azure - 将 ARM 模板资源部署到一个资源组，并将 secret 部署到另一资源组中的 key 保管库

Question

我的 ARM 模板给我带来了一些麻烦。我将其部署到订阅级别一资源组，然后将服务总线部署到新创建的资源组。服务总线本身有 4 个授权规则、一个队列、4 个主题，其中两个主题有自己的授权规则。这一切都很好。我尝试将后两个授权规则的 PrimaryConnectionString 作为 secret 添加到不同资源组中的 KeyVault，这就是我开始遇到问题的地方。以下是完整的 ARM 模板。我目前仅尝试从 shared-context 主题的 SharedCtxListenerServiceAccessKeyauthorizationRule 获取 PrimaryConnectionString。

{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
    "tags": {
        "type": "object",
        "metadata": {
            "description": "Specifies the tags for the Service Bus related Azure Resources."
        }
    },
    "environment": {
        "type": "object",
        "metadata": {
            "description": "Specifies the Team Environment information."
        }
    },
    "serviceBus": {
        "type": "object",
        "metadata": {
            "description": "Specifies the Service Bus information."
        }
    }
},
"variables": {
    "serviceBus": {
        "namespace": {
            "name": "[concat('team-', toLower(parameters('environment').name),'-sbn')]"
        },
        "ResourceGroupName": "[concat('Team-ServiceBus-',parameters('environment').suffix)]"
    },
    "keyVault": {
        "Name": "[concat('Team-Utilities-',parameters('environment').suffix, '-kv')]",
        "ResourceGroupName": "[concat('Team-Utilities-',parameters('environment').suffix)]"
    }
},
"resources": [
    {
        "type": "Microsoft.Resources/resourceGroups",
        "apiVersion": "2019-10-01",
        "name": "[variables('serviceBus').ResourceGroupName]",
        "location": "[parameters('environment').location]",
        "properties": {
        },
        "tags": {
            "Department": "[parameters('tags').Department]",
            "Product": "[parameters('tags').Product]",
            "Service": "[parameters('tags').Service]",
            "Environment": "[parameters('tags').environment]"
        }
    },
    {
        "type": "Microsoft.Resources/deployments",
        "name": "ServiceBus_Infrastructure",
        "apiVersion": "2017-05-10",
        "resourceGroup": "[variables('serviceBus').ResourceGroupName]",
        "properties": {
            "mode": "Incremental",
            "template": {
                "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "resources": [
                    {
                        "name": "[variables('serviceBus').namespace.name]",
                        "type": "Microsoft.ServiceBus/namespaces",
                        "apiVersion": "2017-04-01",
                        "location": "[parameters('environment').location]",
                        "properties": {
                        },
                        "sku": {
                            "name": "[parameters('serviceBus').namespace.sku.name]",
                            "tier": "[parameters('serviceBus').namespace.sku.tier]"
                        },
                        "tags": {
                            "Department": "[parameters('tags').Department]",
                            "Product": "[parameters('tags').Product]",
                            "Service": "[parameters('tags').Service]",
                            "Environment": "[parameters('tags').environment]"
                        },
                        "resources": [
                            {
                                "type": "AuthorizationRules",
                                "name": "RootManagerSharedAccessKey",
                                "apiVersion": "2017-04-01",
                                "properties": {
                                    "rights": [
                                        "Listen",
                                        "Manage",
                                        "Send"
                                    ]
                                },
                                "dependsOn": [
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
                                ]
                            },
                            {
                                "type": "AuthorizationRules",
                                "name": "PubSubSharedAccessKey",
                                "apiVersion": "2017-04-01",
                                "properties": {
                                    "rights": [
                                        "Listen",
                                        "Send"
                                    ]
                                },
                                "dependsOn": [
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]",
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name, '/authorizationRules/RootManagerSharedAccessKey')]"
                                ]
                            },
                            {
                                "type": "AuthorizationRules",
                                "name": "PublishSharedAccessKey",
                                "apiVersion": "2017-04-01",
                                "properties": {
                                    "rights": [
                                        "Send"
                                    ]
                                },
                                "dependsOn": [
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]",
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name, '/authorizationRules/PubSubSharedAccessKey')]"
                                ]
                            },
                            {
                                "type": "AuthorizationRules",
                                "name": "ClientSharedAccessKey",
                                "apiVersion": "2017-04-01",
                                "properties": {
                                    "rights": [
                                        "Listen"
                                    ]
                                },
                                "dependsOn": [
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]",
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name, '/authorizationRules/PublishSharedAccessKey')]"
                                ]
                            },
                            {
                                "type": "queues",
                                "name": "activity-log",
                                "apiVersion": "2017-04-01",
                                "properties": {
                                    "lockDuration": "PT5M",
                                    "maxSizeInMegabytes": 5120,
                                    "requiresDuplicateDetection": false,
                                    "requiresSession": false,
                                    "defaultMessageTimeToLive": "P10675199DT2H48M5.4775807S",
                                    "deadLetteringOnMessageExpiration": false,
                                    "maxDeliveryCount": 10,
                                    "autoDeleteOnIdle": "P10675199DT2H48M5.4775807S",
                                    "enablePartitioning": false,
                                    "enableExpress": false
                                },
                                "dependsOn": [
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
                                ]
                            },
                            {
                                "type": "topics",
                                "name": "pdf-splitted",
                                "apiVersion": "2017-04-01",
                                "properties": {
                                },
                                "dependsOn": [
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
                                ]
                            },
                            {
                                "type": "topics",
                                "name": "platform-admin",
                                "apiVersion": "2017-04-01",
                                "properties": {
                                },
                                "resources": [
                                    {
                                        "type": "authorizationRules",
                                        "name": "PlatformAdminListenerServiceAccessKey",
                                        "apiVersion": "2017-04-01",
                                        "properties": {
                                            "rights": [
                                                "Listen"
                                            ]
                                        },
                                        "dependsOn": [
                                            "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name, '/topics/platform-admin')]"
                                        ]
                                    }
                                ],
                                "dependsOn": [
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
                                ]
                            },
                            {
                                "type": "topics",
                                "name": "shared-context",
                                "apiVersion": "2017-04-01",
                                "properties": {
                                },
                                "resources": [
                                    {
                                        "type": "authorizationRules",
                                        "name": "SharedCtxListenerServiceAccessKey",
                                        "apiVersion": "2017-04-01",
                                        "properties": {
                                            "rights": [
                                                "Listen"
                                            ]
                                        },
                                        "dependsOn": [
                                            "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name, '/topics/shared-context')]"
                                        ]
                                    }
                                ],
                                "dependsOn": [
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
                                ]
                            },
                            {
                                "type": "topics",
                                "name": "transaction-audit",
                                "apiVersion": "2017-04-01",
                                "properties": {
                                },
                                "dependsOn": [
                                    "[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
                                ]
                            }
                        ]
                    }
                ],
                "outputs": {
                    "SharedCtxListenerServiceAccessKeyResourceId": {
                        "type": "string",
                        "value": "[resourceId('Microsoft.ServiceBus/namespaces/topics/authorizationRules',variables('serviceBus').namespace.name, 'shared-context','SharedCtxListenerServiceAccessKey')]"
                    }
                }
            }
        },
        "dependsOn": [
            "[resourceId('Microsoft.Resources/resourceGroups/', variables('serviceBus').resourceGroupName)]"
        ]
    },
    {
        "type": "Microsoft.Resources/deployments",
        "name": "ServiceBus_Secrets",
        "apiVersion": "2017-05-10",
        "resourceGroup": "[variables('keyVault').ResourceGroupName]",
        "properties": {
            "mode": "Incremental",
            "template": {
                "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "resources": [
                    {
                        "type": "Microsoft.KeyVault/vaults/secrets",
                        "name": "[concat(variables('keyVault').Name,'/SharedContext-Listener-ConnectionString')]",
                        "apiVersion": "2016-10-01",
                        "properties": {
                            "contentType": "ConnectionString",
                            "value": "[resourceId('Microsoft.ServiceBus/namespaces/topics/authorizationRules',variables('serviceBus').namespace.name, 'shared-context','SharedCtxListenerServiceAccessKey')]"
                        }
                    }
                ]
            }
        },
        "dependsOn": [
            "[concat('Microsoft.Resources/deployments/','ServiceBus_Infrastructure')]"
        ]
    }
]

