can't create active-active vpngw

[davidkarlsen]

Versions

v1.1.0

terraform:
1.0.11

azure provider:
version = "~> 2.87"

module:

Description

As we want an active-active VPN gw, we configure two public IPs in order to pass these as ip_configuration to the module:

resource "azurerm_public_ip" "vpn_gw" {
  count               = 2
  allocation_method   = "Static"
  location            = var.default_location
  tags                = var.default_tags
  sku                 = "Standard"
  name                = "VpnGw${count.index}"
  resource_group_name = local.comms_resource_group_name
}

data "azurerm_subnet" "gateway_subnet" {
  name                 = "GatewaySubnet"
  resource_group_name  = local.comms_resource_group_name
  virtual_network_name = "es-hub-${var.default_location}"
}

...
 configure_connectivity_resources = {
    advanced = {
      custom_settings_by_resource_type = {
        azurerm_virtual_network_gateway = {
          connectivity = {
            vpngw = {
              (var.default_location) = {
                enable_bgp    = true
                active_active = true
                ip_configuration = [
                  {
                    name                          = "vnetGatewayConfig1"
                    public_ip_address_id          = azurerm_public_ip.vpn_gw[0].id
                    private_ip_address_allocation = "Dynamic"
                    subnet_id                     = data.azurerm_subnet.gateway_subnet.id
                  },
                  {
                    name                          = "vnetGatewayConfig2"
                    public_ip_address_id          = azurerm_public_ip.vpn_gw[1].id
                    private_ip_address_allocation = "Dynamic"
                    subnet_id                     = data.azurerm_subnet.gateway_subnet.id
                  }
                ]
              }
            }
          }
        }
      }
    }

But still the module will create a pip for the gateway, from terraform plan:

  # module.caf-enterprise-scale.azurerm_public_ip.connectivity["/subscriptions/mySub/resourceGroups/es-connectivity-myLocation/providers/Microsoft.Network/publicIPAddresses/es-vpngw-myLocation-pip"] will be created
  + resource "azurerm_public_ip" "connectivity" {
      + allocation_method       = "Static"
      + availability_zone       = "Zone-Redundant"
      + fqdn                    = (known after apply)
      + id                      = (known after apply)
      + idle_timeout_in_minutes = 4
      + ip_address              = (known after apply)
      + ip_version              = "IPv4"
      + location                = "myLocation"
      + name                    = "es-vpngw-myLocation-pip"
      + resource_group_name     = "es-connectivity-myLocation"
      + sku                     = "Standard"
      + sku_tier                = "Regional"
      + tags                    = {
          + "deployedBy" = "terraform/azure/caf-enterprise-scale/v1.1.0"
          + "terraform"  = "true"
        }
      + zones                   = (known after apply)
    }

Steps to Reproduce

1. pass ip_configuration to the module
2. observe that ip_configuration is used, but still a pip (which won't be needed or used) is also created

Screenshots
N/A

Additional context
N/A

[krowlandson]

Great question @davidkarlsen. I'll have to look into whether it's possible to supress creation of the PIP in this scenario, but would it be more useful if we added a feature to the module to auto-create the second network interface and attach it to the firewall when active_active = true?

[davidkarlsen]

Great question @davidkarlsen. I'll have to look into whether it's possible to supress creation of the PIP in this scenario, but would it be more useful if we added a feature to the module to auto-create the second network interface and attach it to the firewall when active_active = true?

creating a 2nd iface would be handy and can co-exist by leaving out any ip config if defined by user - that would provide a balance between flexibility and sane defaulting.

[krowlandson]

Will look into this and get it prioritised on our development backlog... thank you for the feedback @davidkarlsen