New Resource: azurerm_network_manager_network_group

[teowa]

Ref

• What is a network group in Azure Virtual Network Manager
• swagger

Test

TF_ACC=1 go test -v ./internal/services/network -parallel 20 -test.run=TestAccNetworkManager$ -timeout 1440m -ldflags="-X=github.com/hashicorp/terraform-provider-azurerm/version.ProviderVersion=acc"
=== RUN   TestAccNetworkManager
=== RUN   TestAccNetworkManager/NetworkGroup
=== RUN   TestAccNetworkManager/NetworkGroup/basic
=== RUN   TestAccNetworkManager/NetworkGroup/complete
=== RUN   TestAccNetworkManager/NetworkGroup/update
=== RUN   TestAccNetworkManager/NetworkGroup/requiresImport
--- PASS: TestAccNetworkManager (878.19s)
    --- PASS: TestAccNetworkManager/NetworkGroup (878.19s)
        --- PASS: TestAccNetworkManager/NetworkGroup/basic (207.87s)
        --- PASS: TestAccNetworkManager/NetworkGroup/complete (197.14s)
        --- PASS: TestAccNetworkManager/NetworkGroup/update (269.46s)
        --- PASS: TestAccNetworkManager/NetworkGroup/requiresImport (203.72s)
PASS
ok      github.com/hashicorp/terraform-provider-azurerm/internal/services/network       878.218s

[katbyte]

Have test failures:

------- Stdout: -------
=== RUN   TestAccNetworkManager
=== RUN   TestAccNetworkManager/Manager
=== RUN   TestAccNetworkManager/Manager/basic
    testcase.go:117: Step 1/2 error: Error running apply: exit status 1
        
        Error: creating Network Manager: (Name "acctest-networkmanager-221211223628976854" / Resource Group "acctestRG-network-manager-221211223628976854"): network.ManagersClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="BadRequest" Message="Cannot have two Network Managers applied to the same object overlapping scope accesses. Scope id: /subscriptions/*******. Network Manager Id: /subscriptions/*******/resourceGroups/acctestRG-network-manager-221211223628976854/providers/Microsoft.Network/networkManagers/acctest-networkmanager-221211223628976854. Overlapping accesses: SecurityAdmin"

[teowa]

CI failure is not related to this PR:

[teowa]

Have test failures:

------- Stdout: -------
=== RUN   TestAccNetworkManager
=== RUN   TestAccNetworkManager/Manager
=== RUN   TestAccNetworkManager/Manager/basic
    testcase.go:117: Step 1/2 error: Error running apply: exit status 1
        
        Error: creating Network Manager: (Name "acctest-networkmanager-221211223628976854" / Resource Group "acctestRG-network-manager-221211223628976854"): network.ManagersClient#CreateOrUpdate: Failure responding to request: StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 Code="BadRequest" Message="Cannot have two Network Managers applied to the same object overlapping scope accesses. Scope id: /subscriptions/*******. Network Manager Id: /subscriptions/*******/resourceGroups/acctestRG-network-manager-221211223628976854/providers/Microsoft.Network/networkManagers/acctest-networkmanager-221211223628976854. Overlapping accesses: SecurityAdmin"

Hi @katbyte , seems there is existing Network Manager in the test subscription that causes the acctest failure, could you please help delete it? You can search network manager RP in portal directly to delete it or delete the resource group: /subscriptions/*******/resourceGroups/acctestRG-network-manager-221211223628976854/providers/Microsoft.Network/networkManagers/acctest-networkmanager-221211223628976854

[teowa]

