\"Transitional\",\"isolateEmulatorThread\":\"False\",\"bootMethod\":\"BIOS\",\"placementHints\":[]}",
        "network_function_definition_version_resource_reference": {
            "id": "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
            "id_type": "Open",
        },
        "nfvi_id": "/subscriptions/subid/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation",
        "nfvi_type": azure_native.hybridnetwork.NFVIType.AZURE_OPERATOR_NEXUS,
    },
    resource_group_name="rg")

package main

import (
	hybridnetwork "github.com/pulumi/pulumi-azure-native-sdk/hybridnetwork/v3"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := hybridnetwork.NewNetworkFunction(ctx, "networkFunction", &hybridnetwork.NetworkFunctionArgs{
			Location:            pulumi.String("eastus"),
			NetworkFunctionName: pulumi.String("testNf"),
			Properties: &hybridnetwork.NetworkFunctionValueWithoutSecretsArgs{
				AllowSoftwareUpdate: pulumi.Bool(false),
				ConfigurationType:   pulumi.String("Open"),
				DeploymentValues:    pulumi.String("{\"virtualMachineName\":\"test-VM\",\"extendedLocationName\":\"test-cluster\",\"cpuCores\":4,\"memorySizeGB\":8,\"cloudServicesNetworkAttachment\":{\"attachedNetworkId\":\"test-csnet\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-cs-vlan\"},\"networkAttachments\":[{\"attachedNetworkId\":\"test-l3vlan\",\"defaultGateway\":\"True\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-vlan\"}],\"sshPublicKeys\":[{\"keyData\":\"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ==\"}],\"storageProfile\":{\"osDisk\":{\"createOption\":\"Ephemeral\",\"deleteOption\":\"Delete\",\"diskSizeGB\":10}},\"userData\":\"testUserData\",\"adminUsername\":\"testUser\",\"virtioInterface\":\"Transitional\",\"isolateEmulatorThread\":\"False\",\"bootMethod\":\"BIOS\",\"placementHints\":[]}"),
				NetworkFunctionDefinitionVersionResourceReference: hybridnetwork.OpenDeploymentResourceReference{
					Id:     "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
					IdType: "Open",
				},
				NfviId:   pulumi.String("/subscriptions/subid/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation"),
				NfviType: pulumi.String(hybridnetwork.NFVITypeAzureOperatorNexus),
			},
			ResourceGroupName: pulumi.String("rg"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;

return await Deployment.RunAsync(() => 
{
    var networkFunction = new AzureNative.HybridNetwork.NetworkFunction("networkFunction", new()
    {
        Location = "eastus",
        NetworkFunctionName = "testNf",
        Properties = new AzureNative.HybridNetwork.Inputs.NetworkFunctionValueWithoutSecretsArgs
        {
            AllowSoftwareUpdate = false,
            ConfigurationType = "Open",
            DeploymentValues = "{\"virtualMachineName\":\"test-VM\",\"extendedLocationName\":\"test-cluster\",\"cpuCores\":4,\"memorySizeGB\":8,\"cloudServicesNetworkAttachment\":{\"attachedNetworkId\":\"test-csnet\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-cs-vlan\"},\"networkAttachments\":[{\"attachedNetworkId\":\"test-l3vlan\",\"defaultGateway\":\"True\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-vlan\"}],\"sshPublicKeys\":[{\"keyData\":\"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ==\"}],\"storageProfile\":{\"osDisk\":{\"createOption\":\"Ephemeral\",\"deleteOption\":\"Delete\",\"diskSizeGB\":10}},\"userData\":\"testUserData\",\"adminUsername\":\"testUser\",\"virtioInterface\":\"Transitional\",\"isolateEmulatorThread\":\"False\",\"bootMethod\":\"BIOS\",\"placementHints\":[]}",
            NetworkFunctionDefinitionVersionResourceReference = new AzureNative.HybridNetwork.Inputs.OpenDeploymentResourceReferenceArgs
            {
                Id = "/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1",
                IdType = "Open",
            },
            NfviId = "/subscriptions/subid/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation",
            NfviType = AzureNative.HybridNetwork.NFVIType.AzureOperatorNexus,
        },
        ResourceGroupName = "rg",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.hybridnetwork.NetworkFunction;
import com.pulumi.azurenative.hybridnetwork.NetworkFunctionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var networkFunction = new NetworkFunction("networkFunction", NetworkFunctionArgs.builder()
            .location("eastus")
            .networkFunctionName("testNf")
            .properties(NetworkFunctionValueWithoutSecretsArgs.builder()
                .allowSoftwareUpdate(false)
                .configurationType("Open")
                .deploymentValues("{\"virtualMachineName\":\"test-VM\",\"extendedLocationName\":\"test-cluster\",\"cpuCores\":4,\"memorySizeGB\":8,\"cloudServicesNetworkAttachment\":{\"attachedNetworkId\":\"test-csnet\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-cs-vlan\"},\"networkAttachments\":[{\"attachedNetworkId\":\"test-l3vlan\",\"defaultGateway\":\"True\",\"ipAllocationMethod\":\"Dynamic\",\"networkAttachmentName\":\"test-vlan\"}],\"sshPublicKeys\":[{\"keyData\":\"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ==\"}],\"storageProfile\":{\"osDisk\":{\"createOption\":\"Ephemeral\",\"deleteOption\":\"Delete\",\"diskSizeGB\":10}},\"userData\":\"testUserData\",\"adminUsername\":\"testUser\",\"virtioInterface\":\"Transitional\",\"isolateEmulatorThread\":\"False\",\"bootMethod\":\"BIOS\",\"placementHints\":[]}")
                .networkFunctionDefinitionVersionResourceReference(OpenDeploymentResourceReferenceArgs.builder()
                    .id("/subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1")
                    .idType("Open")
                    .build())
                .nfviId("/subscriptions/subid/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation")
                .nfviType("AzureOperatorNexus")
                .build())
            .resourceGroupName("rg")
            .build());

