kitchen-azurerm 2.0.0 → 2.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0853e2f879329c6b0664e4931574d1ca3a8b8998fc1a5e56424eab212b2f95b1'
-  data.tar.gz: e00246cb4d2f291492df022874e9755fb6dc7745067428dd2f1ac291e57fc32f
+  metadata.gz: 7d34cb889a331fa1622ad6e3729fe3ee619c06b5ab830ccc067ca6e17441be01
+  data.tar.gz: a507483fd57dd9ac42ca96e2379d926bd6ad7aa924960374e6bd86298c196f3d
 SHA512:
-  metadata.gz: c8016844395a76393d56fcf31d30b7cb4e14512566c0da7a3a73aeb5fb120f4232d6c1c678feb5ca4d7cd9b159613991b0c759764ff549245e82e5055d8a3ba3
-  data.tar.gz: ec9337480b1b58d0b0a5dc461c99e8d1abbf97e9f0b95dfc8c41b34acf3a4580b0701dfaf0323dd7660164f27602bc9ef912b29cab7cbba5e66a6a99fd7b5cbe
+  metadata.gz: 995c517ffd324584166c51a7463b2bc9588754828c231351224474713b34bc19d0d9ca0714c93fb5c3cdb7d9409911034a7af5a2200ab90fdb89ec3d4f019c74
+  data.tar.gz: 4d79344aba476cc4caf04ca35f785a47eeba4de4758d883f26bf0e7bc912c846cc91def32cbdd1fb5325d3bbfe6b9fe6a4adb1bd0c717054283dd6e580f5ed36

data/lib/kitchen/driver/azure/environments.rb

@@ -19,13 +19,45 @@ module Kitchen
         # @!attribute [r] token_audience
         #   @return [String] audience/resource the access token is requested for.
         Environment = Struct.new(:name, :resource_manager_url, :authentication_endpoint, :token_audience) do
-          # The OAuth2 token URL for a tenant in this cloud.
+          # The OAuth2 v1.0 token URL for a tenant in this cloud.
           #
           # @param tenant_id [String]
           # @return [String]
           def token_url(tenant_id)
             "#{authentication_endpoint.chomp("/")}/#{tenant_id}/oauth2/token"
           end
+
+          # The OAuth2 v2.0 token URL for a tenant in this cloud.
+          #
+          # Federated (assertion-based) client credentials are documented
+          # against v2.0, which takes a +scope+ rather than a +resource+.
+          #
+          # @param tenant_id [String]
+          # @return [String]
+          def token_url_v2(tenant_id)
+            "#{authentication_endpoint.chomp("/")}/#{tenant_id}/oauth2/v2.0/token"
+          end
+
+          # The v2.0 scope covering every permission this driver needs.
+          #
+          # @return [String] e.g. +"https://management.azure.com/.default"+
+          def default_scope
+            "#{resource_manager_url.chomp("/")}/.default"
+          end
+
+          # A copy of this cloud pointed at a different Entra ID authority.
+          #
+          # Platforms that issue federated tokens - AKS in particular - set
+          # +AZURE_AUTHORITY_HOST+ to say where those tokens should be
+          # exchanged.
+          #
+          # @param authority [String, nil] the authority URL, or nil to keep this one.
+          # @return [Environment]
+          def with_authority(authority)
+            return self if authority.to_s.empty?
+
+            self.class.new(name, resource_manager_url, authority, token_audience).freeze
+          end
         end
 
         # Every supported cloud, keyed by its downcased name so that lookups are

data/lib/kitchen/driver/azure/http.rb

@@ -1,3 +1,4 @@
+require "ipaddr" unless defined?(IPAddr)
 require "json" unless defined?(JSON)
 require "net/http" unless defined?(Net::HTTP)
 require "openssl" unless defined?(OpenSSL)
@@ -29,6 +30,11 @@ module Kitchen
           OpenSSL::SSL::SSLError,
         ].freeze
 
