feat: network module redesign for future growth

[mishraomp]

This changeset replaces the computed offset-based subnet allocation with an explicit subnet_allocation map-of-maps variable, adds external VNet peered project NSG rules, implements per-tenant PE subnet selection via pe_subnet_key, and updates all stacks, tenant configs, docs, and workflows accordingly.

AI Hub Infra Changes

Summary: 1 to add, 3 to change, 0 to destroy (across 2 stack(s))

Show plan details

Terraform will perform the following actions:

  # module.network.azapi_resource.private_endpoints_subnet has moved to module.network.azapi_resource.pe_subnets["privateendpoints-subnet"]
    resource "azapi_resource" "pe_subnets" {
        id                        = "/subscriptions/****/resourceGroups/da4cf6-test-networking/providers/Microsoft.Network/virtualNetworks/da4cf6-test-vwan-spoke/subnets/privateendpoints-subnet"
        name                      = "privateendpoints-subnet"
        # (11 unchanged attributes hidden)
    }

  # module.network.azurerm_network_security_group.aca[0] will be updated in-place
  ~ resource "azurerm_network_security_group" "aca" {
        id                  = "/subscriptions/****/resourceGroups/da4cf6-test-networking/providers/Microsoft.Network/networkSecurityGroups/ai-services-hub-test-aca-nsg"
        name                = "ai-services-hub-test-aca-nsg"
      ~ security_rule       = [
          - {
              - access                                     = "Allow"
              - destination_address_prefix                 = "AzureActiveDirectory"
              - destination_address_prefixes               = []
              - destination_application_security_group_ids = []
              - destination_port_range                     = "443"
              - destination_port_ranges                    = []
              - direction                                  = "Outbound"
              - name                                       = "AllowAadOutbound"
              - priority                                   = 120
              - protocol                                   = "Tcp"
              - source_address_prefix                      = "VirtualNetwork"
              - source_address_prefixes                    = []
              - source_application_security_group_ids      = []
              - source_port_range                          = "*"
              - source_port_ranges                         = []
                # (1 unchanged attribute hidden)
            },
          - {
              - access                                     = "Allow"
              - destination_address_prefix                 = "AzureContainerRegistry"
              - destination_address_prefixes               = []
              - destination_application_security_group_ids = []
              - destination_port_range                     = "443"
              - destination_port_ranges                    = []
              - direction                                  = "Outbound"
              - name                                       = "AllowAcrOutbound"
              - priority                                   = 100
              - protocol                                   = "Tcp"
              - source_address_prefix                      = "VirtualNetwork"
              - source_address_prefixes                    = []
              - source_application_security_group_ids      = []
              - source_port_range                          = "*"
              - source_port_ranges                         = []
                # (1 unchanged attribute hidden)
            },
          - {
              - access                                     = "Allow"
              - destination_address_prefix                 = "AzureMonitor"
              - destination_address_prefixes               = []
              - destination_application_security_group_ids = []
              - destination_port_range                     = "443"
              - destination_port_ranges                    = []
              - direction                                  = "Outbound"
              - name                                       = "AllowMonitorOutbound"
              - priority                                   = 110
              - protocol                                   = "Tcp"
              - source_address_prefix                      = "VirtualNetwork"
              - source_address_prefixes                    = []
              - source_application_security_group_ids      = []
              - source_port_range                          = "*"
              - source_port_ranges                         = []
                # (1 unchanged attribute hidden)
            },
          - {
              - access                                     = "Allow"
              - destination_address_prefix                 = "VirtualNetwork"
              - destination_address_prefixes               = []
              - destination_application_security_group_ids = []
              - destination_port_range                     = "*"
              - destination_port_ranges                    = []
              - direction                                  = "Inbound"
              - name                                       = "AllowVnetInbound-10-46-136-0-24"
              - priority                                   = 200
              - protocol                                   = "*"
              - source_address_prefix                      = "10.46.136.0/24"
              - source_address_prefixes                    = []
              - source_application_security_group_ids      = []
              - source_port_range                          = "*"
              - source_port_ranges                         = []
                # (1 unchanged attribute hidden)
            },
          - {
              - access                                     = "Allow"
              - destination_address_prefix                 = "VirtualNetwork"
              - destination_address_prefixes               = []
              - destination_application_security_group_ids = []
              - destination_port_range                     = "*"
              - destination_port_ranges                    = []
              - direction                                  = "Inbound"
