azure - Terraform 没有按正确的顺序销毁 Frontdoor 资源。我怎样才能解决这个问题？

Question

我最近在 Terraform 中构建 Frontdoor，这是一个相当大的挑战。我已经成功构建了它，但现在我需要销毁它，问题是由于某种原因，Terraform 会尝试在销毁 DNS 记录之前销毁前门实例，这确实破坏了尝试在 Terraform 中构建所有这些的目标对于我们来说。

这是因为我最初使用的是门户网站，并且出现了同样的错误。

Front Door Name: "testingfrontdoor"): performing Delete:frontdoors.FrontDoorsClient#Delete: Failure sending request:StatusCode=0 -- Original Error: autorest/azure: Service returned anerror. Status= Code="Conflict" Message="Cannot delete frontendendpoint "portal-staging.jason.website" because it is still directlyor indirectly (using "afdverify" prefix) CNAMEd to front door"testingfrontdoor.azurefd.net". Please remove the DNS CNAME recordsand try again."

如果您尝试在删除 DNS CNAME 之前删除前门实例，因为按照设计，Frontdoor 会进行查找以查看 DNS 记录是否仍然存在，它将无法删除。

如何告诉 terraform 在删除 Frontdoor 之前先使用 Cloudflare 删除 DNS 记录？

请参阅下面的代码:

resource "azurerm_frontdoor" "jccroutingrule" {
  depends_on = [
    cloudflare_record.create_frontdoor_CNAME,
    azurerm_key_vault.jctestingenv_keyvault,
    azurerm_key_vault_certificate.jcimportedcert
  ]
  name                = "testingfrontdoor"
  resource_group_name = azurerm_resource_group.Terraform.name
  #enforce_backend_pools_certificate_name_check = false
  routing_rule {
    name               = "jccroutingrule"
    accepted_protocols = ["Http", "Https"]
    patterns_to_match  = ["/*"]
    frontend_endpoints = ["jccfrontendendpoint","${local.frontendendpoint2}"]
    forwarding_configuration {
      forwarding_protocol = "MatchRequest"
      backend_pool_name   = "jccbackendpool"
    }
  }

  backend_pool_load_balancing {
    name                        = "jccloadbalancesettings"
    sample_size                 = 255
    successful_samples_required = 1
  }

  backend_pool_health_probe {
    name                = "jcchealthprobesettings"
    path                = "/health/probe"
    protocol            = "Https"
    interval_in_seconds = 240
}


  backend_pool {
    name = "jccbackendpool"
    backend {
      host_header = format("portal-staging-westeurope.jason.website")
      address     = format("portal-staging-westeurope.jason.website")
      http_port   = 80
      https_port  = 443
      weight      = 50
      priority    = 1
      enabled     = true
    }

    load_balancing_name = "jccloadbalancesettings"
    health_probe_name   = "jcchealthprobesettings"
  }

  frontend_endpoint {
    name      = "jccfrontendendpoint"
    host_name = format("testingfrontdoor.azurefd.net")
  }

  frontend_endpoint {
    name      = local.frontendendpoint2
    host_name = format("portal-staging.jason.website")
  }

}

resource "azurerm_frontdoor_custom_https_configuration" "portal_staging_https_config" {
  frontend_endpoint_id              = "${azurerm_frontdoor.jccroutingrule.id}/frontendEndpoints/${local.frontendendpoint2}"
  custom_https_provisioning_enabled = true

  custom_https_configuration {
    certificate_source                      = "AzureKeyVault"
    azure_key_vault_certificate_secret_name = "imported-cert"
    azure_key_vault_certificate_vault_id    = azurerm_key_vault.jctestingenv_keyvault.id
  }
}

Answer 1

这是由于已知问题造成的，已讨论 here .

解决方法是禁用检查:

az feature register --namespace Microsoft.Network --name BypassCnameCheckForCustomDomainDeletion