+        # The link-local range, which holds Azure's instance metadata service.
+        #
+        # @return [IPAddr]
+        LINK_LOCAL = IPAddr.new("169.254.0.0/16").freeze
+
         # Seconds to wait for a connection and for a response.
         #
         # @return [Integer]
@@ -87,11 +93,14 @@ module Kitchen
         # @return [Net::HTTPResponse]
         # @api private
         def self.perform(uri, request)
-          proxy = uri.find_proxy
+          proxy = proxy_for(uri)
           http = if proxy
                    Net::HTTP.new(uri.host, uri.port, proxy.host, proxy.port, proxy.user, proxy.password)
                  else
-                   Net::HTTP.new(uri.host, uri.port)
+                   # Explicitly nil rather than Net::HTTP's default of :ENV,
+                   # which would send it back to the environment to pick a
+                   # proxy we have just decided against.
+                   Net::HTTP.new(uri.host, uri.port, nil)
                  end
 
           http.use_ssl = uri.scheme == "https"
@@ -100,6 +109,34 @@ module Kitchen
           http.start { |connection| connection.request(request) }
         end
 
+        # The proxy to reach a URL through, if any.
+        #
+        # Azure's instance metadata service answers on a link-local address,
+        # which exists only on the local link and which no proxy can route to.
+        # Sending it through one breaks managed identity authentication
+        # outright: the connection hangs until the open timeout, surfaces as a
+        # {TransientError}, and is then retried. Every Azure SDK carves the
+        # same exception out.
+        #
+        # @param uri [URI]
+        # @return [URI, nil]
+        # @api private
+        def self.proxy_for(uri)
+          return nil if link_local?(uri.host)
+
+          uri.find_proxy
+        end
+
+        # @param host [String]
+        # @return [Boolean] whether the host is a link-local address.
+        # @api private
+        def self.link_local?(host)
+          LINK_LOCAL.include?(IPAddr.new(host.to_s))
+        rescue IPAddr::Error
+          # Not an IP address at all, so not the metadata service.
+          false
+        end
+
         # @param method [Symbol]
         # @return [Class] the matching +Net::HTTP+ request class.
         # @raise [ArgumentError] for an unsupported method.

data/lib/kitchen/driver/azure/token_provider.rb

@@ -120,6 +120,67 @@ module Kitchen
         end
       end
 
+      # Authenticates with a federated token issued by another identity
+      # provider - GitHub Actions, GitLab, Azure DevOps, or a Kubernetes
+      # service account - rather than a stored secret.
+      #
+      # The platform writes a short-lived signed assertion to a file and
+      # rotates it; the file is therefore re-read on every token fetch rather
+      # than cached, or a long +kitchen test+ run would start presenting an
+      # assertion that has since expired.
+      class WorkloadIdentityToken < TokenProvider
+        # @return [String] the client assertion type required by Entra ID.
+        ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer".freeze
+
+        # @param environment [Environments::Environment]
+        # @param tenant_id [String]
+        # @param client_id [String]
+        # @param token_file [String] path to the federated token file.
+        def initialize(environment:, tenant_id:, client_id:, token_file:)
+          super(environment:)
+          @tenant_id = tenant_id
+          @client_id = client_id
+          @token_file = token_file
+        end
+
+        # @return [String] path to the federated token file.
+        attr_reader :token_file
+
+        # @return [Array(String, Integer)]
+        # @raise [OperationError] if the assertion file cannot be read.
+        def fetch_token
+          response = Http.request(
+            method: :post,
+            url: environment.token_url_v2(@tenant_id),
+            headers: { "Content-Type" => "application/x-www-form-urlencoded" },
+            body: URI.encode_www_form(
+              grant_type: "client_credentials",
+              client_id: @client_id,
+              client_assertion_type: ASSERTION_TYPE,
+              client_assertion: assertion,
+              scope: environment.default_scope
+            )
+          )
+
+          token_from(response, "the workload identity token endpoint")
+        end
+
+        private
+
+        # The current federated assertion, read fresh each time.
+        #
+        # @return [String]
+        # @raise [OperationError] if the file is missing or unreadable.
+        def assertion
+          File.read(token_file).strip
+        rescue SystemCallError => e
+          raise OperationError.new(
+            "Could not read the federated token file at #{token_file} (#{e.class}). " \
+            "AZURE_FEDERATED_TOKEN_FILE must point at a readable assertion issued by your CI platform."
+          )
+        end
+      end
+
       # Authenticates as a managed identity, via the Instance Metadata Service.
       #
       # This replaces the legacy MSI extension endpoint on port 50342 that the

data/lib/kitchen/driver/azure_credentials.rb

@@ -74,16 +74,24 @@ module Kitchen
 
       # Endpoints for the configured cloud.
       #
+      # +AZURE_AUTHORITY_HOST+ overrides the Entra ID endpoint, which is how
+      # platforms that issue federated tokens point at their own authority.
+      #
       # @return [Azure::Environments::Environment]
       # @raise [Kitchen::UserError] if the cloud name is not recognised.
       def azure_environment
-        @azure_environment ||= Azure::Environments.fetch(environment)
+        @azure_environment ||= Azure::Environments.fetch(environment).with_authority(ENV["AZURE_AUTHORITY_HOST"])
       end
 
