search

hashicorp / terraform-provider-azurerm

Terraform provider for Azure Resource Manager
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs
Mozilla Public License 2.0
4.61k stars 4.65k forks source link

azurerm_virtual_network_peering issue with vnet #24297

Open shankar-bala opened 11 months ago

shankar-bala commented 11 months ago

Is there an existing issue for this?

Community Note

Terraform Version

1.2.2

AzureRM Provider Version

3.69.0

Affected Resource(s)/Data Source(s)

azurerm_virtual_network_peering

Terraform Configuration Files

# RESOURCE GROUP #
resource "azurerm_resource_group" "test" {
  name     = "${var.user_name}-${var.prefix}"
  location = var.location
  tags = {
    RunStatus = "NOSTOP"
    NOSTOP_REASON = "Autoscale_automation"
    NOSTOP_EXPECTED_END_DATE  = "12/31/2020"
    StoreStatus = "DND"
    Office = "HQ"
    UserID = var.user_name
    CreateDate = timestamp()
  }
}

# VIRTUAL NET #
resource "azurerm_virtual_network" "hubVnet1" {
  name                = "hubVnet1-${var.user_name}-${var.prefix}"
  address_space       = ["10.0.0.0/16"]
  location            = var.location
  resource_group_name = azurerm_resource_group.test.name
}

# VIRTUAL NET #
resource "azurerm_virtual_network" "Spoke1vnet" {
  name                = "Spoke1vnet-${var.user_name}-${var.prefix}"
  address_space       = ["10.2.0.0/16"]
  location            = var.location
  resource_group_name = azurerm_resource_group.test.name
}

# VIRTUAL NET #
resource "azurerm_virtual_network" "Spoke2vnet" {
  name                = "Spoke2vnet-${var.user_name}-${var.prefix}"
  address_space       = ["10.3.0.0/16"]
  location            = var.location
  resource_group_name = azurerm_resource_group.test.name
}

# VIRTUAL NET FOR INBOUND #
resource "azurerm_virtual_network" "Spoke3vnet" {
  name                = "Spoke3vnet-${var.user_name}-${var.prefix}"
  address_space       = ["10.4.0.0/16"]
  location            = var.location
  resource_group_name = azurerm_resource_group.test.name
}

# VIRTUAL NET FOR NON-RFC #
resource "azurerm_virtual_network" "non-rfc-vnet" {
  count               = var.non_rfc ? 1 : 0
  name                = "non-rfc-vnet-${var.user_name}-${var.prefix}"
  address_space       = ["30.0.0.0/16"]
  location            = var.location
  resource_group_name = azurerm_resource_group.test.name
}

resource "azurerm_subnet" "subnet1" {
  name                 = "subnet1-hubVnet1-${var.user_name}-${var.prefix}"
  resource_group_name  = azurerm_resource_group.test.name
  virtual_network_name = azurerm_virtual_network.hubVnet1.name
  address_prefixes      = ["10.0.0.0/24"]
  delegation {
    name = "subnet1"
    service_delegation {
      name = "PaloAltoNetworks.Cloudngfw/firewalls"
      actions = [
        "Microsoft.Network/virtualNetworks/subnets/join/action",
      ]
    }
  }
}

# SUBNETS #
resource "azurerm_subnet" "subnet2" {
  name                 = "subnet2-hubVnet1-${var.user_name}-${var.prefix}"
  resource_group_name  = azurerm_resource_group.test.name
  virtual_network_name = azurerm_virtual_network.hubVnet1.name
  address_prefixes      = ["10.0.1.0/24"]
  delegation {
    name = "subnet2"
    service_delegation {
      name = "PaloAltoNetworks.Cloudngfw/firewalls"
      actions = [
        "Microsoft.Network/virtualNetworks/subnets/join/action",
      ]
    }
  }
}

