如何在 terraform 中为 azurerm_subnet 添加子网委托块？

Question

我正在尝试使用 Terraform 为现有子网添加子网委托。我没有子网列表，因此实际上不需要迭代。但它应该取决于enable_delegation的布尔值。如果enable_delegation设置为true，terraform plan应该提示subnet_delegation的名称和操作分别作为两个输入。如果enable_delegation设置为false，它应该跳过并继续执行计划。

main.tf：

resource "azurerm_subnet" "subnet" {
  name                 = local.subnet_name
  resource_group_name  = var.resource_group_name
  virtual_network_name = var.virtual_network_name
  address_prefixes     = [local.subnet_address_prefixes]

  dynamic "subnet_delegation" {
    for_each = var.enable_delegation ? [1] : []
    content {
      name    = var.subnet_delegation.name
      actions = var.subnet_delegation.actions
    }
  }
  private_endpoint_network_policies_enabled     = var.private_endpoint_network_policies_enabled
  private_link_service_network_policies_enabled = var.private_link_service_network_policies_enabled
}

变量.tf：

variable "subnet_delegation" {
  type        = object({
    name  = string
    actions = list(string)
    })
  default     = {
    "name"  = "Microsoft.ContainerInstance/containerGroups"
    "actions" = ["Microsoft.Network/virtualNetworks/subnets/join/action",
        "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
        "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"]
  }
}

variable "enable_delegation" {
  type = bool
}

我尝试的另一种方法是：

  dynamic "delegation" {
    for_each = var.subnet_delegations != null ? true : false
    content {
      name = each.value["name"]
      service_delegation {
        name    = each.value["name"]
        actions = each.value["actions"]
      }
    }
  }

错误：

│错误：不支持的块类型 │ │ 在 main.tf 第 15 行，资源“azurerm_subnet”“subnet”中： │ 15: 动态“subnet_delegation”{ │ │ 这里不需要“subnet_delegation”类型的块。

这也不起作用。

如有任何线索，我们将不胜感激。谢谢您的帮助。

Answer 1

我尝试使用 Terraform 为 azurerm_subnet 添加子网委托块，并且能够成功配置要求。

您遇到的错误可能是由于

dynamic

块的错误使用或资源架构中的错误配置造成的。

azurerm_subnet

资源无法识别名为

subnet_delegation

的块。这可能是由于名称不正确或对 AzureRM Terraform 提供程序中资源的结构方式的误解造成的。

将

dynamic

块与

enable_delegation

的条件表达式一起使用是合适的。当

enable_delegation

为

true

时，包含

delegation

块；否则省略。

我的 Terraform 配置：

main.tf：

provider "azurerm" {
    features {}
}

resource "azurerm_resource_group" "example" {
  name     = var.resource_group_name
  location = "East US"
}

resource "azurerm_virtual_network" "example" {
  name                = var.virtual_network_name
  address_space       = ["10.0.0.0/16"]
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
}

resource "azurerm_subnet" "subnet" {
  name                 = var.subnet_name
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = var.subnet_address_prefixes

  dynamic "delegation" {
    for_each = var.enable_delegation ? [var.subnet_delegation] : []
    content {
      name    = delegation.value.name
      service_delegation {
        name    = delegation.value.name
        actions = delegation.value.actions
      }
    }
  }
}

变量.tf：

variable "resource_group_name" {
  type = string
}

variable "virtual_network_name" {
  type = string
}

variable "subnet_name" {
  type = string
}

variable "subnet_address_prefixes" {
  type = list(string)
}

variable "enable_delegation" {
  type    = bool
  default = false
}

variable "subnet_delegation" {
  type = object({
    name    = string
    actions = list(string)
  })
  default = {
    name    = "Microsoft.ContainerInstance/containerGroups"
    actions = [
      "Microsoft.Network/virtualNetworks/subnets/join/action",
      "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
      "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"
    ]
  }
}

terraform.tfvars：

resource_group_name     = "demorg-vk"
virtual_network_name    = "vkVNet"
subnet_name             = "vkSubnet"
subnet_address_prefixes = ["10.0.1.0/24"]

enable_delegation       = true

subnet_delegation = {
  name    = "Microsoft.ContainerInstance/containerGroups"
  actions = [
    "Microsoft.Network/virtualNetworks/subnets/join/action",
    "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
    "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"
  ]
}

输出：