title | description | ms.date | ms.service | ms.custom | ms.reviewer |
---|---|---|---|---|---|
Can't delete a virtual network or subnet used by ACI |
Discusses how to troubleshoot failures when you delete a virtual network or subnet used by Azure Container Instances (ACI). |
01/24/2024 |
container-instances |
sap:Connectivity, devx-track-azurecli |
tysonfreeman, v-weizhu |
This article discusses errors that occur when you delete a virtual network (VNet) or subnet used by Azure Container Instances (ACI) and provides workarounds.
-
When you delete a subnet used by ACI, you receive errors that resemble the following ones:
Failed to delete subnet '<subnet-name>'. Error: 'Subnet /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/<subnet-name> requires any of the following delegations [Microsoft.ContainerInstance/containerGroups] to reference service association link / subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/<subnet-name>/serviceAssociationLinks/acisal.'
Subnet <subnet-name> is in use by /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkProfiles/aci-network-profile-<network-profile-name>/containerNetworkInterfaceConfigurations/eth0/ipConfigurations/ipconfigprofile and cannot be deleted. In order to delete the subnet, delete all the resources within the subnet. See aka.ms/deletesubnet.
Failed to delete subnet '<subnet-name>'. Error: Subnet <subnet-name> is in use by /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/networkProfiles/aci-network-profile-<network-profile-name>/containerNetworkInterfaceConfigurations/eth0/ipConfigurations/ipconfigprofile/aci-network-profile-<network-profile-name>/eth0/ipconfigprofile and cannot be deleted. In order to delete the subnet, delete all the resources within the subnet. See aka.ms/deletesubnet.
-
When you delete a VNet used by ACI, you receive the following error:
Failed to delete virtual network '<vnet-name>'. Error: 'Subnet /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/<subnet-name> requires any of the following delegations [Microsoft.ContainerInstance/containerGroups] to reference service association link /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/<subnet-name>/serviceAssociationLinks/acisal.'
The subnet delegation required by ACI must reference a residual Service Association Link, which prevents the deletion of the VNet or subnet used by ACI.
-
Navigate to the subnet in the Azure portal.
-
Change the subnet delegation to None.
-
Delete network profiles using the
az network profile delete
command to make sure that no network profiles are linked to the subnet. -
If the command in step 3 fails, there might be a lingering network profile. To delete a lingering network profile, use the following command:
az network profile delete --id resourceIdOfNetworkProfile
-
If network profiles still block the subnet update, try to set the subnet delegation to None again.
-
If the previous steps don't help, try to delete the Service Association Link via the Azure CLI using a specified API version, such as version 2018-10-01:
az resource delete --ids /subscriptions/<subscription-id>/resourceGroups/<resourcegroup-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/<subnet-name>/providers/Microsoft.ContainerInstance/serviceAssociationLinks/default --api-version 2018-10-01
When you remove the container group, the network profile created by ACI during the container group creation might not be properly deleted. This results in something remaining within the VNet or subnet, which blocks certain delete operations.
After deleting all ACI container groups, follow these steps:
- Go to the resource group.
- Select Show hidden types. By default, network profiles are hidden in the Azure portal.
- Select the network profile related to the container group.
- Select Delete.
- Delete the VNet or subnet.
After deleting all ACI container groups, follow these steps:
-
Get the network profile ID:
NetworkProfile=$(az network vnet subnet show -g $RES_GROUP --vnet-name $VNET_NAME --name $SUBNET_NAME -o tsv --query ipConfigurationProfiles[].id)
-
Delete the network profile:
az network profile delete --ids $NetworkProfile --yes
-
Delete the subnet:
az network vnet subnet delete --resource-group $RES_GROUP --vnet-name $VNET_NAME --name $SUBNET_NAME
-
Delete the VNet:
az network vnet delete --resource-group $RES_GROUP --name $SUBNET_NAME
If deleting the network profile through the Azure portal and Azure CLI fails, update the network profile property containerNetworkInterfaceConfigurations
to an empty list:
-
Get the network profile ID:
NETWORK_PROFILE_ID=$(az network profile list --resource-group <resource-group-name> --query [0].id --output tsv)
-
Update the network profile:
az resource update --ids $NETWORK_PROFILE_ID --set properties.containerNetworkInterfaceConfigurations=[]
-
Delete the network profile and the subnet.
[!INCLUDE Azure Help Support]