azure - 嵌套模板中引用listKeys()

Question

我正在创建一个 ARM 模板，该模板在不同的资源组中部署大量资源。实际上，资源组本身就是部署的一部分。在简单版本中，我仅创建两个资源组(masterRG 和 dependentRG)，然后创建两个嵌套(内联)部署。第一个内联部署将存储帐户 (testsadj1604) 放入 masterRG 中。此部署依赖于 masterRG。

第二个部署创建一个 key 保管库，并尝试在该保管库中存储来自 testsadj1604 的连接字符串。

在我的实际情况中，我有更多的资源组，并且我实际上尝试部署一个连接字符串为“appsetting”的功能应用程序。但方法是相同的。

我得到的错误如下:

Deployment failed. Correlation ID: 9c359e8e-8657-4756-a5a3-f9c5698fbb46. {
  "error": {
    "code": "ResourceNotFound",
    "message": "The Resource 'Microsoft.Storage/storageAccounts/testsadj1604' under resource group '<null>' was not found."
  }
}

这是我的代码:

{
  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {},
  "resources": [
    {
      "type": "Microsoft.Resources/resourceGroups",
      "apiVersion": "2018-05-01",
      "name": "masterRG",
      "location": "West Europe",
      "properties": {}
    },
    {
      "type": "Microsoft.Resources/resourceGroups",
      "apiVersion": "2018-05-01",
      "name": "dependentRG",
      "location": "West Europe",
      "properties": {}
    },
    {
      "name": "masterRgDeployment",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2019-10-01",
      "resourceGroup": "masterRG",
      "dependsOn": [
        "masterRG"
      ],
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "resources": [
            {
              "apiVersion": "2019-06-01",
              "type": "Microsoft.Storage/storageAccounts",
              "name": "testsadj1604",
              "location": "West Europe",
              "sku": {
                "name": "Standard_GRS"
              },
              "kind": "StorageV2",
              "properties": {
                "supportsHttpsTrafficOnly": true
              }
            }
          ]
        }
      }
    },
    {
      "name": "dependentRgDeployment",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2019-10-01",
      "resourceGroup": "dependentRG",
      "dependsOn": [
        "dependentRG",
        "masterRgDeployment"
      ],
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "resources": [
            {
              "type": "Microsoft.KeyVault/vaults",
              "name": "kvaNameTest1604",
              "apiVersion": "2015-06-01",
              "location": "West Europe",
              "properties": {
                "enabledForDeployment": false,
                "enabledForDiskEncryption": false,
                "enabledForTemplateDeployment": true,
                "tenantId": "[subscription().tenantId]",
                "accessPolicies": [
                  {
                    "objectId": "fc05639d-70eb-4175-a89b-eab7f883c691",
                    "tenantId": "[subscription().tenantId]",
                    "permissions": {
                      "keys": [
                        "get",
                        "list",
                        "update"
                      ],
                      "secrets": [
                        "get",
                        "list",
                        "update"
                      ]
                    }
                  }
                ],
                "sku": {
                  "name": "Standard",
                  "family": "A"
                },
                "networkAcls": {
                  "defaultAction": "Allow",
                  "bypass": "AzureServices"
                }
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "name": "kvaNameTest1604/saConnectionString",
              "apiVersion": "2018-02-14",
              "location": "West Europe",
              "dependsOn": [
                "[resourceId('Microsoft.KeyVault/vaults', 'kvaNameTest1604')]"
              ],
              "properties": {
                "value": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', 'testsadj1604'), '2019-06-01').keys[0].value]"
              }
            }
          ]
        }
      }
    }
  ]
}

我很确定错误来自底部的 listKeys()，在我的真实模板中进行了一整天的反复试验(和谷歌狂热)。使用 listKeys() 和嵌套部署很麻烦，但我真的不明白为什么它不起作用。我确保第二次部署中有一个dependsOn。

这让我很困惑，有什么方法可以使用嵌套(内联)模板并引用不同资源组中的存储帐户 key (但是整体部署的一部分)？我还尝试在第一个部署中创建输出并在第二个部署中引用该输出，但这没有效果。我完全不知所措，欢迎任何帮助!