}

在尝试了几种不同的方法之后，我成功地使用 ServiceBus_Infrastructure 部署的输出来发送 resourceId 并将其用作 KeyVault 的 secret ，作为测试其大部分功能是否按预期运行的一种方法。我尝试在输出中使用 listkey() 函数，如下所示:

                        "SharedCtxListenerServiceAccessKeyResourceId": {
                            "type": "string",
                            "value": "[listkeys(resourceId('Microsoft.ServiceBus/namespaces/topics/authorizationRules',variables('serviceBus').namespace.name, 'shared-context','SharedCtxListenerServiceAccessKey'),'2017-04-01').PrimaryConnectionString]"
                        }
                    }

但是，这给了我这个错误:{"code":"DeploymentFailed","message":"至少一个资源部署操作失败。请列出部署操作以了解详细信息。请参阅 https://aka。 ms/DeployOperations 了解使用详细信息。","details":[{"code":"NotFound","message":"{\r\n\"error\": {\r\n\"code\":\"ParentResourceNotFound\",\r\n\"message\":\"无法对嵌套资源执行请求的操作。找不到父资源“team-development-sbn”。\"\r\n }\r\n}"}]}

这很奇怪，因为服务总线是在上一个部署中创建的，而最后一个部署资源依赖于该服务总线。我想我在某处读到，由于服务总线资源位于部署资源中，因此它不一定知道它实际上已完成，这可能就是它找不到它的原因？

我还尝试在 keyvault secret 的值字段中执行 listKeys() 函数，但它表示此处不需要引用() 函数。

我的基本问题是:如何获取 PrimaryConnectionString 并将其作为 secret 部署到不同资源组中的 keyvault，最好在同一模板中(因为这是希望可以遵循此模式的众多服务之一，其中创建资源并将必要的值存储在中央 keystore 中)感谢您的帮助!

Answer 1

我想如果你重新运行这个模板它就会起作用。那么发生了什么 - 您正在使用嵌套模板，并且它们同时“渲染”所有内容，因此它们在嵌套模板内实际上没有依赖项(嗯，它们有，但有点奇怪)。简而言之，我建议您使用链接模板(因此将服务总线部署转换为链接模板)并按照这种方式进行操作。

ps。老实说，除非您打算使用 Arm 模板管理订阅级资源，否则完全放弃订阅级部署即可。