My local test can succeed:

make acctests SERVICE="network" TESTARGS="-parallel 20 -test.run=TestAccNetworkManager$" TESTTIMEOUT='1440m'
==> Checking that code complies with gofmt requirements...
==> Checking that Custom Timeouts are used...
==> Checking that acceptance test packages are used...
TF_ACC=1 go test -v ./internal/services/network -parallel 20 -test.run=TestAccNetworkManager$ -timeout 1440m -ldflags="-X=github.com/hashicorp/terraform-provider-azurerm/version.ProviderVersion=acc"
=== RUN   TestAccNetworkManager
=== RUN   TestAccNetworkManager/Manager
=== RUN   TestAccNetworkManager/Manager/basic
=== RUN   TestAccNetworkManager/Manager/complete
=== RUN   TestAccNetworkManager/Manager/update
=== RUN   TestAccNetworkManager/Manager/requiresImport
=== RUN   TestAccNetworkManager/NetworkGroup
=== RUN   TestAccNetworkManager/NetworkGroup/basic
=== RUN   TestAccNetworkManager/NetworkGroup/complete
=== RUN   TestAccNetworkManager/NetworkGroup/update
=== RUN   TestAccNetworkManager/NetworkGroup/requiresImport
--- PASS: TestAccNetworkManager (1787.49s)
    --- PASS: TestAccNetworkManager/Manager (923.47s)
        --- PASS: TestAccNetworkManager/Manager/basic (204.09s)
        --- PASS: TestAccNetworkManager/Manager/complete (186.38s)
        --- PASS: TestAccNetworkManager/Manager/update (333.71s)
        --- PASS: TestAccNetworkManager/Manager/requiresImport (199.29s)
    --- PASS: TestAccNetworkManager/NetworkGroup (864.02s)
        --- PASS: TestAccNetworkManager/NetworkGroup/basic (186.45s)
        --- PASS: TestAccNetworkManager/NetworkGroup/complete (197.77s)
        --- PASS: TestAccNetworkManager/NetworkGroup/update (268.60s)
        --- PASS: TestAccNetworkManager/NetworkGroup/requiresImport (211.21s)
PASS
ok      github.com/hashicorp/terraform-provider-azurerm/internal/services/network       1787.529s

[tombuildsstuff]

@teowa

Hi @katbyte , seems there is existing Network Manager in the test subscription that causes the acctest failure, could you please help delete it? You can search network manager RP in portal directly to delete it or delete the resource group: /subscriptions/*******/resourceGroups/acctestRG-network-manager-221211223628976854/providers/Microsoft.Network/networkManagers/acctest-networkmanager-221211223628976854

Looks like we can dynamically create a Management Group and provision this within that, which would mean we can run these in parallel/avoid this issue?

[teowa]

@tombuildsstuff , by test the method can work, but we have to call the POST method to register the Microsoft.Network provider to the Management Group before provision the network manager within it, this is currently not supported in azurerm.

[katbyte]

@teowa - how come we have to make that POST call?

[teowa]

We can parallelize the network manager acctest if we use MG as scope like below. But currently, below config will fail：

resource "azurerm_management_group" "test" {
}

resource "azurerm_network_manager" "test" {
  name                = "acctest-nm-%d"
  resource_group_name = azurerm_resource_group.test.name
  location            = azurerm_resource_group.test.location
  scope {
    management_group_ids = [azurerm_management_group.test.id]
  }
  scope_accesses = ["Connectivity"]
}

the error message is like:
PUT https://management.azure.com/subscriptions/xxxx/resourceGroups/wt-test-rg1-avnm/providers/Microsoft.Network/networkManagers/testNetworkManager3?api-version=2022-01-01

{
    "location": "eastus",
    "properties": {
        "networkManagerScopes": {
            "managementGroups": [
                "/providers/Microsoft.Management/managementGroups/xxxx"
            ]
        },
        "networkManagerScopeAccesses": [
            "Connectivity"
        ]
    }
}

And the response:
400 Bad Request

{
    "error": {
        "message": "Resouce [/providers/Microsoft.Management/managementGroups/xxxx] is not within tenant [xxxx]",
        "code": "BadRequest"
    }
}

From service team, we have to register the new MG with Microsoft.Network to provision Network Manager, see doc. Currently Terraform doesn't support this. So this PR run network manager tests one by one.

[teowa]

[katbyte]

thanks for fixing tests @teowa - LGTM ⛈️

[github-actions]

This functionality has been released in v3.38.0 of the Terraform Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.