resource "azurerm_subnet" "spoke1" {
  name                 = "spoke1-Spoke1vnet-${var.user_name}-${var.prefix}"
  resource_group_name  = azurerm_resource_group.test.name
  virtual_network_name = azurerm_virtual_network.Spoke1vnet.name
  address_prefixes      = ["10.2.0.0/24"]
}

resource "azurerm_subnet" "spoke2" {
  name                 = "spoke2-Spoke2vnet-${var.user_name}-${var.prefix}"
  resource_group_name  = azurerm_resource_group.test.name
  virtual_network_name = azurerm_virtual_network.Spoke2vnet.name
  address_prefixes      = ["10.3.0.0/24"]
}

resource "azurerm_subnet" "spoke3" {
  name                 = "spoke3-Spoke3vnet-${var.user_name}-${var.prefix}"
  resource_group_name  = azurerm_resource_group.test.name
  virtual_network_name = azurerm_virtual_network.Spoke3vnet.name
  address_prefixes      = ["10.4.0.0/24"]
}

resource "azurerm_subnet" "non-rfc" {
  count               = var.non_rfc ? 1 : 0
  name                 = "non-rfc-subnet-${var.user_name}-${var.prefix}"
  resource_group_name  = azurerm_resource_group.test.name
  virtual_network_name = azurerm_virtual_network.non-rfc-vnet[count.index].name
  address_prefixes      = ["30.0.0.0/24"]
}

# PUBLIC IPs #
resource "azurerm_public_ip" "Spoke1PublicIP" {
  count               = var.traffic_instances_per_spoke_vnet
  name                = "Spoke1PublicIP-${var.user_name}-${var.prefix}-${count.index}"
  location            = var.location
  resource_group_name = azurerm_resource_group.test.name
  allocation_method   = "Static"
  domain_name_label   = "spoke1publicip-${var.user_name}-${var.prefix}-${count.index}"
}

# PUBLIC IPs #
resource "azurerm_public_ip" "Spoke2PublicIP" {
  count               = var.traffic_instances_per_spoke_vnet
  name                = "Spoke2PublicIP-${var.user_name}-${var.prefix}-${count.index}"
  location            = var.location
  resource_group_name = azurerm_resource_group.test.name
  allocation_method   = "Static"
  domain_name_label   = "spoke2publicip-${var.user_name}-${var.prefix}-${count.index}"
}

# PUBLIC IPs #
resource "azurerm_public_ip" "Spoke3PublicIP" {
  count               = 1
  name                = "Spoke3PublicIP-${var.user_name}-${var.prefix}-${count.index}"
  location            = var.location
  resource_group_name = azurerm_resource_group.test.name
  allocation_method   = "Static"
  domain_name_label   = "spoke3publicip-${var.user_name}-${var.prefix}-${count.index}"
}

# PUBLIC IPs #
resource "azurerm_public_ip" "non-rfc-PublicIP" {
  count               = var.non_rfc ? 1 : 0
  name                = "non-rfc-PublicIP-${var.user_name}-${var.prefix}-${count.index}"
  location            = var.location
  resource_group_name = azurerm_resource_group.test.name
  allocation_method   = "Static"
  domain_name_label   = "non-rfc-publicip-${var.user_name}-${var.prefix}-${count.index}"
}

# PUBLIC IPs #
resource "azurerm_public_ip" "publicip" {
  count               = var.hub_public_ip_count
  name                = "publicip-${var.user_name}-${var.prefix}-${count.index}"
  location            = var.location
  resource_group_name = azurerm_resource_group.test.name
  allocation_method   = "Static"
  sku                 = "Standard"
  domain_name_label   = "publicip-${var.user_name}-${var.prefix}-${count.index}"
}

