Vhub Routing intent routes modifies to wrong route table

### Community Note

- Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
- Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
- If you are interested in working on this issue or have submitted a pull request, please leave a comment

### Versions

terraform -

azure provider - 3.107.0

module - caf-enterprise-scale and lz-vending

Description

Describe the bug -

We are using two modules, caf-enterprise-scale and lz-vending, for the creation of our Azure landing zone. The VWAN was created using the caf-enterprise-scale module, while the connectivity was set up using the lz-vending module.

While deploying a subscription using these two modules, we observed unexpected behavior with the VHub routing intent route tables. The propagating connections were created in the 'None' route table, whereas they should have been created in the 'Default' route table.

The behavior appears inconsistent. Associated connections are being created in the 'Default' route table, while propagating connections are being created in the 'None' route table. We are unsure what is causing this behavior during subscription deployment. Ideally, for all VNets, both connections should be created under the 'Default' route table.

1. below is the code looks like in caf-enterprise-scale for input values.

locals {
default_source = "/home/vsts/work/1/s/TerraformModules/azure_caf_passthrough"
common = yamldecode(file(find_in_parent_folders("common.yaml")))
}

include {
path = find_in_parent_folders()
}

terraform {
source = local.default_source
extra_arguments "variables" {
commands = get_terraform_commands_that_need_vars()
}
}

dependency "network" {
config_path = "../subscriptions/CA-Qualified-Network-001"
}

dependencies {
paths = ["../landing_zone"]
}

inputs = merge(
{
root_parent_id = "922werb2-932bc-41df1-abd86-8123jhdc"
root_id = "Qualified"
root_name = "Qualified""
default_location = "eastus2"

subscription_id_connectivity = "922werb2-932bc-41df1-abd86-8123jhdc"
provider_subscription_id = "922werb2-932bc-41df1-abd86-8123jhdc"

deploy_connectivity_resources = true
configure_connectivity_resources = {
settings = {
hub_networks = []
vwan_hub_networks = [
{
enabled = true
config = {
address_prefix = "10.36.0.0/20"
location = "eastus2"
sku = "Standard"
routes = []
routing_intent = {
enabled = true
config = {
routing_policies = [
{
name = "routing_policy_1"
destinations = ["Internet", "PrivateTraffic"]
}
]
}
}
expressroute_gateway = {
enabled = false
config = {
scale_unit = 1
}
}
vpn_gateway = {
enabled = false
config = {
bgp_settings = []
routing_preference = ""
scale_unit = 1
}
}
azure_firewall = {
enabled = true
config = {
enable_dns_proxy = false
dns_servers = []
sku_tier = "Standard"
base_policy_id = ""
private_ip_ranges = []
threat_intelligence_mode = "Alert"
threat_intelligence_allowlist = {}
availability_zones = {
zone_1 = true
zone_2 = true
zone_3 = true
}
}
}
spoke_virtual_network_resource_ids = []
secure_spoke_virtual_network_resource_ids = []
enable_virtual_hub_connections = false
}
},
]
ddos_protection_plan = {
enabled = false
config = {
location = "eastus2"
}
}
dns = {
enabled = true
config = {
location = "eastus2"
enable_private_link_by_service = {
azure_api_management = false
azure_app_configuration_stores = false
azure_arc = false
azure_arc_guest_configuration = false
azure_arc_hybrid_resource_provider = false
azure_arc_kubernetes = false
}
private_link_locations = []
public_dns_zones = []
private_dns_zones = []
enable_private_dns_zone_virtual_network_link_on_hubs = true
enable_private_dns_zone_virtual_network_link_on_spokes = true
virtual_network_resource_ids_to_link = []
}
}
}
location = "eastus2"
# Advanced section is undocumented
# Details on how to use it can be found in this terraform file:
# https://github.com/Azure/terraform-azurerm-caf-enterprise-scale/blob/c1eef3432f2ea97b290c9b481f3bab8b513aa204/modules/connectivity/locals.tf
advanced = {
existing_virtual_wan_resource_group_name = "RG-Qualified-NETWORK"
custom_settings_by_resource_type = {
azurerm_resource_group = {
connectivity = {
eastus2 = {
name = "RG-Qualified-NETWORK"
}
}
virtual_wan = {
eastus2 = {
name = "RG-Qualified-NETWORK"
}
}
dns = {
eastus2 = {
name = "RG-Qualified-NETWORK"
}
}
}
azurerm_firewall = {
virtual_wan = {
eastus2 = {
name = "RG-Qualified-NETWORK"
virtual_hub = [
{
public_ip_count = 5
}
]
}
}
}
azurerm_virtual_hub = {
virtual_wan = {
eastus2 = {
name = "Qualified_VHUB"
hub_routing_preference = "ASPath"
}
}
}
azurerm_virtual_wan = {
virtual_wan = {
eastus2 = {
allow_branch_to_branch_traffic = false
name = "Qualified_VWAN"
}
}
}
}
}
tags = local.common.tags
}
}
)

2. Code for lz-vending modules, below shown is input variable file.

variable "virtual_networks" {
type = map(object({
name = string
address_space = list(string)
resource_group_name = string

dns_servers = optional(list(string), [])
ddos_protection_enabled = optional(bool, false)
resource_group_creation_enabled = optional(bool, true)
resource_group_lock_enabled = optional(bool, true)
vwan_connection_enabled = optional(bool, false)
vwan_connection_name = optional(string, "")
vwan_hub_resource_id = optional(string, "")
vwan_security_configuration = optional(object({
secure_internet_traffic = optional(bool, false)
secure_private_traffic = optional(bool, false)
routing_intent_enabled = optional(bool, false)
}), {})
tags = optional(map(string), {})
}))
nullable = false
default = {}
}

Vhub Vnet connections are created using lz-vending module.

Steps to Reproduce

1. Used CAF module to create VWan, Vhub and Azure firewall.
2. Used LZ Vending module to create Vub creation.
3. "The output of the VHub routing intent route table is significantly different.

Screenshots

The connections should be created as shown in the above screenshot. However, both the associated connections and propagating connections are being created in two different route tables: 'Default' and 'None'. Ideally, both should be created in the same 'Default' route table.

Additional context

I need assistance with this issue and would greatly appreciate it if it can be resolved..

Start by comparing the routing intent settings in the referenced caf-enterprise-scale modules/connectivity/locals.tf with the lz-vending virtual_networks variable and its VHub connection inputs. Reproduce the deployment described in the issue and inspect how associated and propagating connections are assigned route tables. Done means both connection types use the Default route table rather than None.

Written by the indexing model from the issue text.