Open Magicloud opened 3 years ago
Thanks for opening this issue. Seems this feature has been implemented in subnet resource. I assume you have to add/remove delegation block from subnet resource to implement it. Below is the example.
Adding delegation:
resource "azurerm_subnet" "test" {
name = "testsubnettest01"
resource_group_name = azurerm_resource_group.test.name
virtual_network_name = azurerm_virtual_network.test.name
address_prefix = "10.1.0.0/24"
delegation {
name = "delegation"
service_delegation {
name = "Microsoft.ContainerInstance/containerGroups"
actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
}
}
}
Removing delegation:
resource "azurerm_subnet" "test" {
name = "testsubnettest01"
resource_group_name = azurerm_resource_group.test.name
virtual_network_name = azurerm_virtual_network.test.name
address_prefix = "10.1.0.0/24"
}
@neil-yechenwei Sorry, I did not make myself clear. Current design is hard to do abstraction. For example, I cannot make a VPC module without setting the delegation or exposing the subnets to users. Updated the original post.
Another use-case for this is, which applies in our environment, is where the subnet is already created and provided to us. We don't want to import the subnet into state and just want to be able to manage (create/remove/change) the subnet delegation,
The azure_subnet resource can't be created due to the azure policy.
olicy identifiers: '[{"policyAssignment":{"name":"Deny-Subnet-Without-Nsg","id":"/providers/Microsoft.Management/managementGroups/QSFT-landingzones/providers/Microsoft.Authorization/policyAssignments/Deny-Subnet-Without-Nsg"},"policyDefinition":{"name":"Subnets should have a Network Security Group ","id":"/providers/Microsoft.Management/managementGroups/QSFT/providers/Microsoft.Authorization/policyDefinitions/Deny-Subnet-Without-Nsg"}}]'
As a remedy to the above one, we are creating subnet using as a block in vnet. But that doesn't have option for subnet delegation.
So what is the alternative for that?
There are cases when vnet with subnets are created by central privilege team due to organization policy. Other teams still have possibility to delegate subnet which is required by many services like function-app, databricks. In such cases having a possibility to delegate subnet as separate resource (like mentioned above azurerm_subnet_delegation
) will be very useful. Currently, due to this limitation we have to use null_resouce
with a bit of az cli scripting which is not ideal.
If you are aware any better solution please advice.
+1 here - we do have the same use case - pre-created subnet, to which we want to modify the service delegations, but we don't want to destroy the subnet as it is managed outside of our setup.
Any update or creative ideas on how to handle subnet Delegation on a provided subnet?
I am in a situation where there is a policy that denies the creation of subnets without a network security group, this means I have to create subnets as part of a azurerm_virtual_network
resource which doesn't and won't allow delegation to be defined (see https://github.com/hashicorp/terraform-provider-azurerm/issues/11187 for why).
Currently I am resorting to hackery such as
provisioner "local-exec" {
command = <<-EOT
az network vnet subnet update \
--resource-group foo-rg \
--name foo-subnet \
--vnet-name foo-vnet \
--delegations Microsoft.DBforPostgreSQL/flexibleServers \
--service-endpoints Microsoft.Storage
EOT
}
Having a provider native way to achieve this would be much nicer.
Community Note
Description
The delegation can be added or removed via Terraform at the moment, but it is tied with azurerm_subnet resource. I cannot work on the delegation without touching the code for azurerm_subnet.
New or Affected Resource(s)
azurerm_subnet (AFFECTED)
azurerm_subnet_delegation (NEW)
Potential Terraform Configuration
References
0000