# Create INTERFACES #
resource "azurerm_network_interface" "Spoke1StandardNic" {
  count                     = var.traffic_instances_per_spoke_vnet
  name                      = "Spoke1StandardNic-${var.user_name}-${var.prefix}-${count.index}"
  location                  = var.location
  resource_group_name       = azurerm_resource_group.test.name
  depends_on = [
    azurerm_virtual_network.Spoke1vnet,
    azurerm_public_ip.Spoke1PublicIP,
  ]
  ip_configuration {
    name                          = "ipConfig1-${var.user_name}-${var.prefix}-${count.index}"
    subnet_id                     = azurerm_subnet.spoke1.id
    private_ip_address_allocation = "Dynamic"
    #private_ip_address            = "10.2.0.4"
    public_ip_address_id          = azurerm_public_ip.Spoke1PublicIP[count.index].id
  }
}

# Create INTERFACES #
resource "azurerm_network_interface" "Spoke2StandardNic" {
  count                     = var.traffic_instances_per_spoke_vnet
  name                      = "Spoke2StandardNic-${var.user_name}-${var.prefix}-${count.index}"
  location                  = var.location
  resource_group_name       = azurerm_resource_group.test.name
  depends_on = [
    azurerm_virtual_network.Spoke2vnet,
    azurerm_public_ip.Spoke2PublicIP,
  ]
  ip_configuration {
    name                          = "ipConfig2-${var.user_name}-${var.prefix}-${count.index}"
    subnet_id                     = azurerm_subnet.spoke2.id
    private_ip_address_allocation = "Dynamic"
    #private_ip_address           = "10.3.0.4"
    public_ip_address_id          = azurerm_public_ip.Spoke2PublicIP[count.index].id
  }
}

# Create INTERFACES #
resource "azurerm_network_interface" "Spoke3StandardNic" {
  count                     = 1
  name                      = "Spoke3StandardNic-${var.user_name}-${var.prefix}-${count.index}"
  location                  = var.location
  resource_group_name       = azurerm_resource_group.test.name
  depends_on = [
    azurerm_virtual_network.Spoke3vnet,
    azurerm_public_ip.Spoke3PublicIP,
  ]
  ip_configuration {
    name                          = "ipConfig3-${var.user_name}-${var.prefix}-${count.index}"
    subnet_id                     = azurerm_subnet.spoke3.id
    private_ip_address_allocation = "Dynamic"
    #private_ip_address           = "10.4.0.4"
    public_ip_address_id          = azurerm_public_ip.Spoke3PublicIP[count.index].id
  }
}

# Create INTERFACES #
resource "azurerm_network_interface" "NonRFCNic" {
  count                     = var.non_rfc ? 1 : 0
  name                      = "NonRFCNic-${var.user_name}-${var.prefix}-${count.index}"
  location                  = var.location
  resource_group_name       = azurerm_resource_group.test.name
  depends_on = [
    azurerm_virtual_network.non-rfc-vnet,
    azurerm_public_ip.non-rfc-PublicIP,
  ]
  ip_configuration {
    name                          = "nonrfcipConfig-${var.user_name}-${var.prefix}-${count.index}"
    subnet_id                     = azurerm_subnet.non-rfc[count.index].id
    private_ip_address_allocation = "Dynamic"
    #private_ip_address           = "10.4.0.4"
    public_ip_address_id          = azurerm_public_ip.non-rfc-PublicIP[count.index].id
  }
}

resource "azurerm_subnet_network_security_group_association" "spoke1" {
  subnet_id                 = azurerm_subnet.spoke1.id
  network_security_group_id = azurerm_network_security_group.nsg1.id
}

resource "azurerm_subnet_network_security_group_association" "spoke2" {
  subnet_id                 = azurerm_subnet.spoke2.id
  network_security_group_id = azurerm_network_security_group.nsg1.id
}

resource "azurerm_subnet_network_security_group_association" "spoke3" {
  subnet_id                 = azurerm_subnet.spoke3.id
  network_security_group_id = azurerm_network_security_group.nsg1.id
}

resource "azurerm_subnet_network_security_group_association" "non-rfc" {
  count                     = var.non_rfc ? 1 : 0
  subnet_id                 = azurerm_subnet.non-rfc[count.index].id
  network_security_group_id = azurerm_network_security_group.nsg1.id
}