       # Selects a token provider based on which credentials resolved.
       #
+      # In precedence order:
+      #
+      # * +AZURE_FEDERATED_TOKEN_FILE+ + +client_id+ + +tenant_id+ - workload
+      #   identity federation, the secretless option for CI.
       # * +client_id+ + +client_secret+ + +tenant_id+ - service principal.
-      # * +client_id+ + +tenant_id+ - user-assigned managed identity.
+      # * +AZURE_USE_MSI+ - managed identity, explicitly.
+      # * +client_id+ without a secret - user-assigned managed identity.
       # * +tenant_id+ only - system-assigned managed identity.
       # * none of the above - falls back to the +az login+ token cache.
       #
@@ -104,18 +112,91 @@ module Kitchen
 
       # @return [Azure::TokenProvider]
       def build_token_provider
-        if client_id && client_secret && tenant_id!
+        if federated_token_file && client_id && tenant_id
+          debug "Authenticating with workload identity federation (#{federated_token_file})."
+          Azure::WorkloadIdentityToken.new(environment: azure_environment, tenant_id:, client_id:,
+            token_file: federated_token_file)
+        elsif client_id && client_secret && tenant_id
+          debug "Authenticating as a service principal."
           Azure::ServicePrincipalToken.new(environment: azure_environment, tenant_id:, client_id:, client_secret:)
-        elsif client_id && tenant_id!
+        elsif use_managed_identity?
+          debug "Authenticating as a managed identity."
           Azure::ManagedIdentityToken.new(environment: azure_environment, client_id:)
-        elsif tenant_id!
+        elsif tenant_id
+          # A tenant with no client credentials means a system-assigned identity.
+          debug "Authenticating as a system-assigned managed identity."
           Azure::ManagedIdentityToken.new(environment: azure_environment)
         else
-          warn("Using tenant id set through `az login`.")
+          warn_about_unusable_credentials
+          debug "No Azure credentials were configured; using the token cached by `az login`."
           Azure::AzureCliToken.new(environment: azure_environment)
         end
       end
 
+      # Warns when credentials were supplied but cannot be used.
+      #
+      # Reaching the Azure CLI with nothing configured is a supported way to
+      # run the driver, so it passes without comment - warning about it on
+      # every create and destroy only taught users to ignore the warnings that
+      # matter. Reaching it having half-configured a service principal is a
+      # mistake worth interrupting for, because the run is about to
+      # authenticate as somebody else entirely.
+      #
+      # @return [void]
+      def warn_about_unusable_credentials
+        if partial_credentials?
+          warn("Incomplete Azure credentials: no #{missing_credentials.join(" or ")} was found in the " \
+               "environment or #{config_path}. Falling back to the credentials from `az login`.")
+        elsif credentials_file_without_subscription?
+          warn("#{config_path} has no [#{subscription_id}] section. " \
+               "Falling back to the credentials from `az login`.")
+        end
+      end
+
+      # Whether some, but not enough, client credentials were supplied.
+      #
+      # @return [Boolean]
+      def partial_credentials?
+        !(client_id.nil? && client_secret.nil? && federated_token_file.nil?)
+      end
+
+      # The credential values needed to use what was supplied.
+      #
+      # @return [Array<String>]
+      def missing_credentials
+        { "tenant_id" => tenant_id, "client_id" => client_id }.select { |_key, value| value.nil? }.keys
+      end
+
+      # Whether a credentials file exists but says nothing about the
+      # subscription under test. An empty section is deliberate - it is how a
+      # user opts one subscription in to the CLI - so it does not count.
+      #
+      # @return [Boolean]
+      def credentials_file_without_subscription?
+        File.file?(config_path) && !credentials.has_section?(subscription_id)
+      end
+
+      # Whether to authenticate as a managed identity.
+      #
+      # A +client_id+ with no accompanying secret means a user-assigned managed
+      # identity, which is how the Azure SDKs read the same combination.
+      # Crucially this does not require a tenant: the instance metadata service
+      # never sees one, so demanding it only prevented the identity from being
+      # used at all.
+      #
+      # @return [Boolean]
+      def use_managed_identity?
+        return true unless ENV["AZURE_USE_MSI"].to_s.empty?
+
+        !client_id.nil? && client_secret.nil?
+      end
+
+      # @return [String, nil] path to a federated token file, if one is configured.
+      def federated_token_file
+        value = ENV["AZURE_FEDERATED_TOKEN_FILE"]
+        value unless value.to_s.empty?
+      end
+
       # @return [Kitchen::Logger] the shared Test Kitchen logger.
       def logger
         Kitchen.logger
@@ -136,25 +217,18 @@ module Kitchen
       # Reads a property from the section of the credentials file matching
       # {#subscription_id}.
       #
+      # Reads through +to_h+ rather than +IniFile#[]+, which auto-vivifies:
+      # asking an +IniFile+ for a section it does not have *adds* that section.
+      # Looking up the credentials of an unconfigured subscription therefore
+      # used to leave the parsed file claiming to contain it.
+      #
       # @param property [String] the INI key to read.
       # @return [String, nil]
       def credentials_property(property)
-        value = credentials[subscription_id]&.[](property)
+        value = credentials.to_h[subscription_id]&.[](property)
         value unless value.to_s.empty?
       end
 
