Azure / Azure/Azure-Landing-Zones

VPN Gateway bgpPeeringAddresses causes continuous drift and service disruption on every apply

Open
#335 5 comments 1 reaction 2 assignees Assigned to @jaredfholgate View on GitHub
Transfer From: TF avm-ptn-con-hs :arrow_right:
Dominant language
PowerShell
Stars
96
Forks
70
Avg merge
3d 1h
Merged PRs (30d)
7

Description

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Issue Type?

Bug

### (Optional) Module Version

0.16.7

### (Optional) Correlation Id

_No response_

### Description

## Description
The VPN Gateway resource experiences continuous drift on every `terraform plan/apply`, causing actual modifications to production VPN Gateways that take ~2.5 minutes per gateway and disrupt BGP sessions.

### Problem
The module uses `azapi_resource` to create VPN Gateways with BGP enabled. When only `asn` and `peer_weight` are specified in `vpn_bgp_settings`, Azure automatically populates the `bgpPeeringAddresses` array with computed values:

```hcl
vpn_bgp_settings = {
asn = 65542
peer_weight = 0
}
```

Azure adds:
```json
"bgpPeeringAddresses": [
{
"customBgpIpAddresses": [],
"defaultBgpIpAddresses": ["100.X.X.X"],
"ipconfigurationId": "/subscriptions/.../ipConfigurations/...",
"tunnelIpAddresses": ["4.X.X.X"]
},
{
"customBgpIpAddresses": [],
"defaultBgpIpAddresses": ["100.X.X.X"],
"ipconfigurationId": "/subscriptions/.../ipConfigurations/...",
"tunnelIpAddresses": ["13.X.X.X"]
}
]
```

On subsequent runs, Terraform detects these as changes and attempts to remove them, triggering an actual gateway modification.

### Evidence
```
module.hub_and_spoke_networking.module.hub_and_spoke_vnet.module.virtual_network_gateway["primary-vpn"].azapi_resource.vgw: Modifying...
module.hub_and_spoke_networking.module.hub_and_spoke_vnet.module.virtual_network_gateway["primary-vpn"].azapi_resource.vgw: Modifications complete after 2m33s
```

### Impact
- **Production service disruption**: BGP sessions are torn down and re-established
- **Active-active gateways modified simultaneously**: Both instances reconfigure at once
- **Pipeline delays**: ~5 minutes added to every deployment
- **Unnecessary risk**: Changes to stable production infrastructure

### Root Cause
The `azapi_resource` is not handling computed/read-only Azure properties correctly. The `bgpPeeringAddresses` field is automatically populated by Azure and should not be sent back in update requests, but `azapi_resource` is including it in the diff.

### Configuration
```hcl
vpn = {
name = "${var.service_name}-${local.primary_region_code}-vpng-${var.environment}"
sku = "VpnGw1AZ"
vpn_active_active_enabled = true
vpn_bgp_enabled = true
vpn_generation = "Generation1"
vpn_type = "RouteBased"
vpn_bgp_settings = {
asn = 65542
peer_weight = 0
}
ip_configurations = {
active_active_1 = { public_ip = { zones = ["1", "2", "3"] } }
active_active_2 = { public_ip = { zones = ["1", "2", "3"] } }
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.