azure - Terraform 在未指定的情况下强制将值设置为 null

Question

我之前使用过 terraform ，但没有看到这个意外问题，每次我运行计划时，它都会说它将替换资源，因此我添加了生命周期来忽略所有更改。当我让计划应用时，即使它声明会将 FQDN、IP 地址或 GUID 更改为 null，它实际上并没有执行此操作，但是当我在应用完成后再次运行计划时，会发生相同的更新用于资源显示。我拥有的其他 10 个资源也发生这种情况，但我无法找出原因。

这是我的托管实例配置的片段:

  #SQL MANAGED INSTANCE
resource "azurerm_mssql_managed_instance" "main" {
  name                = local.SQLInstanceName
  resource_group_name = var.RG.name
  location            = var.SQLMIInfo.Location



  identity {
    type = "SystemAssigned"
  }


  lifecycle {
    ignore_changes = all
  }

  license_type       = "BasePrice"
  subnet_id          = data.azurerm_subnet.SQL.id
  sku_name           = var.SQLMIInfo.Sku
  storage_size_in_gb = var.SQLMIInfo.StorageGB
  vcores             = var.SQLMIInfo.VCores
  storage_account_type = var.SQLMIInfo.StorageType

  collation = "Latin1_General_CI_AS"

  administrator_login          = var.Secrets.SQLMIAdminAccount
  administrator_login_password = "${data.azurerm_key_vault_secret.SQLAdmin.value}"

  public_data_endpoint_enabled = false

  depends_on = [
    null_resource.delegation,
  ]
}


data "azurerm_subnet" "endpoint" {
  name                 = "Hub-Private-Endpoint-Subnet"
  virtual_network_name = "${var.RGInfo.Env}-01-HUB-VNET"
  resource_group_name  = "RG-${var.RGInfo.Env}-01-HUB"
}


resource "azurerm_private_endpoint" "main" {
  name                = local.PrivateEndpointName
  location            = "West Europe"
  resource_group_name = var.RG.name
  subnet_id           = data.azurerm_subnet.endpoint.id
  custom_network_interface_name  = "${local.PrivateEndpointName}-nic"
  private_service_connection {
    name                           = local.PrivateEndpointName
    is_manual_connection           = false
    private_connection_resource_id = azurerm_mssql_managed_instance.main.id
    subresource_names = ["managedInstance"]
  }

  lifecycle {
    ignore_changes = all
  }
}

这是它显示的更新

# module.WE-DBOU.module.SQLInstances["we-sqlmi-gfndbou-imp-01"].azurerm_mssql_managed_instance.main must be replaced
-/+ resource "azurerm_mssql_managed_instance" "main" {
      ~ administrator_login_password   = (sensitive value)
      - dns_zone_partner_id            = "" -> null
      ~ fqdn                           = "pilot-08-we-sqlmi-gfndbou-imp-01.database.windows.net" -> (known after apply)
      ~ id                             = "/suensitive/resourceGroups/RG-PILOT-08-WE-DBOU/providers/Microsoft.Sql/managedInstances/pilot-08-we-sqlmi-gfndbou-imp-01" -> (known after apply)
        name                           = "pilot-08-we-sqlmi-gfndbou-imp-01"
      ~ subnet_id                      = "sensitive/resourceGroups/RG-PILOT-08-WE-DBOU/providers/Microsoft.Network/virtualNetworks/PILOT-08-WE-DBOU-VNET/subnets/we-sqlmi-gfndbou-imp-01-Subnet" -> (known after apply) # forces replacement
      - tags                           = {} -> null
        # (14 unchanged attributes hidden)

      ~ identity {
          ~ principal_id = "97a84a7b-8u3wu9u9u2-283u82uuu91u2991" -> (known after apply)
          ~ tenant_id    = "97a84a7b-8u3wu9u9u2-283u82uuu91u2991" -> (known after apply)
            # (1 unchanged attribute hidden)
        }
    }