-      # Tenant ID, warning the user once when one cannot be resolved.
-      #
-      # @return [String, nil]
-      def tenant_id!
-        return tenant_id if tenant_id
-        return nil if @warned_about_tenant_id
-
-        @warned_about_tenant_id = true
-        warn("(#{config_path}) does not contain tenant_id neither is the AZURE_TENANT_ID environment variable set.")
-        nil
-      end
-
       # @return [String, nil] tenant ID from the environment or credentials file.
       def tenant_id
         env_or_credentials("AZURE_TENANT_ID", "tenant_id")

data/lib/kitchen/driver/azurerm.rb

@@ -280,14 +280,8 @@ module Kitchen
 
           run_deployment(state, "post-deploy", post_deployment(config[:post_deployment_template], config[:post_deployment_parameters])) if File.file?(config[:post_deployment_template])
         rescue Azure::OperationError => operation_error
-          rest_error = operation_error.body["error"]
-          if operation_error.code == "DeploymentActive"
-            info "Deployment for resource group #{state[:azure_resource_group_name]} is ongoing."
-            info "If you need to change the deployment template you'll need to rerun `kitchen create` for this instance."
-          else
-            info rest_error
-            raise operation_error
-          end
+          info operation_error.body["error"]
+          raise operation_error
         end
 
         state[:hostname] = resolve_hostname(state, deployment_parameters["nicName"])
@@ -369,7 +363,18 @@ module Kitchen
       def run_deployment(state, prefix, deployment)
         name = "#{prefix}-#{state[:uuid]}"
         info "Creating deployment: #{name}"
-        create_deployment_async(state[:azure_resource_group_name], name, deployment)
+        begin
+          create_deployment_async(state[:azure_resource_group_name], name, deployment)
+        rescue Azure::OperationError => operation_error
+          raise unless operation_error.code == "DeploymentActive"
+
+          # An interrupted `kitchen create` leaves its deployment running in
+          # Azure. Wait for that one instead of abandoning the rest of create:
+          # the deployment already in flight is the one we wanted, and the
+          # steps after this still have to run for the instance to be usable.
+          info "Deployment #{name} is already running; waiting for it rather than submitting it again."
+          info "To deploy a changed template, run `kitchen destroy` for this instance first."
+        end
         follow_deployment_until_end_state(state[:azure_resource_group_name], name)
       end
 
@@ -458,31 +463,50 @@ module Kitchen
       # The VM name to use, either the configured one or one generated from
       # +vm_prefix+ plus part of the instance uuid.
       #
-      # The generated name is truncated to {MAX_VM_NAME_LENGTH} so that a
-      # +vm_prefix+ longer than the documented three characters still yields a
-      # name Azure will accept.
+      # The prefix is capped one character short of {MAX_VM_NAME_LENGTH} so
+      # that a +vm_prefix+ longer than the documented three characters still
+      # yields a name Azure will accept. Leaving room for at least one uuid
+      # character does two things: it keeps some entropy in every generated
+      # name, and it guarantees the name ends with one, because a prefix that
+      # filled the whole budget could end on the separator it was written
+      # with. Azure rejects that outright - both for the VM and for the
+      # network interface named after it, which must end with a word
+      # character.
       #
       # @param state [Hash] instance state, must already have a +:uuid+.
       # @return [String]
       def generated_vm_name(state)
         return config[:vm_name] if config[:vm_name]
 