resource "azurerm_subnet_network_security_group_association" "hub_trust" {
  subnet_id                 = azurerm_subnet.subnet2.id
  network_security_group_id = azurerm_network_security_group.hub_trust_nsg.id
}

resource "azurerm_subnet_network_security_group_association" "hub_untrust" {
  subnet_id                 = azurerm_subnet.subnet1.id
  network_security_group_id = azurerm_network_security_group.hub_untrust_nsg.id
}

resource "azurerm_route_table" "hub-trust-rtb" {
  name                          = "hub-trust-rtb-${var.user_name}-${var.prefix}"
  location                      = azurerm_resource_group.test.location
  resource_group_name           = azurerm_resource_group.test.name
  disable_bgp_route_propagation = false
  tags = {
    environment = "Production"
  }
}

resource "azurerm_subnet_route_table_association" "hub-trust-rtb" {
  subnet_id      = azurerm_subnet.subnet2.id
  route_table_id = azurerm_route_table.hub-trust-rtb.id
}

resource "azurerm_route_table" "spoke1-rtb" {
  name                          = "spoke1-rtb-${var.user_name}-${var.prefix}"
  location                      = azurerm_resource_group.test.location
  resource_group_name           = azurerm_resource_group.test.name
  disable_bgp_route_propagation = false
  tags = {
    environment = "Production"
  }
}

resource "azurerm_subnet_route_table_association" "spoke1-rtb" {
  subnet_id      = azurerm_subnet.spoke1.id
  route_table_id = azurerm_route_table.spoke1-rtb.id
}

resource "azurerm_route_table" "spoke2-rtb" {
  name                          = "spoke2-rtb-${var.user_name}-${var.prefix}"
  location                      = azurerm_resource_group.test.location
  resource_group_name           = azurerm_resource_group.test.name
  disable_bgp_route_propagation = false
  tags = {
    environment = "Production"
  }
}
resource "azurerm_subnet_route_table_association" "spoke2-rtb" {
  subnet_id      = azurerm_subnet.spoke2.id
  route_table_id = azurerm_route_table.spoke2-rtb.id
}

resource "azurerm_route_table" "spoke3-rtb" {
  name                          = "spoke3-rtb-${var.user_name}-${var.prefix}"
  location                      = azurerm_resource_group.test.location
  resource_group_name           = azurerm_resource_group.test.name
  disable_bgp_route_propagation = false
  tags = {
    environment = "Production"
  }
}
resource "azurerm_subnet_route_table_association" "spoke3-rtb" {
  subnet_id      = azurerm_subnet.spoke3.id
  route_table_id = azurerm_route_table.spoke3-rtb.id
}

resource "azurerm_route_table" "non-rfc-rtb" {
  count                         = var.non_rfc ? 1 : 0
  name                          = "non-rfc-rtb-${var.user_name}-${var.prefix}"
  location                      = azurerm_resource_group.test.location
  resource_group_name           = azurerm_resource_group.test.name
  disable_bgp_route_propagation = false
  tags = {
    environment = "Production"
  }
}
resource "azurerm_subnet_route_table_association" "non-rfc-rtb" {
  count          = var.non_rfc ? 1 : 0
  subnet_id      = azurerm_subnet.non-rfc[count.index].id
  route_table_id = azurerm_route_table.non-rfc-rtb[count.index].id
}

# Azure Virtual Network peering between Virtual Network Hub and Spoke1
resource "azurerm_virtual_network_peering" "Hub_to_spoke1" {
  name                         = "peer-vnet-Hub-with-spoke1-${var.user_name}-${var.prefix}"
  resource_group_name          = azurerm_resource_group.test.name
  virtual_network_name         = azurerm_virtual_network.hubVnet1.name
  remote_virtual_network_id    = azurerm_virtual_network.Spoke1vnet.id
  allow_virtual_network_access = true
  allow_forwarded_traffic = true
  allow_gateway_transit =  false
  use_remote_gateways = false
}

