azure - 错误 :ManagedEnvResourceDisallowedByPolicy, 消息:无法创建托管环境，因为策略不允许创建所需资源

Question

通过 Azure ARM 自动化脚本创建具有网络选项的 Azure 容器应用程序时，出现以下错误:

错误详细信息:

{    "id": "/subscriptions/xxxx/resourceGroups/yyyy/providers/Microsoft.App/managedEnvironments/xxxxx",
    "name": "testcontainerappsenv",
    "type": "Microsoft.App/managedEnvironments",
    "location": "westeurope",
    "tags": {},
    "systemData": {
        "createdBy": "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="9ce8f9efe8dcfbf1fdf5f0b2fff3f1" rel="noreferrer noopener nofollow">[email protected]</a>",
        "createdByType": "User",
        "createdAt": "xxxx",
        "lastModifiedBy": "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="116574626551767c70787d3f727e7c" rel="noreferrer noopener nofollow">[email protected]</a>",
        "lastModifiedByType": "User",
        "lastModifiedAt": "xxxx"
    },
    "properties": {
        "provisioningState": "Failed",
        "vnetConfiguration": {
            "internal": false,            "infrastructureSubnetId": "/subscriptions/xxxx/resourceGroups/yyy/providers/Microsoft.Network/virtualNetworks/testvnt/subnets/aaaa",
            "dockerBridgeCidr": "10.1.0.1/16",
            "platformReservedCidr": "10.0.0.0/16",
            "platformReservedDnsIP": "10.0.0.2"
        },
        "deploymentErrors": "**ErrorCode: ManagedEnvironmentResourceDisallowedByPolicy, Message: Fail to create managed environment because creation of required resources was disallowed by policy, refer to https://go.microsoft.com/fwlink/?linkid=2198255 for more detail.**",
        "defaultDomain": "xxxxxx.westeurope.azurecontainerapps.io",
        "appLogsConfiguration": {
            "destination": "log-analytics",
            "logAnalyticsConfiguration": {
                "customerId": "xxxxxxxxxx"
            }
        }
    }
}

在这种情况下，阻止我们的策略是:https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F783ea2a8-b8fd-46be-896a-9ae79643a0b1

任何人都可以通过提供指导来帮助我们

经过几个小时的故障排除并深入研究后，我们发现该策略:https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2F783ea2a8-b8fd-46be-896a-9ae79643a0b1不允许我们。为了交叉检查，我们在没有网络的情况下进行了部署，发现它已成功创建。

Answer 1

创建容器应用程序时，这不是强制/默认策略。如果在租户或组织级别启用了“容器应用应禁用外部网络访问”策略，则不允许。

Azure 内置 Policy对于 Azure 容器应用程序并了解有关此的问题 tutorial

我通过在租户上启用此策略并尝试创建容器应用程序重现了该问题。

不应允许在 ARM 模板下运行，因为来自容器应用程序的流量已公开。

门户中的基本模板

模板 json 文件

{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "subscriptionId": {
            "type": "string"
        },
        "name": {
            "type": "string"
        },
        "location": {
            "type": "string"
        },
        "environmentId": {
            "type": "string"
        },
        "containers": {
            "type": "array"
        },
        "secrets": {
            "type": "secureObject",
            "defaultValue": {
                "arrayValue": []
            }
        },
        "registries": {
            "type": "array"
        },
        "ingress": {
            "type": "object"
        }
    },
    "resources": [
        {
            "apiVersion": "2022-06-01-preview",
            "name": "[parameters('name')]",
            "type": "Microsoft.App/containerapps",
            "kind": "containerapps",
            "location": "[parameters('location')]",
            "dependsOn": [],
            "properties": {
                "environmentId": "[parameters('environmentId')]",
                "configuration": {
                    "secrets": "[parameters('secrets').arrayValue]",
                    "registries": "[parameters('registries')]",
                    "activeRevisionsMode": "Single",
                    "ingress": "[parameters('ingress')]"
                },
                "template": {
                    "containers": "[parameters('containers')]",
                    "scale": {
                        "minReplicas": 0
                    }
                }
            }
        }
    ]
}

参数json文件

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "subscriptionId": {
            "value": "********************"
        },
        "name": {
            "value": "demoswarnaapp"
        },
        "location": {
            "value": "westeurope"
        },
        "environmentId": {
            "value": "/subscriptions/****************resourceGroups/Compute-Resources/providers/Microsoft.App/managedEnvironments/Testca"
        },
        "containers": {
            "value": [
                {
                    "name": "simple-hello-world-container",
                    "image": "mcr.microsoft.com/azuredocs/containerapps-helloworld:latest",
                    "command": [],
                    "resources": {
                        "cpu": 0.25,
                        "memory": ".5Gi"
                    }
                }
            ]
        },
        "registries": {
            "value": []
        },
        "secrets": {
            "value": {
                "arrayValue": []
            }
        },
        "ingress": {
            "value": {
                "external": true,
                "targetPort": 80
            }
        }
    }
}

禁用该策略后，它会被允许并成功部署。