Virtual Network Subnet¶

Creates a subnet in an existing virtual network, with optional delegation, network security group, route table and NAT gateway associations. Role assignments passed to the module are applied to the parent virtual network, which is what Managed DevOps Pools VNet injection requires.

Summary¶

Subnet in an existing virtual network, with delegation and parent-scoped role assignments.

Module Information¶

Property	Value
Owner	platform-team
Support	Support
Version	1.0.0

Resource Types¶

Resource Type
`Microsoft.Authorization/roleAssignments`
`Microsoft.Network/virtualNetworks`
`Microsoft.Network/virtualNetworks/subnets`

Usage¶

module subnet 'br:geitbicepmodweucr01.azurecr.io/bicep/modules/network/subnet:1.0.0' = {
  name: 'subnet'
  params: {
    // Required parameters
    par_virtual_network_name: <string>
    par_subnet_name: <string>
    par_address_prefixes: <array>
  }
}

Parameters¶

Name	Type	Description	Default
`par_address_prefixes`	`array`	Address prefixes for the subnet in CIDR notation. Size it for the maximum pool size plus the five addresses Azure reserves in every subnet. Do not use 172.17.0.0/16 or any range that overlaps it - Managed DevOps Pools uses that range internally and an overlap breaks agent connectivity.	required
`par_default_outbound_access`	`bool`	Whether the subnet keeps platform-provided default outbound internet access. Defaults to true, which preserves current Azure behaviour. Microsoft is retiring default outbound access, so this is a transitional setting: attach a NAT gateway or a route to a firewall and set this to false once an explicit egress path exists. A Managed DevOps Pools agent with no outbound path never comes online, because it cannot download the worker binaries.	`True`
`par_delegations`	`array`	Service delegations for the subnet. Managed DevOps Pools requires a delegation to Microsoft.DevOpsInfrastructure/pools, which makes the subnet exclusive to a single pool - no other pool or resource can use it. The subnet must be empty when the delegation is applied. Defaults to no delegation.	``
`par_nat_gateway_id`	`string`	Optional. Resource ID of a NAT gateway to associate with the subnet. Defaults to empty, meaning no NAT gateway.	``
`par_network_security_group_id`	`string`	Optional. Resource ID of a network security group to associate with the subnet. Defaults to empty, meaning no network security group.	``
`par_private_endpoint_network_policies`	`string`	Private endpoint network policies on the subnet. Defaults to Disabled, which is required before a private endpoint can be created in the subnet.	`Disabled`
`par_route_table_id`	`string`	Optional. Resource ID of a route table to associate with the subnet. Defaults to empty, meaning no route table.	``
`par_service_endpoints`	`array`	Optional. Service endpoints to enable on the subnet. Defaults to none.	``
`par_subnet_name`	`string`	Name of the subnet to create.	required
`par_virtual_network_name`	`string`	Name of the existing virtual network that hosts the subnet. The virtual network must be in the same resource group as this deployment, and in the same region as any Managed DevOps Pool that uses the subnet.	required
`par_virtual_network_role_assignments`	`array`	Optional. Role assignments applied to the PARENT virtual network, not to the subnet. Managed DevOps Pools requires the DevOpsInfrastructure service principal to hold Reader (acdd72a7-3385-48ef-bd42-f606fba81ae7) and Network Contributor (4d97b98b-1d4f-4787-a291-c67834d212e7) at this scope, otherwise pool creation fails. Retrieve its object ID with: az ad sp list --display-name DevOpsInfrastructure --query "[].id" -o tsv. Do not place a Delete lock on the virtual network - Managed DevOps Pools creates a service association link on the subnet during pool updates and a lock blocks its cleanup.	``

Outputs¶

Name	Type	Description
`out_subnet_id`	`string`	Resource ID of the deployed subnet.
`out_subnet_name`	`string`	Name of the deployed subnet.
`out_virtual_network_id`	`string`	Resource ID of the parent virtual network.

Versions¶

Pin an exact version. Ranges are not supported.

Version	Reference
`1.0.0` (latest)	`br/Euvic-Modules:network/subnet:1.0.0`