azure - 使用托管标识创建 AKS 集群并通过 az cli 脚本错误与 acr 关联

Question

我是 power-shell 脚本的新手，我尝试运行下面的脚本，该脚本将创建一个 AKS 集群，其托管标识也与 ACR 关联。 但它在“托管身份”行给出错误。。

Param(
    [parameter(Mandatory = $false)]
    [string]$subscriptionName = "azure-subcription",
    [parameter(Mandatory = $false)]
    [string]$resourceGroupName = "demoRG",
    [parameter(Mandatory = $false)]
    [string]$resourceGroupLocaltion = "East US 2",
    [parameter(Mandatory = $false)]
    [string]$clusterName = "nginxCluster",
    [parameter(Mandatory = $false)]
    [int16]$workerNodeCount = 3,
    [parameter(Mandatory = $false)]
    [string]$kubernetesVersion = "1.19.3",
    [parameter(Mandatory = $false)]
    [string]$acrRegistryName = "ngAcrRegistrydemo"
)

# Set Azure subscription name
Write-Host "Setting Azure subscription to $subscriptionName"  -ForegroundColor Yellow
az account set --subscription=$subscriptionName

$aksRgExists = az group exists --name $resourceGroupName

Write-Host "$resourceGroupName exists : $aksRgExists"

if ($aksRgExists -eq $false) {

    # Create resource group name
    Write-Host "Creating resource group $resourceGroupName in region $resourceGroupLocaltion" -ForegroundColor Yellow
    az group create `
        --name=$resourceGroupName `
        --location=$resourceGroupLocaltion `
        --output=jsonc
}

$aks = az aks show `
    --name $clusterName `
    --resource-group $resourceGroupName `
    --query name | ConvertFrom-Json

$aksCLusterExists = $aks.Length -gt 0

if ($aksCLusterExists -eq $false) {
    # Create AKS cluster
    Write-Host "Creating AKS cluster $clusterName with resource group $resourceGroupName in region $resourceGroupLocaltion" -ForegroundColor Yellow
    az aks create `
        --resource-group=$resourceGroupName `
        --name=$clusterName `
        --node-count=$workerNodeCount `
        --enable-managed-identity `
        --output=jsonc `
        --kubernetes-version=$kubernetesVersion `
        --aks-custom-headers="CustomizedUbuntu=aks-ubuntu-1804,ContainerRuntime=containerd" `
        --attach-acr=$acrRegistryName 

}
# Get credentials for newly created cluster
Write-Host "Getting credentials for cluster $clusterName" -ForegroundColor Yellow
az aks get-credentials `
    --resource-group=$resourceGroupName `
    --name=$clusterName `
    --overwrite-existing

Write-Host "Successfully created cluster $clusterName with $workerNodeCount node(s)" -ForegroundColor Green

Write-Host "Creating cluster role binding for Kubernetes dashboard" -ForegroundColor Green

# kubectl create clusterrolebinding kubernetes-dashboard `
#     -n kube-system `
#     --clusterrole=cluster-admin `
#     --serviceaccount=kube-system:kubernetes-dashboard

错误消息类似于“az:错误:无法识别的参数:--enable-management-identity”。

请就如何启用与 AKS 群集关联的托管身份提供帮助或提供建议。

非常感谢，

Answer 1

首先，CLI命令az aks create没有参数--aks-custom-headers，另外两个参数--enable -托管身份和--attach-acr。您可以在不使用字符 = 的情况下再试一次，只需在参数后面附加值即可:

az aks create `
--resource-group $resourceGroupName `
--name $clusterName `
--node-count $workerNodeCount `
--enable-managed-identity `
--kubernetes-version $kubernetesVersion `
--attach-acr $acrRegistryName

你可以看一下命令az aks create 。此外，这是托管标识，而不是服务主体，因此您需要使用命令 az identity list获取节点组中 AKS 的标识，您可以通过 CLI 命令获取节点组，如下所示:

az aks show -g aksGroup -n aksCluster --query nodeResourceGroup