subnet delegation actions handling is incorrect.

[alex-goncharov]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

$ terraform version
Terraform v0.12.3
+ provider.azurerm v1.30.1

Affected Resource(s)

• azurerm_subnet

Terraform Configuration Files

resource "azurerm_subnet" "test" {
  name                 = "test"
  resource_group_name  = "test-rg"
  virtual_network_name = "test-vnet"
  address_prefix       = "10.1.0.0/24"

  delegation {
    name = md5("Microsoft.Sql/managedInstances")
    service_delegation {
      name = "Microsoft.Sql/managedInstances"
      actions = [
        "Microsoft.Network/virtualNetworks/subnets/action" 
        # "Microsoft.Network/virtualNetworks/subnets/join/action"
        # "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action"
      ]
    }
  }
}

Expected Behavior

Provider should accept all possible delegation action or if Azure API disallows delegation action modification (which, looking at the CLI it does not), then provider should not try to set or modify them.

Actual Behavior

I'm fairly new to Azure API, but behaviour of the azurerm_subnet resource seems incorrect:

Provider allows me to create subnet delegation with empty actions list or with a single value in it (the one that's not commented out). Once subnet is created though, it looks like Azure API disregards actions list and create delegation with 3 options (full list above):

  # azurerm_subnet.test will be updated in-place
  ~ resource "azurerm_subnet" "test" {
        address_prefix       = "10.1.0.0/24"
        id                   = "..."
        ip_configurations    = []
        name                 = "test"
        resource_group_name  = "test-rg"
        service_endpoints    = []
        virtual_network_name = "test-vnet"

      ~ delegation {
            name = "5807eb7c8e7ae01071afecff5e0a7466"

          ~ service_delegation {
              ~ actions = [
                  - "Microsoft.Network/virtualNetworks/subnets/join/action",
                  - "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
                  + "Microsoft.Network/virtualNetworks/subnets/action",
                ]
                name    = "Microsoft.Sql/managedInstances"
            }
        }
    }

As a result terraform wants to change subnet delegation on every apply. And it is not possible to set all the actions because provider accepts only one:

Error: expected delegation.0.service_delegation.0.actions.1 to be one of [Microsoft.Network/virtualNetworks/subnets/action], got Microsoft.Network/virtualNetworks/subnets/join/action

Steps to Reproduce

1. create the plan from snippet above
2. terraform apply
3. terrafrom plan

[bentterp]

PR #4137 should fix this issue

[bentterp]

@tusharbudhe0302 I think you may be commenting on a different issue?
AFAICT, your template does not seem to concern subnet delegation.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!