Allow parent resources to be redeployed while leaving their child resources alone

[fschmied]

Is your feature request related to a problem? Please describe.
Whenever I redeploy a VNET using Azure Bicep, it will clear out all subnets in the VNET that are not explicitly listed in the VNET resource definition. This prevents me from partitioning my resource definitions into logical groups that can be separately deployed (and redeployed), which is a common strategy with infrastructure as code approaches. (For reference, see, e.g., the "stack" patterns from the "Infrastructure as Code" book by Kief Morris.)

There is a similar situation with AKS cluster deployments, which require details about all node pools.

This has also been discussed in #4023 (comment), but I'm creating a new issue because #4023 originally came from a different angle.

I also want to mention #5806 (which I created), which is also from a slightly different perspective, but might show there are different issues that all relate to the higher goal of being able to partition infrastructure definitions into smaller units.

Describe the solution you'd like
I would like to have a way to define a resource in such a way that the Azure Resource Manager will either leave existing child resources alone, if any, or merge them with what I have declared.

In #4023 (comment), an upsert modifier was mentioned, this would work well.
An alternative would be a merge keyword as mentioned in #5806.

[alex-frankel]

In general, you can deploy parent resources without affecting child resources (i.e. sql servers & databases). The reason this happens for VNETs is because subnets were originally modelled as a property on the vnet resource, then later they added the ability to deploy subnets as a child resource, so when you redeploy a vnet, the networking RP think you are asking for an empty vnet since the subnets property is empty. It's a long standing issue with a long discussion here: Azure/azure-quickstart-templates#2786

I'm not as familiar with the AKS node pools example, do you have a full code sample?

[fschmied]

@alex-frankel Thank you for pointing me to that existing issue on VNETs. So this is actually a problem in the specific resource provider rather than a general design issue.

I wonder if Bicep/ARM could and should still provide a mechanism to work around the issue? Apparently, the VNET problem is not going to be fixed (assuming the team responsible is even aware of it). In addition, the workaround might provide additonal benefits, e.g., also support #5806 and similar.

[fschmied]

I'm not as familiar with the AKS node pools example, do you have a full code sample?

I've actually only run into the VNET problem myself (and #5806, which, however, is not a child resource). The AKS issue is detailed in #4023 (comment) .

[fschmied]

To follow up on this: We've since encountered this problem also on Load Balancers (frontend IP configurations), NSGs (rules), and Storage Accounts (virtual network rules). We always need to fall back to scripting for those resources 🙁 .