使用 terraform VM 扩展的 Azure 磁盘加密 - 强制替换 [第二次运行]

Question

我创建了以下资源来加密虚拟机的“所有”磁盘，到目前为止效果很好：

resource "azurerm_virtual_machine_extension" "vm_encry_win" {
  count                         = "${var.vm_encry_os_type == "Windows" ? 1 : 0}"
  name                          = "${var.vm_encry_name}"
  location                      = "${var.vm_encry_location}"
  resource_group_name           = "${var.vm_encry_rg_name}"
  virtual_machine_name          = "${var.vm_encry_vm_name}"
  publisher                     = "${var.vm_encry_publisher}"
  type                          = "${var.vm_encry_type}"
  type_handler_version          = "${var.vm_encry_type_handler_version == "" ? "2.2" : var.vm_encry_type_handler_version}"
  auto_upgrade_minor_version    = "${var.vm_encry_auto_upgrade_minor_version}"
  tags                          = "${var.vm_encry_tags}"

  settings = <<SETTINGS
                {
                    "EncryptionOperation":      "${var.vm_encry_operation}",
                    "KeyVaultURL":              "${var.vm_encry_kv_vault_uri}",
                    "KeyVaultResourceId":       "${var.vm_encry_kv_vault_id}",
                    "KeyEncryptionKeyURL":      "${var.vm_encry_kv_key_url}",
                    "KekVaultResourceId":       "${var.vm_encry_kv_vault_id}",
                    "KeyEncryptionAlgorithm":   "${var.vm_encry_key_algorithm}",
                    "VolumeType":               "${var.vm_encry_volume_type}"
                }
             SETTINGS
}

当我第一次运行时 - 对操作系统和数据磁盘都进行了 ADE 加密。 但是，当我使用 terraform plan 或 terraform apply 重新运行 terraform 时，它想要替换我已经创建的所有数据磁盘，如下面的屏幕截图所示。

我不知道如何解决。而且我已经创建的磁盘不应被替换。 我检查了

ignore_chnages

的线条

lifecycle {
        ignore_changes = [encryption_settings]
    }

我不确定在哪里添加或者此参考是否真正解决了问题？ 我应该添加哪个资源块。 或者还有别的办法吗？

Answer 1

resource "azurerm_virtual_machine_extension" "vm_encry_win" {
  count                         = var.vm_encry_os_type == "Windows" ? 1 : 0
  name                          = var.vm_encry_name
  location                      = var.vm_encry_location
  resource_group_name           = var.vm_encry_rg_name
  virtual_machine_name          = var.vm_encry_vm_name
  publisher                     = var.vm_encry_publisher
  type                          = var.vm_encry_type
  type_handler_version          = var.vm_encry_type_handler_version == "" ? "2.2" : var.vm_encry_type_handler_version
  auto_upgrade_minor_version    = var.vm_encry_auto_upgrade_minor_version
  tags                          = var.vm_encry_tags

  settings = jsonencode({
    EncryptionOperation      = var.vm_encry_operation
    KeyVaultURL              = var.vm_encry_kv_vault_uri
    KeyVaultResourceId       = var.vm_encry_kv_vault_id
    KeyEncryptionKeyURL      = var.vm_encry_kv_key_url
    KekVaultResourceId       = var.vm_encry_kv_vault_id
    KeyEncryptionAlgorithm   = var.vm_encry_key_algorithm
    VolumeType               = var.vm_encry_volume_type
  })

  lifecycle {
    ignore_changes = [
      settings,     # This prevents unnecessary replacement for updates to the settings block
    ]
  }
}

在此更新的代码中，ignore_changes 属性用于设置块。这将防止 Terraform 在未来更新期间当设置块发生更改时更换数据磁盘。