-        prefix = config[:vm_prefix].to_s
-        remaining = MAX_VM_NAME_LENGTH - prefix.length
-        return prefix[0, MAX_VM_NAME_LENGTH] if remaining <= 0
-
-        "#{prefix}#{state[:uuid][0, remaining]}"
+        prefix = config[:vm_prefix].to_s[0, MAX_VM_NAME_LENGTH - 1]
+        "#{prefix}#{state[:uuid][0, MAX_VM_NAME_LENGTH - prefix.length]}"
       end
 
+      # Maximum length of an Azure resource group name.
+      #
+      # @return [Integer]
+      MAX_RESOURCE_GROUP_NAME_LENGTH = 90
+
       # Name of the resource group this instance deploys into.
       #
+      # The instance name is the suite and platform joined together, so a
+      # descriptive suite on a long platform overruns Azure's limit and
+      # +kitchen create+ fails on its very first call - over a name the user
+      # never chose. Only that part is shortened: the prefix and suffix were
+      # asked for explicitly, and the timestamp is what keeps the name unique.
+      #
       # @return [String] +explicit_resource_group_name+ when set, otherwise
       #   prefix + instance name + UTC timestamp + suffix.
       def azure_resource_group_name
         return config[:explicit_resource_group_name] if config[:explicit_resource_group_name]
 
         formatted_time = Time.now.utc.strftime "%Y%m%dT%H%M%S"
-        "#{config[:azure_resource_group_prefix]}#{config[:azure_resource_group_name]}-#{formatted_time}#{config[:azure_resource_group_suffix]}"
+        prefix = config[:azure_resource_group_prefix].to_s
+        suffix = config[:azure_resource_group_suffix].to_s
+        room = MAX_RESOURCE_GROUP_NAME_LENGTH - prefix.length - suffix.length - formatted_time.length - 1
+        name = config[:azure_resource_group_name].to_s[0, [room, 0].max]
+
+        "#{prefix}#{name}-#{formatted_time}#{suffix}"
       end
 
       # JSON fragment describing the data disks to attach to the VM.
@@ -663,11 +687,19 @@ module Kitchen
         end
 
         info "Resource Template deployment reached end state of '#{deployment_provisioning_state}'."
-        show_failed_operations(resource_group, deployment_name) if deployment_provisioning_state == "Failed"
+        return if deployment_provisioning_state == "Succeeded"
+
+        show_failed_operations(resource_group, deployment_name)
+        raise "Deployment '#{deployment_name}' in resource group '#{resource_group}' " \
+              "ended in state '#{deployment_provisioning_state}'."
       end
 
       # Raises with the status messages of every failed operation in a deployment.
       #
+      # Returns quietly when no single operation reported a failure, leaving
+      # the caller to raise: a deployment can fail without one, and its own
+      # provisioning state is the authority on whether it worked.
+      #
       # @param resource_group [String] the resource group name.
       # @param deployment_name [String] the deployment name.
       # @return [void]
@@ -838,11 +870,20 @@ module Kitchen
 
       # The full first-boot script handed to a Windows VM as custom data.
       #
+      # A Windows VM has exactly one custom data slot, and the driver needs it
+      # for the WinRM bootstrap. Any +custom_data+ the user configured has to
+      # travel in the same slot, so it is appended here rather than assigned
+      # over the top - which is what used to happen, silently discarding it.
+      #
+      # It runs after WinRM is listening and the data disks are formatted, and
+      # before the logoff that ends the first-logon session.
+      #
       # @return [String]
       def custom_data_script_windows
         <<-EOH
   #{enable_winrm_powershell_script}
   #{format_data_disks_powershell_script}
+  #{custom_data_content}
   logoff
         EOH
       end
@@ -921,13 +962,30 @@ module Kitchen
           info "Using custom vnet: #{config[:vnet_id]}"
           virtual_machine_deployment_template_file("internal.erb", data.merge(
             vnet_id: config[:vnet_id],
-            subnet_id: config[:subnet_id],
+            subnet_ref: subnet_reference,
             public_ip: config[:public_ip],
             public_ip_sku: config[:public_ip_sku]
           ))
         end
       end
 
