azurerm_subnet - Fixed delegation (fixes #3730)

[bentterp]

This should fix #3730

I've removed and deployed delegation, and removed again. When deployed, the delegation shows up in the console without complaints.

After applying a change, the next plan is empty.

[tombuildsstuff]

hi @bentterp

Thanks for opening this PR - taking a look through I've left a couple of questions inline but this otherwise LGTM 👍

Thanks!

[tombuildsstuff]

hey @bentterp

Thanks for clarifying that - taking another look into this it appears that it's possible to set all 3 of these values for the actions field (since it's used in this ARM Template) - as such I think we need to add these values back in for the moment.

Since this PR otherwise looks good, I hope you don't mind but so that we can get this merged I'm going to push a commit to add that back in.

Thanks!

[tombuildsstuff]

Tests pass:

[bentterp]

Yes, you can add all 3 actions like this

      name = "subnet service delegation"
      service_delegation {
        name     = delegation.value
        actions  = [
          "Microsoft.Network/virtualNetworks/subnets/join/action",
          "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
          "Microsoft.Network/virtualNetworks/subnets/action"
        ]
      }

and the plan will be sane and the apply will be successfull.

But every subsequent apply will want to do this

      ~ delegation {
            name = "subnet service delegation"

          ~ service_delegation {
              ~ actions = [
                    "Microsoft.Network/virtualNetworks/subnets/join/action",
                    "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
                  + "Microsoft.Network/virtualNetworks/subnets/action",
                ]
                name    = "Microsoft.Sql/managedInstances"
            }
        }

And that apply will also be successfull, and then the next time you get the same diff between TF state and what's deployed and so it goes on and on.

This is not a problem for an ARM template because it doesn't care about state - I care about state, that's why I use Terraform 😍

However, if you leave out "Microsoft.Network/virtualNetworks/subnets/action" then state will match subsequent interrogations, and delegation will still work.

I'm perfectly okay with what you chose to do, but it will create confusion if we don't at least make it clear in the docs what is happening and how to get rid of it.

//Bent

[ghost]

This has been released in version 1.34.0 of the provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. As an example:

provider "azurerm" {
    version = "~> 1.34.0"
}
# ... other configuration ...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!