Question about building Azure VM images without public IP

[Rajinder Singh]

I want to build VM images without using public IP.

Azure builder is documented here:

https://www.packer.io/docs/builders/azure.html

I will be setting these values:

• virtual_network_name (string) Use a pre-existing virtual network for the VM. This option enables private communication with the VM, no public IP address is used or provisioned (unless you set private_virtual_network_with_public_ip).

• virtual_network_resource_group_name (string) If virtual_network_name is set, this value may also be set. If virtual_network_name is set, and this value is not set the builder attempts to determine the resource group containing the virtual network. If the resource group cannot be found, or it cannot be disambiguated, this value should be set.

• virtual_network_subnet_name (string) If virtual_network_name is set, this value may also be set. If virtual_network_name is set, and this value is not set the builder attempts to determine the subnet to use with the virtual network. If the subnet cannot be found, or it cannot be disambiguated, this value should be set.

I will also set this value as I don't want azure service principal to be given contributor level access. This value allows us to limit access to a specific resource group.

• build_resource_group_name (string) - Specify an existing resource group to run the build in

I am assuming that packer service principal will also need access to virtual_network_resource_group_name.   What type of access is needed? Is this documented?

My build server where I am building packer images is located in a shared Virtual Network.

I was thinking of specifying using the same virtual network and subnet to build the image.

I want to understand how packer will use build_resource_group_name and still use a different virtual network in a different resource group.

How will it clean up network resources once it is done? Is it smart enough to clean up all resources in "build_resource_group_name" and network resources in "virtual_network_resource_group_name"

I am concerned that Packer build may wipe out all network resources in virtual_network_resource_group_name 

Can somebody explain how this will work?

Thanks

[Rajinder Singh]

I tested out and it worked fine. Packer was able to use build resource group and still use a different virtual network to create a vm with private IP.