Add new feature for azure_rm_subnet

plugins/module_utils/azure_rm_common.py

@@ -967,7 +967,7 @@ def network_client(self):
     @property
     def network_models(self):
         self.log("Getting network models...")
-        return NetworkManagementClient.models("2018-08-01")
+        return NetworkManagementClient.models("2019-06-01")
 
     @property
     def rm_client(self):

plugins/modules/azure_rm_subnet.py

@@ -84,6 +84,22 @@
                 description:
                     - A list of locations.
                 type: list
+    private_endpoint_network_policies:
+        description:
+            - C(Enabled) or C(Disabled) apply network policies on private endpoints in the subnet.
+        type: str
+        default: Enabled
+        choices:
+            - Enabled
+            - Disabled
+    private_link_service_network_policies:
+        description:
+            - C(Enabled) or C(Disabled) apply network policies on private link service in the subnet.
+        type: str
+        default: Enabled
+        choices:
+            - Enabled
+            - Disabled
 
 extends_documentation_fragment:
     - azure.azcollection.azure
@@ -176,6 +192,18 @@
             returned: always
             type: str
             sample: "Succeeded"
+        private_endpoint_network_policies:
+            description:
+                - C(Enabled) or C(Disabled) apply network policies on private endpoints in the subnet.
+            returned: always
+            type: str
+            sample: "Enabled"
+        private_link_service_network_policies:
+            description:
+                - C(Enabled) or C(Disabled) apply network policies on private link service in the subnet.
+            returned: always
+            type: str
+            sample: "Disabled"
 '''  # NOQA
 
 from ansible_collections.azure.azcollection.plugins.module_utils.azure_rm_common import AzureRMModuleBase, CIDR_PATTERN, azure_id_to_dict, format_resource_id
@@ -195,7 +223,9 @@ def subnet_to_dict(subnet):
         address_prefix=subnet.address_prefix,
         address_prefixes=subnet.address_prefixes,
         network_security_group=dict(),
-        route_table=dict()
+        route_table=dict(),
+        private_endpoint_network_policies=subnet.private_endpoint_network_policies,
+        private_link_service_network_policies=subnet.private_link_service_network_policies
     )
     if subnet.network_security_group:
         id_keys = azure_id_to_dict(subnet.network_security_group.id)
@@ -227,6 +257,16 @@ def __init__(self):
             route_table=dict(type='raw'),
             service_endpoints=dict(
                 type='list'
+            ),
+            private_endpoint_network_policies=dict(
+                type='str',
+                default='Enabled',
+                choices=['Enabled', 'Disabled']
+            ),
+            private_link_service_network_policies=dict(
+                type='str',
+                default='Enabled',
+                choices=['Enabled', 'Disabled']
             )
         )
 
@@ -246,6 +286,8 @@ def __init__(self):
         self.security_group = None
         self.route_table = None
         self.service_endpoints = None
+        self.private_link_service_network_policies = None
+        self.private_endpoint_network_policies = None
 
         super(AzureRMSubnet, self).__init__(self.module_arg_spec,
                                             supports_check_mode=True,
@@ -287,6 +329,21 @@ def exec_module(self, **kwargs):
             results = subnet_to_dict(subnet)
 
