azurerm_palo_alto_next_generation_firewall_* - support the property trustedRanges

[neil-yechenwei]

Service team is requesting this new feature.

Note: Above test cases are also failed in Teamcity Daily Run with same error so that it's not related with this PR.

[catriona-m]

Hi @neil-yechenwei - it looks like the test has a fail related to this PR in the latest run:

------- Stdout: -------
=== RUN   TestAccPaloAltoNextGenerationFirewallLocalRulestackVNet_update
=== PAUSE TestAccPaloAltoNextGenerationFirewallLocalRulestackVNet_update
=== CONT  TestAccPaloAltoNextGenerationFirewallLocalRulestackVNet_update
    testcase.go:113: Step 3/8 error: Error running pre-apply refresh: exit status 1
        Error: expected "network_profile.0.trusted_ranges.0" to be a valid CIDR Value, got 20.22.92.11: invalid CIDR address: 20.22.92.11
          with azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack.test,
          on terraform_plugin_test.tf line 138, in resource "azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack" "test":
         138:     trusted_ranges            = ["20.22.92.11", "20.23.92.11"]
        Error: expected network_profile.0.trusted_ranges.0 to contain a valid IP range, got: 20.22.92.11
          with azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack.test,
          on terraform_plugin_test.tf line 138, in resource "azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack" "test":
         138:     trusted_ranges            = ["20.22.92.11", "20.23.92.11"]
        Error: expected "network_profile.0.trusted_ranges.1" to be a valid CIDR Value, got 20.23.92.11: invalid CIDR address: 20.23.92.11
          with azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack.test,
          on terraform_plugin_test.tf line 138, in resource "azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack" "test":
         138:     trusted_ranges            = ["20.22.92.11", "20.23.92.11"]
        Error: expected network_profile.0.trusted_ranges.1 to contain a valid IP range, got: 20.23.92.11
          with azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack.test,
          on terraform_plugin_test.tf line 138, in resource "azurerm_palo_alto_next_generation_firewall_virtual_network_local_rulestack" "test":
         138:     trusted_ranges            = ["20.22.92.11", "20.23.92.11"]
--- FAIL: TestAccPaloAltoNextGenerationFirewallLocalRulestackVNet_update (2307.17s)
FAIL

[neil-yechenwei]

@catriona-m , thanks for the comment. I updated PR. Please take another look. Thanks.

[katbyte]

should this be

Suggested change

	"trusted_ranges": {
	"trusted_addresses_ranges": {

or

Suggested change

	"trusted_ranges": {
	"trusted_addresses": {

to both be more clear what it is looking for as well match other propertyes int he provider?

[neil-yechenwei]

Updated to trusted_address_ranges

[neil-yechenwei]

@katbyte , thanks for the comments. I updated PR. Please take another look. Thanks.

[katbyte]

Thanks @neil-yechenwei - checked tests and they are all failing?

------- Stdout: -------
=== RUN   TestAccPaloAltoNextGenerationFirewallVHubLocalRulestack_basic
=== PAUSE TestAccPaloAltoNextGenerationFirewallVHubLocalRulestack_basic
=== CONT  TestAccPaloAltoNextGenerationFirewallVHubLocalRulestack_basic
    testcase.go:113: Step 1/2 error: Error running apply: exit status 1
        
        Error: waiting for Virtual Hub: (Name "acctestVHUB-240118040419856605" / Resource Group "acctestRG-PANGFWVH-240118040419856605") provisioning route: failed to provision routing on Virtual Hub "acctestRG-PANGFWVH-240118040419856605" (Resource Group "acctestVHUB-240118040419856605")
        
          with azurerm_virtual_hub.test,
          on terraform_plugin_test.tf line 49, in resource "azurerm_virtual_hub" "test":
          49: resource "azurerm_virtual_hub" "test" {
        
    testing_new.go:90: Error running post-test destroy, there may be dangling resources: exit status 1
        
        Error: deleting Virtual Wan: (Name "acctestvwan-240118040419856605" / Resource Group "acctestRG-PANGFWVH-240118040419856605"): network.VirtualWansClient#Delete: Failure sending request: StatusCode=400 -- Original Error: Code="InUseVirtualWanCannotBeDeleted" Message="Cannot proceed with the operation because Virtual WAN has references. The WAN is referenced by 1 Virtual Hubs and 0 VPN Sites." Details=[]
        
--- FAIL: TestAccPaloAltoNextGenerationFirewallVHubLocalRulestack_basic (473.16s)
FAIL

could we plase fix these up so we can ensure this works as intended?

[neil-yechenwei]

Hi @katbyte , the test cases you mentioned are also failed in both Network and PaloAlto in Teamcity Daily Run with same error. Per the error message returned by API in teamcity, it's service API issue not TF issue. It depends on the fix from service team, so I can't fix it in the short term. I suggest to review/merge this PR first since the failure is not related with this PR. In the meanwhile, I have already filed azure support ticket and IcM ticket to ask service team to fix it. Does it make sense?

Note: As our test service principal and test subscription have insufficient permission for this RP, so it's hard to us to run some test cases on my local for this RP. I assume jackofallops has full permission for this RP since he added them in TF.

[katbyte]

@neil-yechenwei - is the problem causing the tests to fail described anywhere? and is there an ETA for the fix?

[neil-yechenwei]

@katbyte , for Virtual Hub issue, Virtual Wan Service team confirmed that the issue has been fixed last Friday and I found the Virtual Hub issue has gone in the latest Teamcity Daily Run. For PaloAlto issue, seems it is also fixed by the related service team. Below is the latest test result.

[neil-yechenwei]

Below is the latest test result.

[katbyte]

Great thanks @neil-yechenwei - LGTM 🪟

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active contributions.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.