              - name                                       = "AllowVnetInbound-10-46-82-0-24"
              - priority                                   = 201
              - protocol                                   = "*"
              - source_address_prefix                      = "10.46.82.0/24"
              - source_address_prefixes                    = []
              - source_application_security_group_ids      = []
              - source_port_range                          = "*"
              - source_port_ranges                         = []
                # (1 unchanged attribute hidden)
            },
          + {
              + access                                     = "Allow"
              + destination_address_prefix                 = "VirtualNetwork"
              + destination_address_prefixes               = []
              + destination_application_security_group_ids = []
              + destination_port_range                     = "443"
              + destination_port_ranges                    = []
              + direction                                  = "Outbound"
              + name                                       = "AllowVirtualNetworkOutbound"
              + priority                                   = 130
              + protocol                                   = "Tcp"
              + source_address_prefix                      = "VirtualNetwork"
              + source_address_prefixes                    = []
              + source_application_security_group_ids      = []
              + source_port_range                          = "*"
              + source_port_ranges                         = []
                # (1 unchanged attribute hidden)
            },
          + {
              + access                                     = "Allow"
              + destination_address_prefix                 = "AzureActiveDirectory"
              + destination_address_prefixes               = []
              + destination_application_security_group_ids = []
              + destination_port_range                     = "443"
              + destination_port_ranges                    = []
              + direction                                  = "Outbound"
              + name                                       = "AllowAadOutbound"
              + priority                                   = 120
              + protocol                                   = "Tcp"
              + source_address_prefix                      = "VirtualNetwork"
              + source_address_prefixes                    = []
              + source_application_security_group_ids      = []
              + source_port_range                          = "*"
              + source_port_ranges                         = []
            },
          + {
              + access                                     = "Allow"
              + destination_address_prefix                 = "AzureContainerRegistry"
              + destination_address_prefixes               = []
              + destination_application_security_group_ids = []
              + destination_port_range                     = "443"
              + destination_port_ranges                    = []
              + direction                                  = "Outbound"
              + name                                       = "AllowAcrOutbound"
              + priority                                   = 100
              + protocol                                   = "Tcp"
              + source_address_prefix                      = "VirtualNetwork"
              + source_address_prefixes                    = []
              + source_application_security_group_ids      = []
              + source_port_range                          = "*"
              + source_port_ranges                         = []
            },
          + {
              + access                                     = "Allow"
              + destination_address_prefix                 = "AzureMonitor"
              + destination_address_prefixes               = []
              + destination_application_security_group_ids = []
              + destination_port_range                     = "443"
              + destination_port_ranges                    = []
              + direction                                  = "Outbound"
              + name                                       = "AllowMonitorOutbound"
              + priority                                   = 110
              + protocol                                   = "Tcp"
              + source_address_prefix                      = "VirtualNetwork"
              + source_address_prefixes                    = []
              + source_application_security_group_ids      = []
              + source_port_range                          = "*"
              + source_port_ranges                         = []
            },
          + {
              + access                                     = "Allow"
              + destination_address_prefix                 = "VirtualNetwork"
              + destination_address_prefixes               = []
              + destination_application_security_group_ids = []
              + destination_port_range                     = "*"
              + destination_port_ranges                    = []
              + direction                                  = "Inbound"
              + name                                       = "AllowVnetInbound-10-46-136-0-24"
              + priority                                   = 200
              + protocol                                   = "*"
              + source_address_prefix                      = "10.46.136.0/24"
              + source_address_prefixes                    = []
              + source_application_security_group_ids      = []
              + source_port_range                          = "*"
              + source_port_ranges                         = []
            },
          + {
              + access                                     = "Allow"
              + destination_address_prefix                 = "VirtualNetwor
(truncated, see workflow logs for complete plan)

---

Updated by CI — plan against test environment (run #237) at 2026-03-03 00:27:34 UTC.