[azure provider] Juju purges resource group VMs and other resources that do not belong to it

[Peter De Sousa]

Hi,

[Problem]

When bootstrapping juju on azure if the bootstrap fails, juju will kill all resources inside that Resource Group (But keep the Resource Group)

[Reproducer]

1. Create a resource group (Outside of juju)

2. Configure the Azure Resource group via Policies to disable public IPs (This should cause juju to fail bootstrap)

3. Create a VM in that resource group as a jumphost

4. Follow juju docs to connect azure, preferably with an Azure Service Principal that has permissions to operate on the Resource Group

5. Bootstrap: juju bootstrap --debug --config use-public-ip=true --config resource-group-name=JujuControllerRG --config network=SPOKE_NET/JujuControllerVNET /SUBNET --no-default-model azure/westeurope azure-controller

The important part here is for juju to fail bootstrapping then begin cleanup.

[Workarounds]

None at time of writing

[Peter De Sousa (pjds)]

Attached is the JSON dump from Azure showing the actions triggered by the Service Principal operated by juju.

[Peter De Sousa (pjds)]

Screenshot of Activity Log in azure showing VMs being deleted

[Pedro Guimarães (pguimaraes)]

I believe this line is the root-cause of this issue: https://github.com/juju/juju/blob/e9031cdcff02105d07f89d309577a567933655d4/provider/azure/environ.go#L1834

[Ian Booth (wallyworld)]

purge was originally done because of a misplaced understanding that a BYO RG would be created empty specifically for that juju model; it is non-trivial for juju to figure out the dependencies so as to know what order to delete things in, but that's something that will need to be done.

[Ian Booth (wallyworld)]

This is for 2.8
https://github.com/juju/juju/pull/12313