azure - 使用 azurerm 配置 Terraform 子网时出错

Question

最近我发现我的 AKS 集群拥有一个太小的子网。因此，我尝试添加第二个子网和节点池(现在可以通过 Azure CNI 实现)，然后创建一个适当的子网并将其迁移回来。

在terraform plan期间，一切顺利并有有效响应，但在应用时会抛出错误。

Error: Error Creating/Updating Subnet "me-test-k8s-subnet2" (Virtual Network "me-test-k8s-vnet" / Resource Group "me-test-k8s-rg"): network.SubnetsClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="NetcfgInvalidSubnet" Message="Subnet 'me-test-k8s-subnet2' is not valid in virtual network 'me-test-k8s-vnet'." Details=[]

  on main.tf line 28, in resource "azurerm_subnet" "subnet2":
  28: resource "azurerm_subnet" "subnet2" {

我的原始集群是使用以下 Terraform 配置创建的:

  name     = "${var.cluster_name}-rg"
  location = "${var.location}"
}

resource "azurerm_virtual_network" "network" {
  name                = "${var.cluster_name}-vnet"
  location            = "${azurerm_resource_group.rg.location}"
  resource_group_name = "${azurerm_resource_group.rg.name}"
  address_space       = ["10.1.0.0/16"]
}

resource "azurerm_subnet" "subnet" {
  name                 = "${var.cluster_name}-subnet"
  resource_group_name  = "${azurerm_resource_group.rg.name}"
  address_prefixes     = ["10.1.0.0/24"]
  virtual_network_name = "${azurerm_virtual_network.network.name}"
}

为了让事情变得更简单，我决定首先将子网添加到没有节点池的网络中。这将带我了解这个地形计划:

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # azurerm_subnet.subnet2 will be created
  + resource "azurerm_subnet" "subnet2" {
      + address_prefix                                 = (known after apply)
      + address_prefixes                               = [
          + "10.2.0.0/22",
        ]
      + enforce_private_link_endpoint_network_policies = false
      + enforce_private_link_service_network_policies  = false
      + id                                             = (known after apply)
      + name                                           = "me-test-k8s-subnet2"
      + resource_group_name                            = "me-test-k8s-rg"
      + virtual_network_name                           = "me-test-k8s-vnet"
    }

希望有人能解释一下为什么会出现这个错误。

最好，皮姆

Answer 1

在虚拟网络中创建子网时，必须检查其是否没有跳出网络范围。

您刚刚超出了网络掩码的范围:10.1.0.0/16

First host: 10.1.0.1    
Last  host: 10.1.255.254

并且您正在尝试创建子网 10.2.0.0/22。

为了不与已创建的子网重叠，可以接受 10.1.4.0/22。