Azure / Azure/azure-quickstart-templates

SQL Server Private Endpoint Dependency Not Properly Resolved for Existing SQL Server

Open
#8,820 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
Bicep
Stars
14.9k
Forks
16.2k
Avg merge
6d 21h
Merged PRs (30d)
6

Description

[SQL Server Private Endpoint](https://github.com/Azure/azure-quickstart-templates/blob/master/101-private-endpoint-sql/azuredeploy.json)
[SQL Server Private Endpoint from App Service](https://github.com/Azure/azure-quickstart-templates/blob/master/201-private-endpoint-sql-from-appservice/azuredeploy.json)

### Issue Details
This issue affects multiple templates that show how to deploy a SQL server with a Private Endpoint. The applicable scenario involves first deploying a template where an existing SQL Server with Public Network Access Enabled and that does not exist within a Virtual Network, and then deploying a template that moves the SQL Server within a Virtual Network with a Private Endpoint and sets Public Network Access to Disabled.

While the templates define a dependency of the Private Endpoint upon the SQL Server, which is correct in deployments from scratch, the deployment fails on an existing SQL Server when trying to set Public Network Access to Disabled, because the SQL Server does not have a dependency on the Private Endpoint and the Private Endpoint does not exist yet.

Error message is as follows:

```
{
"code": "DeploymentFailed",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
"details": [
{
"code": "PECsNotExistingToDenyPublicNetworkAccess",
"message": "Unable to set Deny Public Network Access to Yes since there is no private endpoint enabled to access the server. Please set up private endpoints and retry the operation (https://docs.microsoft.com/azure/sql-database/sql-database-private-endpoint-overview#how-to-set-up-private-link-for-azure-sql-database)."
}
]
}
```

Please let me know if this should be submitted in a different GitHub repository.

### Repro steps
1. Deploy ARM template that creates a SQL Server with Public Network Access Enabled and without Virtual Network or Private Endpoint.
2. Deploy ARM template that creates a SQL Server with Public Network Access Disabled and within a Virtual Network with Private Endpoint.
3. Private Endpoint has dependency on SQL Server resource and SQL Server has no dependency on Private Endpoint, as defined in the referenced templates above.
4. Race condition occurs where SQL Server tries to set Public Network Access to Disabled before Private Endpoint exists.

Temporary Workaround: Delete SQL Server and redeploy. Race condition will not occur, but this is not acceptable for Production environments.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with azuredeploy.json in 101-private-endpoint-sql and 201-private-endpoint-sql-from-appservice, then review their SQL Server and Private Endpoint dependency declarations. Reproduce the two-step deployment described in the issue and inspect the deployment operations. Done means an existing SQL Server can be moved to a private endpoint with public network access disabled without the race condition.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, sql
Domain
cloud, databases, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.