# Azure Virtual Network peering between Virtual Network Hub and Spoke2
resource "azurerm_virtual_network_peering" "Hub_to_spoke2" {
  name                         = "peer-vnet-Hub-with-spoke2-${var.user_name}-${var.prefix}"
  resource_group_name          = azurerm_resource_group.test.name
  virtual_network_name         = azurerm_virtual_network.hubVnet1.name
  remote_virtual_network_id    = azurerm_virtual_network.Spoke2vnet.id
  allow_virtual_network_access = true
  allow_forwarded_traffic = true
  allow_gateway_transit =  false
  use_remote_gateways = false
}

# Azure Virtual Network peering between Virtual Network Spoke2 and Hub
resource "azurerm_virtual_network_peering" "spoke2_to_hub" {
  name                         = "peer-vnet-spoke2-with-hub-${var.user_name}-${var.prefix}"
  resource_group_name          = azurerm_resource_group.test.name
  virtual_network_name         = azurerm_virtual_network.Spoke2vnet.name
  remote_virtual_network_id    = azurerm_virtual_network.hubVnet1.id
  allow_virtual_network_access = true
  allow_forwarded_traffic = true
  allow_gateway_transit =  false
  use_remote_gateways = false
}

# Azure Virtual Network peering between Virtual Network Spoke1 and Hub
resource "azurerm_virtual_network_peering" "spoke1_to_hub" {
  name                         = "peer-vnet-spoke1-with-hub-${var.user_name}-${var.prefix}"
  resource_group_name          = azurerm_resource_group.test.name
  virtual_network_name         = azurerm_virtual_network.Spoke1vnet.name
  remote_virtual_network_id    = azurerm_virtual_network.hubVnet1.id
  allow_virtual_network_access = true
  allow_forwarded_traffic = true
  allow_gateway_transit =  false
  use_remote_gateways = false
}

# Azure Virtual Network Peering between Virtual Network Hub and non-rfc
resource "azurerm_virtual_network_peering" "Hub_to_non-rfc" {
  count                         = var.non_rfc ? 1 : 0
  name                         = "peer-vnet-Hub-with-non-rfc-${var.user_name}-${var.prefix}"
  resource_group_name          = azurerm_resource_group.test.name
  virtual_network_name         = azurerm_virtual_network.hubVnet1.name
  remote_virtual_network_id    = azurerm_virtual_network.non-rfc-vnet[count.index].id
  allow_virtual_network_access = true
  allow_forwarded_traffic = true
  allow_gateway_transit =  false
  use_remote_gateways = false
}

# Azure Virtual Network peering between Virtual Network Spoke1 and Hub
resource "azurerm_virtual_network_peering" "non-rfc_to_hub" {
  count                         = var.non_rfc ? 1 : 0
  name                         = "peer-vnet-non-rfc-with-hub-${var.user_name}-${var.prefix}"
  resource_group_name          = azurerm_resource_group.test.name
  virtual_network_name         = azurerm_virtual_network.non-rfc-vnet[count.index].name
  remote_virtual_network_id    = azurerm_virtual_network.hubVnet1.id
  allow_virtual_network_access = true
  allow_forwarded_traffic = true
  allow_gateway_transit =  false
  use_remote_gateways = false
}

Debug Output/Panic Output

https://gist.github.com/shankar-bala/186fee5ba056e736ca454d3e3d11a1bd

Expected Behaviour

vnet peering should get created successfully

Actual Behaviour

vnet peering failing because the vnet is reported as not in succeeded state

Steps to Reproduce

terraform plan terraform apply

Important Factoids

No response

References

No response

wuxu92 commented 11 months ago

Hi @shankar-bala ,

The logs indicate a conflict occurred while creating the peering resource on the virtual network. Is this error intermittent or persistent? Can we resolve it by rerunning the Terraform apply for a successful outcome?

shankar-bala commented 10 months ago

Error seems to be intermittant..