Skip to content

keyvault 2021-10-01: ignoreMissingVnetServiceEndpoint not respond as expect #22128

Open
@wuxu92

Description

@wuxu92

I created a keyvault with ignoreMissingVnetServiceEndpoint = true but the server does not respond ignoreMissingVnetServiceEndpoint field as true when i retrieve the keyvault.

request as:

curl -H 'content-type: application/json; charset=utf-8' -H 'user-agent: Go/go1.19.3 (amd64-linux) go-autorest/v14.2.1 Azure-SDK-For-Go/v66.0.0 keyvault/2021-10-01 HashiCorp Terraform/1.3.6 (+https://www.terraform.io) Terraform Plugin SDK/2.10.1 terraform-provider-azurerm/dev pid-222c6c49-1b0a-5959-a213-6608f9eb8820' -H 'authorization: Bearer xxxxx' -H 'x-ms-authorization-auxiliary: ' -H 'x-ms-correlation-request-id: 10f68284-3bfb-5132-9756-b3bf890b7aaf' --compressed 
-X PATCH
 'https://management.azure.com/subscriptions/xx-xx-x-x-xxx/resourceGroups/acctestRG-230110183813226776/providers/Microsoft.KeyVault/vaults/vault230110183813226776?api-version=2021-10-01'
 -d '{
    "properties": {
        "networkAcls": {
            "bypass": "AzureServices",
            "defaultAction": "Allow",
            "ipRules": [
                {
                    "value": "123.0.0.101"
                },
                {
                    "value": "123.0.0.102/32"
                }
            ],
            "virtualNetworkRules": [
                {
                    "id": "/subscriptions/xx-xx-x-x-xxx/resourceGroups/acctestrg-230110183813226776/providers/Microsoft.Network/virtualNetworks/acctestvirtnet230110183813226776/subnets/acctestsubneta230110183813226776",
                    "ignoreMissingVnetServiceEndpoint": false
                },
                {
                    "id": "/subscriptions/85b3dbca-5974-4067-9669-67a141095a76/resourceGroups/acctestrg-230110183813226776/providers/Microsoft.Network/virtualNetworks/acctestvirtnet230110183813226776/subnets/acctestsubnetb230110183813226776",
                    "ignoreMissingVnetServiceEndpoint": true
                }
            ]
        }
    }
}'

and it response with no ignoreMissingVnetServiceEndpoint

HTTP/2.0 200 
cache-control: no-cache
pragma: no-cache
content-type: application/json; charset=utf-8
expires: -1
vary: Accept-Encoding
x-ms-client-request-id: c8d75352-7a55-4e17-8f41-f2ace95b4f11
x-ms-keyvault-service-version: 1.5.606.0
x-ms-request-id: 53bf4605-d867-418d-a57d-1e79c1e70dad
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-ms-ratelimit-remaining-subscription-writes: 1198
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-ms-correlation-request-id: 10f68284-3bfb-5132-9756-b3bf890b7aaf
x-ms-routing-request-id: EASTASIA:20230110T104421Z:a14bbbf7-92d9-4f9b-8de6-f3428ab3f9af
date: Tue, 10 Jan 2023 10:44:21 GMT
content-length: 1755

{
    "id": "/subscriptions/xxx-xx-xx-x-xx/resourceGroups/acctestRG-230110183813226776/providers/Microsoft.KeyVault/vaults/vault230110183813226776",
    "name": "vault230110183813226776",
    "type": "Microsoft.KeyVault/vaults",
    "location": "westeurope",
    "tags": {},
    "properties": {
        "sku": {
            "family": "A",
            "name": "standard"
        },
        "tenantId": "72f988bf-86f1-41af-91ab-2d7cd011db47",
        "networkAcls": {
            "bypass": "AzureServices",
            "defaultAction": "Allow",
            "ipRules": [
                {
                    "value": "123.0.0.101/32"
                },
                {
                    "value": "123.0.0.102/32"
                }
            ],
            "virtualNetworkRules": [
                {
                    "id": "/subscriptions/xxxx/resourcegroups/acctestrg-230110183813226776/providers/microsoft.network/virtualnetworks/acctestvirtnet230110183813226776/subnets/acctestsubneta230110183813226776"  
                 # <-- no ignoreMissingVnetServiceEndpoint
                },
                {
                    "id": "/subscriptions/xxxx/resourcegroups/acctestrg-230110183813226776/providers/microsoft.network/virtualnetworks/acctestvirtnet230110183813226776/subnets/acctestsubnetb230110183813226776" 
                 #  <-- no ignoreMissingVnetServiceEndpoint
                }
            ]
        },
        "accessPolicies": [
            {
                "tenantId": "72f988bf-86f1-41af-91ab-2d7cd011db47",
                "objectId": "46f17840-0e65-493b-b5b7-caf7e2520c8c",
                "permissions": {
                    "keys": [
                        "Create"
                    ],
                    "secrets": [
                        "Set"
                    ],
                    "certificates": [],
                    "storage": []
                }
            }
        ],
        "enabledForDeployment": false,
        "enabledForDiskEncryption": false,
        "enabledForTemplateDeployment": false,
        "enableSoftDelete": true,
        "softDeleteRetentionInDays": 7,
        "enableRbacAuthorization": false,
        "vaultUri": "https://vault230110183813226776.vault.azure.net/",
        "provisioningState": "Succeeded",
        "publicNetworkAccess": "Enabled"
    }
}

related API:

"ignoreMissingVnetServiceEndpoint": {
"type": "boolean",
"description": "Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured."
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    KeyVaultService AttentionWorkflow: This issue is responsible by Azure service team.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions