无法在现有的azure vnet子网中部署Azure Api管理

Question

我正在尝试在现有 vnet 子网中部署 API 管理。它是一个内部 API 管理网关 stv2，因此我必须提供公共 IP，并且需要公共 IP 地址才能使用可用区域，因为我的服务位于虚拟网络中”。其他团队已经设置了所需的基础设施，例如 vnet、子网、功能APP等。问题是当我尝试使用公共IP部署API管理时，它会抛出错误消息。请建议如何解决这个问题？

数据块部分

data "azurerm_resource_group" "rg" {
  name = "azdlgleuw-rg-sharatapigw-001"
}
    
data "azurerm_virtual_network" "virtualnetwork" {
  name                = "azdlgleuw-vnet-sharatapigw-001"
  resource_group_name = data.azurerm_resource_group.rg.name
}

data "azurerm_subnet" "apisubnet" {
  name                 = "azdlgleuw-snet-sharatapigw-001"
  resource_group_name  = data.azurerm_resource_group.rg.name
  virtual_network_name = data.azurerm_virtual_network.virtualnetwork.name
}

资源块

resource "azurerm_public_ip" "api-pip" {
    allocation_method   = "Static"
    location            = data.azurerm_resource_group.rg.location
    name                = "azdlgleuw-pip-publicip-001"
    resource_group_name = data.azurerm_resource_group.rg.name
    sku                 = "Standard"
    zones = [1,2,3]
    sku_tier                = "Regional"
    idle_timeout_in_minutes = 4
    ip_version              = "IPv4"
    domain_name_label   = "azure-api-sharatapigw-001"
}

创建API管理资源

resource "azurerm_api_management" "apim" {
  name                 = "azdlgleuw-apim-apimngname-001"
  resource_group_name  = data.azurerm_resource_group.rg.name
  location             = data.azurerm_resource_group.rg.location
  publisher_name       = "sharat"
  publisher_email      = "[email protected]"
  virtual_network_type = "Internal"
  sku_name             = "Developer_1"

  virtual_network_configuration {
    subnet_id = data.azurerm_subnet.apisubnet.id
  }

  public_ip_address_id = azurerm_public_ip.api-pip.id
}


resource "azurerm_api_management_api" "sharatapimgmntapi" {
  name                = "azdlgleuw-apim-apimgmntapi-001"
  resource_group_name = data.azurerm_resource_group.rg.name
  api_management_name = azurerm_api_management.apim.name
  revision            = "1"
  display_name        = "sharat-api"
  path                = "extranet/v1"
  protocols           = ["https"]

  import {
    content_format = "openapi"
    content_value  = file("${path.module}/openapi.yaml")
  }  
}

resource "azurerm_api_management_api_policy" "example" {
  api_name            = azurerm_api_management_api.sharatapimgmntapi.name
  api_management_name = azurerm_api_management.apim.name
  resource_group_name = data.azurerm_resource_group.rg.name

  xml_content = <<XML
<policies>
  <inbound>
    <base />
    <set-backend-service base-url="https://azure-api-sharatapigw-001.azurewebsites.net/api" />
  </inbound>
</policies>
XML
}

错误信息：

错误：创建/更新服务（订阅：“xxxxxxxxxxxxxx” │ 资源组名称：“azdlgleuw-rg-sharatapigw-001” │ 服务名称：“azure-api-sharatapigw-001”）：执行 CreateOrUpdate：意外状态 400（400 错误请求），错误：InvalidParameters：无效参数：在使用虚拟的 API 管理服务部署中将

subnetResourceId

更新为

/subscriptions/xxxxxxxx/resourceGroups/azdlgleuw-rg-sharatapigw-001/providers/Microsoft.Network/virtualNetworks/azdlgleuw-vnet-sharatapigw-001/subnets/azdlgleuw-snet-sharatapigw-001

时配置网络

Internal

，位置

West Europe

中的公共 IP 地址属性必须与

/subscriptions/xxxxxxxxxxxxx/resourceGroups/azdlgleuw-rg-sharatapigw-001/providers/Microsoft.Network/publicIPAddresses/azdlgleuw-pip-publicip-001

不同，并且不应与任何现有位置（西欧）匹配，因为我们需要创建新部署以避免停机。

Answer 1

无法在现有的 azure vnet 子网中部署 Azure Api 管理：

1. 在将 API 管理服务连接到子网之前，请验证之前创建的子网和当前创建的 API 管理服务位于同一区域。如果您想使用现有的，则两者应该位于同一区域。
2. 此外，要将 API 管理服务部署到现有子网中，需要有一个与该子网关联的网络安全组。

注意：通过门户关联，然后再次尝试部署即可成功。

经过上述检查后，我尝试了您的要求，部署成功如下图。

provider "azurerm"{
features{}
}
data "azurerm_resource_group" "rg" {
  name = "jahresources"
}
    
data "azurerm_virtual_network" "virtualnetwork" {
  name                = "westvnet"
  resource_group_name = data.azurerm_resource_group.rg.name
}

data "azurerm_subnet" "apisubnet" {
  name                 = "default2west"
  resource_group_name  = data.azurerm_resource_group.rg.name
  virtual_network_name = data.azurerm_virtual_network.virtualnetwork.name
}
resource "azurerm_public_ip" "api-pip" {
    allocation_method   = "Static"
    location            = data.azurerm_resource_group.rg.location
    name                = "azdlgleuw-pip-publicip-001"
    resource_group_name = data.azurerm_resource_group.rg.name
    sku                 = "Standard"
    zones = [1,2,3]
    sku_tier                = "Regional"
    idle_timeout_in_minutes = 4
    ip_version              = "IPv4"
    domain_name_label   = "azure-api-sharatapigw-001"
}
resource "azurerm_api_management" "apim" {
  name                 = "azdlgleuw-apim-apijah-001"
  resource_group_name  = data.azurerm_resource_group.rg.name
  location             = data.azurerm_resource_group.rg.location
  publisher_name       = "sharat"
  publisher_email      = "[email protected]"
  virtual_network_type = "Internal"
  sku_name             = "Developer_1"

  virtual_network_configuration {
    subnet_id = data.azurerm_subnet.apisubnet.id
  }

  public_ip_address_id = azurerm_public_ip.api-pip.id
}


resource "azurerm_api_management_api" "sharatapimgmntapi" {
  name                = "azdlgleuw-apim-apimgmjah-001"
  resource_group_name = data.azurerm_resource_group.rg.name
  api_management_name = azurerm_api_management.apim.name
  revision            = "1"
  display_name        = "sharat-api"
  path                = "extranet/v1"
  protocols           = ["https"]  
}

resource "azurerm_api_management_api_policy" "example" {
  api_name            = azurerm_api_management_api.sharatapimgmntapi.name
  api_management_name = azurerm_api_management.apim.name
  resource_group_name = data.azurerm_resource_group.rg.name

  xml_content = <<XML
<policies>
  <inbound>
    <base />
    <set-backend-service base-url="https://azure-api-sharatapigw-001.azurewebsites.net/api" />
  </inbound>
</policies>
XML
}

输出：