Answer 1

要使其在单个模板中工作，您需要执行一些操作:

1. 在您的 keyvault secret 部署中设置此属性:

    "expressionEvaluationOptions": {
      "scope": "inner"
    },

这将延迟表达式的计算，直到部署开始。

当你设置#1时，你需要为你需要的值定义参数(你不能再使用“全局”参数/变量)，你可以像你的例子中那样对所有字符串进行硬编码，但我猜那是不是您在“真实”部署中所做的事情。定义参数并将值传递到该部署中。

您的listKeys()调用需要包含storageAccount的完整resourceId，因为它位于单独/不同的部署中 - 因此您需要提供resourceGroup名称参数 - 如果您在部署中交叉订阅(您的示例没有' t) 您需要提供 subscriptionId 参数。

下面是一个工作示例...

{
  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": {
      "type": "string",
      "defaultValue": "[concat('scratch', uniqueString(newGuid()))]"
    }
   },
  "resources": [
    {
      "type": "Microsoft.Resources/resourceGroups",
      "apiVersion": "2018-05-01",
      "name": "masterRG",
      "location": "West Europe",
      "properties": {
      }
    },
    {
      "type": "Microsoft.Resources/resourceGroups",
      "apiVersion": "2018-05-01",
      "name": "dependentRG",
      "location": "West Europe",
      "properties": {
      }
    },
    {
      "name": "masterRgDeployment",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2019-10-01",
      "resourceGroup": "masterRG",
      "dependsOn": [
        "masterRG"
      ],
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "resources": [
            {
              "apiVersion": "2019-06-01",
              "type": "Microsoft.Storage/storageAccounts",
              "name": "[parameters('storageAccountName')]",
              "location": "West Europe",
              "sku": {
                "name": "Standard_GRS"
              },
              "kind": "StorageV2",
              "properties": {
                "supportsHttpsTrafficOnly": true
              }
            }
          ]
        }
      }
    },
    {
      "name": "dependentRgDeployment",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2019-10-01",
      "resourceGroup": "dependentRG",
      "dependsOn": [
        "dependentRG",
        "masterRgDeployment"
      ],
      "properties": {
        "mode": "Incremental",
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "parameters":{
          "storageAccountName": {
            "value": "[parameters('storageAccountName')]"
          },
          "storageAccountResourceGroupName": {
            "value": "masterRG"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": {
            "storageAccountName": {
              "type": "string"
            },
            "storageAccountResourceGroupName": {
              "type": "string"
            }
          },
          "variables": {
            "vaultName": "[concat('kv-', parameters('storageAccountName'))]"
          },
          "resources": [
            {
              "type": "Microsoft.KeyVault/vaults",
              "name": "[variables('vaultName')]",
              "apiVersion": "2019-09-01",
              "location": "West Europe",
              "properties": {
                "enabledForDeployment": false,
                "enabledForDiskEncryption": false,
                "enabledForTemplateDeployment": true,
                "tenantId": "[subscription().tenantId]",
                "accessPolicies": [ ],
                "sku": {
                  "name": "Standard",
                  "family": "A"
                },
                "networkAcls": {
                  "defaultAction": "Allow",
                  "bypass": "AzureServices"
                }
              }
            },
            {
              "type": "Microsoft.KeyVault/vaults/secrets",
              "name": "[concat(variables('vaultName'), '/saConnectionString')]",
              "apiVersion": "2019-09-01",
              "location": "West Europe",
              "dependsOn": [
                "[resourceId('Microsoft.KeyVault/vaults', variables('vaultName'))]"
              ],
              "properties": {
                "value": "[listKeys(resourceId(parameters('storageAccountResourceGroupName'),'Microsoft.Storage/storageAccounts', parameters('storageAccountName')), '2019-06-01').keys[0].value]"
              }
            }
          ]
        }
      }
    }
  ]
}