  # module.WE-DBOU.module.SQLInstances["we-sqlmi-gfndbou-imp-01"].azurerm_private_dns_zone.db-dns will be updated in-place
  ~ resource "azurerm_private_dns_zone" "db-dns" {
        id                                                    = "/sensitive/resourceGroups/RG-PILOT-01-HUB/providers/Microsoft.Network/privateDnsZones/privatelink.database.windows.net"
      - max_number_of_record_sets                             = 25000 -> null
      - max_number_of_virtual_network_links                   = 1000 -> null
      - max_number_of_virtual_network_links_with_registration = 100 -> null
        name                                                  = "privatelink.database.windows.net"
      - number_of_record_sets                                 = 1 -> null
        tags                                                  = {}
        # (1 unchanged attribute hidden)

      ~ soa_record {
          - fqdn          = "privatelink.sensitive.database.windows.net." -> null
          - host_name     = "azureprivatedns.net" -> null
          - serial_number = 1 -> null
            tags          = {}
            # (6 unchanged attributes hidden)
        }
    }

  # module.WE-DBOU.module.SQLInstances["we-sqlmi-gfndbou-imp-01"].azurerm_private_endpoint.main must be replaced
-/+ resource "azurerm_private_endpoint" "main" {
      ~ custom_dns_configs            = [
          - {
              - fqdn         = "pilot-08-we-sqlmi-gfndbou-imp-01.database.windows.net"
              - ip_addresses = [
                  - "10.40.6.9",
                ]
            },
        ] -> (known after apply)
      ~ id                            = "/sensitive/sensitive/resourceGroups/RG-PILOT-08-WE-DBOU/providers/Microsoft.Network/privateEndpoints/pilot-08-we-dbou-import-01" -> (known after apply)
        name                          = "pilot-08-we-dbou-import-01"
      ~ network_interface             = [
          - {
              - id   = "/sensitive/sensitive/resourceGroups/RG-PILOT-08-WE-DBOU/providers/Microsoft.Network/networkInterfaces/pilot-08-we-dbou-import-01-nic"
              - name = "pilot-08-we-dbou-import-01-nic"
            },
        ] -> (known after apply)
      ~ private_dns_zone_configs      = [] -> (known after apply)
      ~ subnet_id                     = "/sensitive/sensitive/resourceGroups/RG-PILOT-01-HUB/providers/Microsoft.Network/virtualNetworks/PILOT-01-HUB-VNET/subnets/Hub-Private-Endpoint-Subnet" -> (known after apply) # forces replacement
      - tags                          = {} -> null
        # (3 unchanged attributes hidden)

      ~ private_service_connection {
            name                           = "pilot-08-we-dbou-import-01"
          ~ private_connection_resource_id = "/sensitive/sensitive/resourceGroups/RG-PILOT-08-WE-DBOU/providers/Microsoft.Sql/managedInstances/pilot-08-we-sqlmi-gfndbou-imp-01" -> (known after apply) # forces replacement
          ~ private_ip_address             = "10.40.6.9" -> (known after apply)
            # (2 unchanged attributes hidden)
        }
    }

希望这是有道理的，我已经被困在这个问题上好几天了，到处寻找但找不到任何东西，请随时询问是否需要更多详细信息

Answer 1

当您再次运行 terraform plan 时，Terraform 检测到您配置中的资源状态与 Azure 中的资源状态不匹配。

对于少数 terraform 资源，不建议使用

ignore_changes = all。不要使用 ignore_changes，而是使用 prevent_destroy = true 来防止在运行 terraform plan & apply 时删除。

terraform state 还可用于检查资源的当前状态并将其与 terraform 配置中的所需状态进行比较。

lifecycle
  { 
      prevent_destroy =  true 
  }

这将防止 Terraform 在更新时破坏资源。

我在我的环境中尝试了相同的操作，terraform plan 按预期工作。