azure - VNET 中的 Terraform AKS 此处不应出现名为 "user_assigned_identity_id"的参数

Question

我想在 VNET 内创建一个集群，以便稍后可以创建与本地资源的连接。我有以下问题:

│ 错误:不支持的参数 │ │ 在 main.tf 第 130 行，资源“azurerm_kubernetes_cluster”“aks”中: │ 130:user_assigned_identity_id = azurerm_user_assigned_identity.identity.id │ │ 不需要名为“user_assigned_identity_id”的参数在这里。

我的main.tf:

`

data "azurerm_resource_group" "aks-rg" {
  name     = var.resource_group_name
}

resource "azurerm_role_assignment" "role_acrpull" {
  scope                            = azurerm_container_registry.acr.id
  role_definition_name             = "AcrPull"
  principal_id                     = azurerm_kubernetes_cluster.aks.kubelet_identity.0.object_id
  #skip_service_principal_aad_check = true
}

resource "azurerm_container_registry" "acr" {
  name                = var.acr_name
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  location            = var.location
  sku                 = "Standard"
  admin_enabled       = false
}

resource "azurerm_network_security_group" "pusg" {
  name                = "Public_Security_Group"
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
}

resource "azurerm_virtual_network" "puvnet" {
  name                = "Public_VNET"
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  address_space       = ["10.19.0.0/16"]
  dns_servers         = ["10.19.0.4", "10.19.0.5"]
}

resource "azurerm_subnet" "osubnet" {
  name                 = "Outer_Subnet"
  resource_group_name  = data.azurerm_resource_group.aks-rg.name
  address_prefixes     = ["10.19.1.0/24"]
  virtual_network_name = azurerm_virtual_network.puvnet.name
}

resource "azurerm_subnet" "isubnet" {
  name                 = "Inner_Subnet"
  resource_group_name  = data.azurerm_resource_group.aks-rg.name
  address_prefixes     = ["10.19.2.0/24"]
  virtual_network_name = azurerm_virtual_network.puvnet.name
}

resource "azurerm_subnet" "firewall_subnet" {
  name                 = "AzureFirewallSubnet"
  resource_group_name  = data.azurerm_resource_group.aks-rg.name
  virtual_network_name = azurerm_virtual_network.puvnet.name
  address_prefixes     = ["10.19.3.0/24"]
}

resource "azurerm_user_assigned_identity" "identity" {
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  location            = var.location
  name                = "identityh"
}

resource "azurerm_role_assignment" "networkRole" {
  scope                = data.azurerm_resource_group.aks-rg.id
  role_definition_name = "Network Contributor"
  principal_id         = azurerm_user_assigned_identity.identity.principal_id
}

resource "azurerm_route_table" "routeTable" {
  name                = "rt-FWall"
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
}

resource "azurerm_route" "route1" {
  name                   = "dg-route1"
  resource_group_name    = data.azurerm_resource_group.aks-rg.name
  route_table_name       = azurerm_route_table.routeTable.name
  address_prefix         = "0.0.0.0/0"
  next_hop_type          = "VirtualAppliance"
  next_hop_in_ip_address = azurerm_firewall.firewall.ip_configuration.0.private_ip_address
}

resource "azurerm_subnet_route_table_association" "base" {
  subnet_id      = azurerm_subnet.osubnet.id
  route_table_id = azurerm_route_table.routeTable.id
}

resource "azurerm_public_ip" "firewall_public_ip" {
  name                = "pip-firewall"
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  allocation_method   = "Static"
  sku                 = "Standard"
}

resource "azurerm_firewall" "firewall" {
  name                = "public_firewall"
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  sku_name            = "AZFW_VNet"
  sku_tier            = "Standard"

  ip_configuration {
    name                 = "ipconfig"
    subnet_id            = azurerm_subnet.firewall_subnet.id
    public_ip_address_id = azurerm_public_ip.firewall_public_ip.id
  }
}

resource "azurerm_kubernetes_cluster" "aks" {
  name                = var.cluster_name
  kubernetes_version  = var.kubernetes_version
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  dns_prefix          = var.cluster_name

  network_profile {
    network_plugin = "azure"
    outbound_type  = "userDefinedRouting"
  }

  default_node_pool {
    name                = "system"
    node_count          = var.system_node_count
    vm_size             = "Standard_DS2_v2"
    vnet_subnet_id = azurerm_subnet.osubnet.id
  }

  identity {
    type                      = "UserAssigned"
    user_assigned_identity_id = azurerm_user_assigned_identity.identity.id
  }
}

`

区域是德国中西部。 Kubernetes 版本 1.24.3、Azurerm 3.33、Terraform 1.3

我尝试了在互联网上找到的不同方法，但似乎都不起作用。最好的情况是创建时间过长并且 terraform 停止而不创建集群。

Answer 1

该参数似乎不是身份 block 的一部分。可以在身份 block 内部使用的参数是 identity_ids [1]:

resource "azurerm_kubernetes_cluster" "aks" {
  name                = var.cluster_name
  kubernetes_version  = var.kubernetes_version
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  dns_prefix          = var.cluster_name

  network_profile {
    network_plugin = "azure"
    outbound_type  = "userDefinedRouting"
  }

  default_node_pool {
    name                = "system"
    node_count          = var.system_node_count
    vm_size             = "Standard_DS2_v2"
    vnet_subnet_id = azurerm_subnet.osubnet.id
  }

  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.identity.id]
  }
}

请注意，identity_ids 参数是一个列表，因此标识两边有方括号。

<小时/>

[1] https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster#identity_ids