# Virtual Network

> zop.dev creates the azurerm_virtual_network and nothing else, with address_space defaulting to 10.0.0.0/16; subnets, NSGs, and public IPs arrive later with the AKS module. Address space is the long-shadow decision: overlapping ranges block future peering, while the VNet itself carries no charge of its own.

Source: https://zop.dev/integrations/provision/azure/virtual-network
Updated: 2026-08-19

---

An Azure Virtual Network is the address space your Azure resources live in. zop.dev creates the VNet as the networking foundation for AKS and database provisioning.

## azurerm_virtual_network and nothing else

azurerm_virtual_network only.

## Address space defaults to 10.0.0.0/16

```text
resource_group_name; vnet name; address_space default 10.0.0.0/16.
```

## The README overstates the module's scope

The module creates the VNet only: no subnets, NSGs, or public IPs here (the module README overstates its scope). Subnet-level resources come with the AKS module.

## A deliberately small module

The module creates the virtual network and stops. There are no subnets, no network security
groups, and no public IPs, despite what its own README claims. Those arrive with the AKS module, which carves
subnet-level resources out of the address space this module reserves. The split is worth
understanding when auditing: an empty-looking VNet provisioned here is not misconfigured, it
is a foundation waiting for a cluster, and the interesting networking objects will be
attributed to cluster provisioning rather than to this module.

## Choose the address space like it is permanent

`address_space` defaults to 10.0.0.0/16, or 65,536 addresses, which is plenty until it collides.
Peering is where the decision comes due: two networks with overlapping ranges cannot be
peered, on Azure or to anything else, and defaults collide with defaults. If this VNet will
ever meet another network (a hub, a partner, a second environment, a VPN to an office),
allocate from an organization-wide plan now. Renumbering later means rebuilding everything
that lives inside, because subnets and their tenants embed the range.

## Free until traffic moves

A virtual network costs nothing to exist: no hourly rate, no per-VNet fee, nothing for the
address space. Money enters with movement: peering charges per GB crossing it, NAT and load
balancers bill as they arrive with the cluster, and egress to the internet is metered. That
makes the VNet itself the rare resource safe to create early and leave standing. The
constraint it carries is not cost but the address decision above: free to hold, expensive to
re-decide.