    }
}

resources:
  networkFunction:
    type: azure-native:hybridnetwork:NetworkFunction
    properties:
      location: eastus
      networkFunctionName: testNf
      properties:
        allowSoftwareUpdate: false
        configurationType: Open
        deploymentValues: '{"virtualMachineName":"test-VM","extendedLocationName":"test-cluster","cpuCores":4,"memorySizeGB":8,"cloudServicesNetworkAttachment":{"attachedNetworkId":"test-csnet","ipAllocationMethod":"Dynamic","networkAttachmentName":"test-cs-vlan"},"networkAttachments":[{"attachedNetworkId":"test-l3vlan","defaultGateway":"True","ipAllocationMethod":"Dynamic","networkAttachmentName":"test-vlan"}],"sshPublicKeys":[{"keyData":"ssh-rsa CMIIIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0TqlveKKlc2MFvEmuXJiLGBsY1t4ML4uiRADGSZlnc+7Ugv3h+MCjkkwOKiOdsNo8k4KSBIG5GcQfKYOOd17AJvqCL6cGQbaLuqv0a64jeDm8oO8/xN/IM0oKw7rMr/2oAJOgIsfeXPkRxWWic9AVIS++H5Qi2r7bUFX+cqFsyUCAwEBBQ=="}],"storageProfile":{"osDisk":{"createOption":"Ephemeral","deleteOption":"Delete","diskSizeGB":10}},"userData":"testUserData","adminUsername":"testUser","virtioInterface":"Transitional","isolateEmulatorThread":"False","bootMethod":"BIOS","placementHints":[]}'
        networkFunctionDefinitionVersionResourceReference:
          id: /subscriptions/subid/resourcegroups/rg/providers/Microsoft.HybridNetwork/publishers/testVendor/networkFunctionDefinitionGroups/testnetworkFunctionDefinitionGroupName/networkFunctionDefinitionVersions/1.0.1
          idType: Open
        nfviId: /subscriptions/subid/resourceGroups/testResourceGroup/providers/Microsoft.ExtendedLocation/customLocations/testCustomLocation
        nfviType: AzureOperatorNexus
      resourceGroupName: rg

Setting nfviType to AzureOperatorNexus targets Operator Nexus clusters. The deploymentValues include an extendedLocationName that identifies the specific cluster. The VM configuration is similar to AzureCore, but the nfviId references an Operator Nexus custom location. This infrastructure type provides telco-specific features like enhanced isolation and performance guarantees.

Beyond these examples

These snippets focus on specific network function features: containerized and VM-based deployments, open and secret configuration types, and infrastructure targeting. They’re intentionally minimal rather than full network service deployments.

The examples reference pre-existing infrastructure such as network function definition versions (published by vendors), Azure Arc custom locations or resource groups, and network attachments and VLANs. They focus on configuring the network function rather than provisioning the underlying infrastructure.

To keep things focused, common network function patterns are omitted, including:

Software update controls (allowSoftwareUpdate)
Managed identity configuration
Resource tagging and metadata
Import scenarios for existing network functions

These omissions are intentional: the goal is to illustrate how each network function feature is wired, not provide drop-in telco modules. See the NetworkFunction resource reference for all available configuration options.

Let's deploy Azure Hybrid Network Functions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Configuration & Deployment

What's the difference between Open and Secret configuration types?

The configurationType determines how deployment values are handled. Use "Open" for non-sensitive configurations with deploymentValues, or "Secret" for sensitive data requiring secretDeploymentValues (like passwords). The idType in networkFunctionDefinitionVersionResourceReference must match your configurationType.

How do I provide sensitive deployment values like passwords?

Set configurationType to "Secret" and use secretDeploymentValues with a JSON string containing sensitive data (e.g., {"adminPassword":"password1","userPassword":"password2"}).

What format should deployment values use?

Both deploymentValues and secretDeploymentValues accept JSON strings. For Kubernetes deployments, include releaseName and namespace. For virtual machines, include virtualMachineName, cpuCores, memorySizeGB, and network attachments.

How do I override Helm values for specific roles?

Use roleOverrideValues as an array of JSON strings. Each entry specifies a role name and deployParametersMappingRuleProfile with helmMappingRuleProfile containing helmPackageVersion, releaseName, releaseNamespace, and values.

Infrastructure Types

Which NFVI type should I use for my deployment?

Choose based on your infrastructure:

AzureArcKubernetes for Azure Arc-enabled Kubernetes clusters (requires customLocations resource)
AzureCore for Azure native deployments (uses resource group as nfviId)
AzureOperatorNexus for Operator Nexus clusters (requires customLocations with extendedLocationName)

How do I deploy to Azure Arc Kubernetes?

Set nfviType to "AzureArcKubernetes" and provide nfviId pointing to a Microsoft.ExtendedLocation/customLocations resource. Use deploymentValues with Helm configuration including releaseName and namespace.

Resource Management

What properties can't I change after creating the network function?

The following properties are immutable: location, networkFunctionName, and resourceGroupName. You must recreate the resource to change these values.

How do I access different API versions like 2022-01-01-preview?

Run pulumi package add azure-native hybridnetwork [ApiVersion] to generate a local SDK package for specific API versions (2022-01-01-preview or 2023-09-01 are available).

What's the relationship between network function definition version and idType?

The idType in networkFunctionDefinitionVersionResourceReference must match your configurationType. Use "Open" for open configurations or "Secret" for first-party resources with secrets.

Using a different cloud?

Explore networking guides for other cloud providers:

AWS Guides GCP Guides