[pyoor]

Adds job-delete permission to the fuzzing Batch janitor role so cleanup can force-delete expired jobs before deleting their pools, avoiding stalled cleanup when a node is unreachable.

[markcor]

@pyoor, any reason I shouldn't apply this change?

[pyoor]

@markcor Nope, it's ready to land. Thanks!

[markcor]

@pyoor The Terraform plan detects that fuzzing-agent-subnet was deleted outside Terraform. Applying the full plan as-is would:

• Add Microsoft.Batch/batchAccounts/jobs/delete to the Fuzzing Batch harness janitor role, as intended by this PR.
• Recreate fuzzing-agent-subnet (10.1.3.0/24) in the clauditor-run-vnet virtual network, resource group clauditor, with default outbound access disabled.
• Recreate its association with fuzzing-agent-subnet-nsg.
• Recreate its association with fuzzing-agent-subnet-routes.
• Destroy and recreate the subnet_join role assignment on that subnet.

The plan totals 4 to add, 1 to change, 1 to destroy. No apply has been run as part of this work.

Do you want that subnet and its associations/role assignment restored, or was its deletion intentional and we should keep this apply limited to the janitor permission change?

[pyoor]

In response to the Terraform drift: please restore fuzzing-agent-subnet, its NSG and route-table associations, and the subnet-join role assignment, then apply the janitor job-delete permission.

The subnet’s removal was unintended. Azure history shows a November 2 operator VNet update removed it. The Windows isolation branch already includes a fix to preserve additional subnets during reconciliation.

[markcor]

Changes appplied.