+      # Resource id of the subnet the network interface attaches to.
+      #
+      # +subnet_id+ has always held the subnet's *name*, resolved against
+      # +vnet_id+. The setting is named like a resource id and sits directly
+      # beside +vnet_id+, which really is one, so supplying a full subnet
+      # resource id is an easy mistake to make - and it used to be appended to
+      # the vnet id, leaving ARM to reject a path that appears nowhere in the
+      # user's kitchen.yml. Both spellings are accepted.
+      #
+      # @return [String]
+      def subnet_reference
+        subnet = config[:subnet_id].to_s
+        return subnet if subnet.start_with?("/subscriptions/")
+
+        "#{config[:vnet_id]}/subnets/#{subnet}"
+      end
+
       # Warns about settings that Azure retirements have made inoperable.
       #
       # @return [void]
@@ -975,9 +1033,33 @@ module Kitchen
 
       # The port(s) the configured transport connects on.
       #
-      # @return [Array<Integer>] 5985 and 5986 for WinRM, otherwise 22.
+      # The transport already knows which port it will dial, so a +port+ set on
+      # it is authoritative: assuming the default instead produced an instance
+      # nothing could reach, and left the user repeating the port in
+      # +open_ports+ to get in.
+      #
+      # WinRM keeps both standard ports regardless, because
+      # {#enable_winrm_powershell_script} creates both listeners whatever the
+      # transport was pointed at.
+      #
+      # @return [Array<Integer>]
       def transport_ports
-        instance.transport.name.to_s.casecmp("winrm") == 0 ? [5985, 5986] : [22]
+        configured = instance.transport[:port].to_i
+
+        if winrm_transport?
+          ([5985, 5986] + [configured]).reject(&:zero?).uniq
+        elsif configured == 0
+          [22]
+        else
+          [configured]
+        end
+      end
+
+      # Whether the instance is driven over WinRM.
+      #
+      # @return [Boolean]
+      def winrm_transport?
+        instance.transport.name.to_s.casecmp("winrm") == 0
       end
 
       # ARM security rules for the generated network security group.
@@ -1034,18 +1116,25 @@ module Kitchen
 
       # Base64-encoded custom data for the VM.
       #
-      # +custom_data+ may be either the literal content or a path to a file
-      # holding it.
-      #
       # @return [String, nil] nil when no +custom_data+ is configured.
       def prepared_custom_data
         return nil if config[:custom_data].nil?
 
-        @prepared_custom_data ||= if readable_file?(config[:custom_data])
-                                    Base64.strict_encode64(File.read(config[:custom_data]))
-                                  else
-                                    Base64.strict_encode64(config[:custom_data])
-                                  end
+        @prepared_custom_data ||= Base64.strict_encode64(custom_data_content)
+      end
+
+      # The configured custom data, as content.
+      #
+      # +custom_data+ may be either the literal content or a path to a file
+      # holding it, so this resolves whichever was given.
+      #
+      # @return [String] empty when no +custom_data+ is configured.
+      def custom_data_content
+        @custom_data_content ||= if readable_file?(config[:custom_data])
+                                   File.read(config[:custom_data])
+                                 else
+                                   config[:custom_data].to_s
+                                 end
       end
 
       private

data/lib/kitchen/driver/azurerm_version.rb

@@ -6,6 +6,6 @@ module Kitchen
     # driver and, with it, the whole Azure SDK.
     #
     # @return [String]
-    AZURERM_VERSION = "2.0.0".freeze
+    AZURERM_VERSION = "2.1.2".freeze
   end
 end

data/templates/internal.erb

@@ -176,13 +176,12 @@
         "location": "[parameters('location')]",
         "nicName": "[parameters('nicName')]",
         "nsgName": "[concat(parameters('nicName'), '-nsg')]",
-        "subnetName": "<%= subnet_id %>",
         "publicIPAddressName": "publicip",
         "vmName": "[parameters('vmName')]",
         "vmSize": "[parameters('vmSize')]",
         "vmIdentityType": "[if(parameters('systemAssignedIdentity'), if(empty(parameters('userAssignedIdentities')), 'SystemAssigned', 'SystemAssigned, UserAssigned'), if(empty(parameters('userAssignedIdentities')), 'None', 'UserAssigned'))]",
         "vnetID": "<%= vnet_id %>",
-        "subnetRef": "[concat(variables('vnetID'),'/subnets/',variables('subnetName'))]"
+        "subnetRef": "<%= subnet_ref %>"
     },
     "resources": [
         {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kitchen-azurerm
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.2
 platform: ruby
 authors:
 - Stuart Preston