Unable to create 2 Gateway Subnet reference in virtualnetworkgateway

[vronnG]

Describe the bug

When attempting to create multiple Virtual Network Gateways in the same subscription/resource group (Same namespace), we encounter issues with naming constraints on the GatewaySubnet. The Virtual Network Gateway can only be created in a subnet named GatewaySubnet, which leads to conflicts when trying to set up gateways for multiple VNets within the same resource group.

apiVersion: network.azure.com/v1api20201101
kind: VirtualNetworksSubnet
metadata:
  name: gatewaysubnet 
  namespace: sandbox
spec:
  addressPrefix: 10.x.x.x/27
  owner:
    name: vnet1
---
apiVersion: network.azure.com/v1api20201101
kind: VirtualNetworksSubnet
metadata:
  name: gatewaysubnet 
  namespace: sandbox
spec:
  addressPrefix: 10.x.x.x/27
  owner:
    name: vnet2

# How to reference vnet1 gateway ??

apiVersion: network.azure.com/v1api20240301
kind: VirtualNetworkGateway
metadata:
  name: gw-test
  namespace: sandbox
spec:
  location: westus3
  gatewayType: ExpressRoute
  ipConfigurations:
    - name: default
      subnet:
        reference:
          group: network.azure.com
          kind: VirtualNetworksSubnet
          name: gatewaysubnet 
  owner:
    name: rg-networking

# How to reference vnet2 gateway ??

apiVersion: network.azure.com/v1api20240301
kind: VirtualNetworkGateway
metadata:
  name: gw-test
  namespace: sandbox
spec:
  location: westus3
  gatewayType: ExpressRoute
  ipConfigurations:
    - name: default
      subnet:
        reference:
          group: network.azure.com
          kind: VirtualNetworksSubnet
          name: gatewaysubnet 
  owner:
    name: rg-networking

Virtual Network Gateway can only be created in subnet with name 'GatewaySubnet

To Reproduce

• Create two VNets in the same subscription/resource group (e.g., vnet1 and vnet2).
• No Peering between 2
• In both VNets, create a subnet named GatewaySubnet. (Note: The Virtual Network Gateway requires the subnet to be specifically named GatewaySubnet).
• Attempt to create the subnet with the same name which will fail because of the same name conflict and hence unable to create Virtual Network Gateway for both VNets.

Problem

Issue 1: It's not possible to create two subnets with the same name (GatewaySubnet) within the same subscription/resource group(Same namespace), even though the subnets are in different VNets.
Issue 2: It’s unclear how to create Virtual Network Gateways for multiple VNets within the same resource group(Same namespace) when both require a subnet named GatewaySubnet.

Virtual Network Gateway can only be created in subnet with name 'GatewaySubnet

Expected behavior

It should be possible to create Virtual Network Gateways for multiple VNets, even if they are in the same subscription/resource group, by allowing each VNet to have a GatewaySubnet without conflict.

[theunrepentantgeek]

If you use kubectl to list VirtualNetworksSubnet you'll find that you currently have only one - because they both have the name gatewaysubnet, the second one overwrites the first.

Fortunately, you can give them different names in the cluster, while still having them called gatewaysubnet in Azure - all ASO resources have an azureName property for precisely this kind of situation.

Try this:

apiVersion: network.azure.com/v1api20201101
kind: VirtualNetworksSubnet
metadata:
  name: gatewaysubnet-vnet1
  namespace: sandbox
spec:
  addressPrefix: 10.x.x.x/27
  owner:
    name: vnet1
  azureName: GatewaySubnet
---
apiVersion: network.azure.com/v1api20201101
kind: VirtualNetworksSubnet
metadata:
  name: gatewaysubnet-vnet2
  namespace: sandbox
spec:
  addressPrefix: 10.x.x.x/27
  owner:
    name: vnet2
  azureName: GatewaySubnet

I've given each subnet a unique name within the cluster, but they both have azureName: GatewaySubnet for when they're created in Azure.

Then you can create your gateway for vnet1 with

apiVersion: network.azure.com/v1api20240301
kind: VirtualNetworkGateway
metadata:
  name: gw-test
  namespace: sandbox
spec:
  location: westus3
  gatewayType: ExpressRoute
  ipConfigurations:
    - name: default
      subnet:
        reference:
          group: network.azure.com
          kind: VirtualNetworksSubnet
          name: gatewaysubnet-vnet1
  owner:
    name: rg-networking

and similarly for the other gateway:

apiVersion: network.azure.com/v1api20240301
kind: VirtualNetworkGateway
metadata:
  name: gw-test
  namespace: sandbox
spec:
  location: westus3
  gatewayType: ExpressRoute
  ipConfigurations:
    - name: default
      subnet:
        reference:
          group: network.azure.com
          kind: VirtualNetworksSubnet
          name: gatewaysubnet-vnet2
  owner:
    name: rg-networking

Note: I've hand modified these yaml fragments without testing, check for typos.

Let us know how you get on.

[vronnG]

Make sense. Thanks for clarifying this. Closing this issue.