             if self.state == 'present':
+                if self.private_endpoint_network_policies is not None:
+                    if results['private_endpoint_network_policies'] != self.private_endpoint_network_policies:
+                        self.log("CHANGED: subnet {0} private_endpoint_network_policies".format(self.private_endpoint_network_policies))
+                        changed = True
+                        results['private_endpoint_network_policies'] = self.private_endpoint_network_policies
+                else:
+                    subnet['private_endpoint_network_policies'] = results['private_endpoint_network_policies']
+                if self.private_link_service_network_policies is not None:
+                    if results['private_link_service_network_policies'] != self.private_link_service_network_policies is not None:
+                        self.log("CHANGED: subnet {0} private_link_service_network_policies".format(self.private_link_service_network_policies))
+                        changed = True
+                        results['private_link_service_network_policies'] = self.private_link_service_network_policies
+                else:
+                    subnet['private_link_service_network_policies'] = results['private_link_service_network_policies']
+
                 if self.address_prefix_cidr and results['address_prefix'] != self.address_prefix_cidr:
                     self.log("CHANGED: subnet {0} address_prefix_cidr".format(self.name))
                     changed = True
@@ -350,6 +407,10 @@ def exec_module(self, **kwargs):
                         subnet.route_table = self.network_models.RouteTable(id=self.route_table)
                     if self.service_endpoints:
                         subnet.service_endpoints = self.service_endpoints
+                    if self.private_endpoint_network_policies:
+                        subnet.private_endpoint_network_policies = self.private_endpoint_network_policies
+                    if self.private_link_service_network_policies:
+                        subnet.private_link_service_network_policies = self.private_link_service_network_policies
                 else:
                     # update subnet
                     self.log('Updating subnet {0}'.format(self.name))
@@ -364,6 +425,10 @@ def exec_module(self, **kwargs):
 
                     if results.get('service_endpoints') is not None:
                         subnet.service_endpoints = results['service_endpoints']
+                    if results.get('private_link_service_network_policies') is not None:
+                        subnet.private_link_service_network_policies = results['private_link_service_network_policies']
+                    if results.get('private_endpoint_network_policies') is not None:
+                        subnet.private_endpoint_network_policies = results['private_endpoint_network_policies']
 
                 self.results['state'] = self.create_or_update_subnet(subnet)
             elif self.state == 'absent' and changed:

plugins/modules/azure_rm_subnet_info.py

@@ -106,6 +106,18 @@
             returned: always
             type: str
             sample: /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myResourceGroup/providers/Microsoft.Network/routeTables/myRouteTable
+        private_endpoint_network_policies:
+            description:
+                - C(Enabled) or C(Disabled) apply network policies on private endpoints in the subnet.
+            returned: always
+            type: str
+            sample: Enabled
+        private_link_service_network_policies:
+            description:
+                - C(Enabled) or C(Disabled) apply network policies on private link service in the subnet.
+            returned: always
+            type: str
+            sample: Disabled
         security_group:
             description:
                 - Associated security group ID.
@@ -240,7 +252,9 @@ def format_response(self, item):
             'route_table': d.get('route_table', {}).get('id'),
             'security_group': d.get('network_security_group', {}).get('id'),
             'provisioning_state': d.get('provisioning_state'),
-            'service_endpoints': d.get('service_endpoints')
+            'service_endpoints': d.get('service_endpoints'),
+            'private_endpoint_network_policies': d.get('private_endpoint_network_policies'),
+            'private_link_service_network_policies': d.get('private_link_service_network_policies')
         }
         return d
 

tests/integration/targets/azure_rm_subnet/tasks/main.yml

@@ -188,6 +188,29 @@
     that:
       - output.changed
 
+- name: Update the subnet with network policies
+  azure_rm_subnet:
+    name: foobar01
+    virtual_network_name: My_Virtual_Network
+    resource_group: "{{ resource_group }}"
+    private_link_service_network_policies: Disabled
+    private_endpoint_network_policies: Enabled
+  register: output
+
+- assert:
+    that: output
+
+- name: The subnet with network policies should be idempotent
+  azure_rm_subnet:
+    name: foobar01
+    virtual_network_name: My_Virtual_Network
+    resource_group: "{{ resource_group }}"
+    private_link_service_network_policies: Disabled
+    private_endpoint_network_policies: Enabled
+  register: output
+
+- assert:
+    that: not output.changed
 
 - name: Get subnet facts
   azure_rm_subnet_info:
@@ -208,6 +231,8 @@
       - output.subnets[0]['address_prefixes_cidr'] != None
       - output.subnets[0]['security_group'] != None
       - output.subnets[0]['provisioning_state'] != None
+      - output.subnets[0]['private_endpoint_network_policies'] == 'Enabled'
+      - output.subnets[0]['private_link_service_network_policies'] == 'Disabled'
 
 - name: Get subnet facts
   azure_rm_subnet_info: