azure - "update in-place"在 Terraform 中无限期运行

Question

如果下面的条件语句没有值，我想应用“Azure 服务”，如果有值，我想应用“var.network_rules_bypass”。顺便说一句，Terraform 会不断尝试更新，无论是否有值，如下所示。我请求你的帮助。

• 问题如果您应用“terraform plan -> terraform apply”并再次尝试“terraform plan”，您将继续更新。

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # azurerm_storage_account.storageaccount will be updated in-place
  ~ resource "azurerm_storage_account" "storageaccount" {
        id                                = "/subscriptions/000000000-0000000...."
        name                              = "teststorage"
        tags                              = {
            "Environment" = "prd"
        }
        # (32 unchanged attributes hidden)

      ~ network_rules {
          ~ default_action             = "Allow" -> "Deny"
            # (3 unchanged attributes hidden)
        }

        # (1 unchanged block hidden)
    }

• main.tf

resource "azurerm_storage_account" "storageaccount" {
  name                     = var.azstorageaccount_name
  resource_group_name      = data.azurerm_resource_group.system_rg_name.name
  location                 = var.location
  account_tier             = var.account_tier
  account_replication_type = var.account_replication_type
  account_kind             = var.account_kind
  access_tier              = var.access_tier
  large_file_share_enabled = var.large_file_share_enabled
  is_hns_enabled           = var.is_hns_enabled
  sftp_enabled          = var.is_sftp_enabled
  public_network_access_enabled     = var.public_network_access_enabled

  blob_properties  {
    container_delete_retention_policy {
      days = var.container_delete_retention_policy
    }
    delete_retention_policy {
      days = var.delete_retention_policy
    }
  }

  dynamic "network_rules" {
    for_each = var.network_rules_enabled ? ["true"] : []
    content {
      default_action             = var.network_rules_default_action
      ip_rules                   = var.network_rules_ip_rules
      virtual_network_subnet_ids = var.network_rules_virtual_network_subnet_ids
      bypass                     = var.network_rules_bypass != [] ? var.network_rules_bypass : ["AzureServices"] <==== This!!!!
      dynamic "private_link_access" {
        for_each = var.private_link_access
        content {
          endpoint_resource_id = private_link_access.value.endpoint_resource_id
          endpoint_tenant_id   = private_link_access.value.endpoint_tenant_id
        }
      }
    }
  }
  tags = {
    Environment = "${var.tag}"
  }
}

• var.tf

variable "system_rg" {
  description = "The Prefix used for all resources in this example"
  type        = string
  default     = "testrg"
}

variable "tag" {
  type    = string
  default = "prd"
}

variable "azstorageaccount_name" {
  type    = string
  default = "teststg001"
}

variable "large_file_share_enabled" {
  type    = string
  default = "false"
}

variable "account_tier" {
  type = string
  default = "Standard"
}

variable "account_replication_type" {
  type = string
  default = "LRS"
}

variable "account_kind" {
  type = string
  default = "StorageV2"
}

variable "access_tier" {
  type = string
  default = "Hot"
}

variable "is_hns_enabled" {
  type = string
  default = "false"
}

variable "is_sftp_enabled" {
  type = string
  default = "false"
}

variable "public_network_access_enabled" {
  type    = string
  default = "true"
}

variable "container_delete_retention_policy" {
  type    = string
  default = "7"
}

variable "delete_retention_policy" {
  type    = string
  default = "7"
}

variable "network_rules_enabled" {
  description = "Boolean to enable Network Rules on the Storage Account, requires `network_bypass`, `allowed_cidrs`, `subnet_ids` or `default_firewall_action` correctly set if enabled."
  type        = bool
  default     = true # true
}

variable "network_rules_default_action" {
  type = string
  default = "Deny" # Allow
}

variable "network_rules_ip_rules" {
  type = list(string)
  default = [ "10.10.10.10 ]
}

variable "network_rules_virtual_network_subnet_ids" {
  type = list(string)
  default = [ "/subscriptions/.../" ]
}

variable "network_rules_bypass" {
  type = list(string)
  # default = [ "Logging", "Metrics", "AzureServices" ]
  default = []
}

variable "private_link_access" {
  description = "List of Privatelink objects to allow access from."
  type = list(object({
    endpoint_resource_id = string
    endpoint_tenant_id = optional(string, null)
  }))
  default = [ 
    { 
      endpoint_resource_id = "/subscriptions/00000-0000-00000-000000/providers/Microsoft.Security/datascanners/storageDataScanner"
      endpoint_tenant_id = null
    },
    # { 
    #   endpoint_resource_id = 
    #   endpoint_tenant_id = 
    # }
  ]
  nullable = false
}

Answer 1

Problem If you apply "terraform plan -> terraform apply" and try "terraform plan" again, you will continue to update.

Terraform 更新网络规则的原因是 azurerm_storage_account.storageaccount.network_rules block 中的 bypass 参数。这些会导致 Terraform 对资源计划并应用更改，即使值没有更改也是如此。

要解决此问题，您可以在 azurerm_storage_account block 中使用 ignore_changes 生命周期 block 。

这是用于防止更新的更新代码。

    provider "azurerm" {
      features {}
    }
    
    data "azurerm_resource_group" "example" {
      name = "existing-resource-group-name"
    }
    
    resource "azurerm_virtual_network" "example" {
      name                = "example-vnet"
      address_space       = ["10.0.0.0/16"]
      location            = data.azurerm_resource_group.example.location
      resource_group_name = data.azurerm_resource_group.example.name
    }
    
    resource "azurerm_subnet" "example" {
      name                 = "example-subnet"
      resource_group_name  = data.azurerm_resource_group.example.name
      virtual_network_name = azurerm_virtual_network.example.name
      address_prefixes     = ["10.0.2.0/24"]
      service_endpoints    = ["Microsoft.Storage"]
    }
    
    
    resource "azurerm_storage_account" "storageaccount" {
      name                     = var.azstorageaccount_name
      resource_group_name      = data.azurerm_resource_group.example.name
      location                 = data.azurerm_resource_group.example.location
      account_tier             = var.account_tier
      account_replication_type = var.account_replication_type
      account_kind             = var.account_kind
      access_tier              = var.access_tier
      large_file_share_enabled = var.large_file_share_enabled
      is_hns_enabled           = var.is_hns_enabled
      sftp_enabled             = var.is_sftp_enabled
      public_network_access_enabled = var.public_network_access_enabled
    
      blob_properties  {
        container_delete_retention_policy {
          days = var.container_delete_retention_policy
        }
        delete_retention_policy {
          days = var.delete_retention_policy
        }
      }
    
      dynamic "network_rules" {
        for_each = var.network_rules_enabled ? ["true"] : []
        content {
          default_action             = var.network_rules_default_action
          ip_rules                   = var.network_rules_ip_rules
          virtual_network_subnet_ids = [azurerm_subnet.example.id]
          bypass                     = coalesce(var.network_rules_bypass, ["AzureServices"])
        }
      }
      tags = {
        Environment = "${var.tag}"
      }
    lifecycle {
        ignore_changes = [
          network_rules,
        ]
      }
    }

添加ignore_changes后，当我尝试terraform plan时，它不会更新资源，如下所示。

引用:How and when to ignore lifecycle changes in Terraform