azure - 无法使用 ARM 模板创建具有托管标识的 Azure AKS 容器服务

Question

我正在尝试使用 ARM 模板创建具有托管标识的 AKS 容器服务实例。如果我使用 az CLI，则没有问题:

az aks create -g“sa-rg”-n“aks-cluster”--enable-托管身份

但是我无法使用 ARM 模板获得相同的结果。

让我们考虑以下基本 ARM 模板

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "outputs": {},
  "parameters": {},
  "resources": [
    {
      "apiVersion": "2021-03-01",
      "dependsOn": [],
      "location": "australiaeast",
      "name": "aks-cluster",
      "properties": {
        "agentPoolProfiles": [
          {
            "name": "agentpool",
            "count": 1,
            "vmSize": "Standard_DS2_v2",
            "osType": "Linux",
            "osDiskSizeGB": 128,
            "`": null,
            "osDiskType": "Managed",
            "maxPods": 110,
            "type": "VirtualMachineScaleSets",
            "mode": "System"
          }
        ],
        "dnsPrefix": "aks-cluster-dns",
        "servicePrincipalProfile": {
          "clientId": "msi",
          "secret": null
        },
        "identity": {
          "type": "SystemAssigned"
        },
        "enableRBAC": true
      },
      "type": "Microsoft.ContainerService/managedClusters"
    }
  ]
}

根据https://github.com/Azure/azure-cli/issues/12219#issuecomment-636143374 ，要使用托管身份 (MSI) 创建，只需要“身份”对象，而不是“servicePrincipalProfile”。但是，如果我这样做，我会得到以下异常:

ERROR: {"error":{"code":"InvalidTemplateDeployment","message":"Thetemplate deployment is not valid according to thevalidation procedure. The tracking id is'5a6c6444-c74b-4709-888e-bef816d05ca9'. See inner errors fordetails.","details":[{"code":"InvalidParameter","message":"Provisioningof resource(s) for container service aks-cluster in resource groupsa-rg failed. Message: {\n "code": "InvalidParameter",\n"message": "Required parameter servicePrincipalProfile is missing(null).",\n "target": "servicePrincipalProfile"\n }. Details:"}]}}

但是，如果我插入“servicePrincipalProfile”(如上所示)，我会得到:

ERROR: {"error":{"code":"InvalidTemplateDeployment","message":"Thetemplate deployment is not valid according to thevalidation procedure. The tracking id is'536bca0b-33b8-45f8-8407-edba873d3657'. See inner errors fordetails.","details":[{"code":"InvalidParameter","message":"Provisioningof resource(s) for container service aks-cluster in resource groupsa-rg failed. Message: {\n "code": "InvalidParameter",\n"message": "The value of parameter servicePrincipalProfile.secretis invalid. Please see https://aka.ms/aks-naming-rules for moredetails.",\n "target": "servicePrincipalProfile.secret"\n }.Details: "}]}}

我已经尝试过

        "servicePrincipalProfile": {
          "clientId": "msi"
          "secret": null
        },
        "identity": {
          "type": "SystemAssigned"
        },

        "servicePrincipalProfile": {
          "clientId": "msi"
          "secret": ""
        },
        "identity": {
          "type": "SystemAssigned"
        },

        "servicePrincipalProfile": {
          "clientId": "msi"
          "secret": "dummy"
        },
        "identity": {
          "type": "SystemAssigned"
        },

        "servicePrincipalProfile": {
          "clientId": "msi"
        },
        "identity": {
          "type": "SystemAssigned"
        },

同样的4删除“身份”，但我总是得到参数servicePrincipalProfile.secret的值无效

创建容器服务的正确 ARM 模板是什么？

Answer 1

几件事:

• identity 属性应位于资源的根目录，
• 您只需在 servicePrincipalProfile 属性中指定 clientId: "msi"。

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "outputs": {},
  "parameters": {},
  "resources": [
    {
      "apiVersion": "2021-03-01",
      "dependsOn": [],
      "location": "australiaeast",
      "name": "aks-cluster",
      "identity": {
        "type": "SystemAssigned"
      },
      "properties": {
        "agentPoolProfiles": [
          {
            "name": "agentpool",
            "count": 1,
            "vmSize": "Standard_DS2_v2",
            "osType": "Linux",
            "osDiskSizeGB": 128,
            "osDiskType": "Managed",
            "maxPods": 110,
            "type": "VirtualMachineScaleSets",
            "mode": "System"
          }
        ],
        "dnsPrefix": "aks-cluster-dns",
        "servicePrincipalProfile": {
          "clientId": "msi"
        },
        "enableRBAC": true
      },
      "type": "Microsoft.ContainerService/managedClusters"
    }
  ]
}