azure - AKS 群集创建额外的路由表、额外的 NSG 并且不使用现有的自定义路由表和 NSG

Question

我最近开始使用 azure 开发 terraform。作为其中的一部分，我尽可能多地浏览了文档来创建资源。在此我尝试创建 AKS 集群。我能够创建成功。但我有一些担忧(我觉得有错误，如果我错了请纠正)。

目前在 AKS 集群配置期间，aks-engine 将自动创建路由表和网络安全。我在 terraform 文档中没有看到任何阻止这些问题的选项。因为我想使用现有的路由表和 NSG，因为我位于公司网络下。预期行为:ASK 应选择现有路由表和 NSG，而不是创建新资源。这是我的代码片段。请帮助我。

provider "azurerm" {
    version = "~> 2.15"
    features {}
 }

resource "azurerm_resource_group" "aks" {
    name     = var.resource_group
    location = var.location
}
#fetch existing subnet 
data "azurerm_subnet" "aks" {
    name                 = var.subnetname
    virtual_network_name = var.virtual_network_name
    resource_group_name  = var.vnet_resource_group
}

resource "azurerm_subnet_network_security_group_association" "aks" {
    subnet_id                 = data.azurerm_subnet.aks.id
    network_security_group_id = var.network_security_group
}

resource "azurerm_route_table" "aks"{
    name                          = var.subnetname
    resource_group_name           = azurerm_resource_group.aks.name
    location                      = azurerm_resource_group.aks.location
    disable_bgp_route_propagation = false

    route{
        name                = var.route_name
        address_prefix      = var.route_address_prefix
        next_hop_type       = var.route_next_hop_type
    }

}
resource "azurerm_subnet_route_table_association" "aks" {
    subnet_id      = data.azurerm_subnet.aks.id
    route_table_id = azurerm_route_table.aks.id
}
resource "azurerm_kubernetes_cluster" "aks" {
    name                    = azurerm_resource_group.aks.name
    resource_group_name     = azurerm_resource_group.aks.name
    location                = azurerm_resource_group.aks.location
    dns_prefix              = "akstfpoc"   #The dns_prefix must contain between 3 and 45 characters, and can contain only letters, numbers, and hyphens. It must start with a letter and must end with a letter or a number.
    kubernetes_version      = "1.15.10"
    private_cluster_enabled = false
    node_resource_group     = var.node_resource_group
    
    api_server_authorized_ip_ranges = [] #var.api_server_authorized_ip_ranges
    default_node_pool {
        enable_node_public_ip   = false
        name                    = "agentpool" 
        node_count              = var.node_count
        orchestrator_version    = "1.15.10"
        vm_size                 = var.vm_size
        os_disk_size_gb         = var.os_disk_size_gb
        vnet_subnet_id          = data.azurerm_subnet.aks.id
    }

    linux_profile {
        admin_username = var.admin_username
        ssh_key {
            key_data = var.ssh_key
        }
    }
    service_principal {
        client_id     = var.client_id
        client_secret = var.client_secret
    }

    role_based_access_control {
        enabled = true
    }
    network_profile {
        network_plugin = "kubenet"
        #dns_service_ip     = "172.17.1.10"
        #service_cidr       = "172.16.0.0/14"
        pod_cidr           = "172.40.0.0/16"
        network_policy     = "calico"
        outbound_type      = "loadBalancer"
        load_balancer_sku  = "Standard"


        # load_balancer_profile {
        #     managed_outbound_ip_count = []
        #     outbound_ip_address_ids   = []
        #     outbound_ip_prefix_ids    = [""]
            
        # }
    }
            addon_profile {
            aci_connector_linux {
            enabled = false
        }

        azure_policy {
            enabled = false
        }

        http_application_routing {
            enabled = false
        }

        kube_dashboard {
            enabled = false
        }

        oms_agent {
            enabled = false
        }
    }
    
}

Answer 1

要使用私有(private)子网，您应该使用

network_plugin = “azure ”

这将允许您将 AKS 集群绑定(bind)到预先存在的子网，您将完全控制路由表和 NSG(您可以预先创建它们并使用 Terraform 将它们与您的子网关联)

查看有关如何使用 azure-cli 的文档

https://learn.microsoft.com/en-us/azure/aks/configure-azure-cni

对于 Terraform，您需要设置

default_agent_pool 上的 vnet_subnet_id:https://www.terraform.io/docs/providers/azurerm/r/kubernetes_cluster.html#vnet_subnet_id

https://www.terraform.io/docs/providers/azurerm/r/kubernetes_cluster.html#network_profile