AKS和ACR之间的专用端点

Question

我想在我的Azure环境中创建AKS和ACR资源。脚本能够创建这两种资源，我能够连接到它们中的每一种。但是AKS节点不能从ACR中提取图像。经过一些研究，我发现我需要在AKS和ACR之间创建一个专用端点。

奇怪的是，如果我使用Terraform创建PE，AKS和ACR仍然无法通信。如果我手动创建PE，他们就可以通信。我比较了UI上这两个PEs的参数，它们看起来是一样的。

有人能帮我用下面的脚本来定义PE吗？或者让我知道我做错了什么？

谢谢!

不带专用端点的完整TF脚本

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.97.0"
    }
  }

  required_version = ">= 1.1.7"
}

provider "azurerm" {
  features {}

  subscription_id = "xxx"
}

resource "azurerm_resource_group" "rg" {
  name     = "aks-rg"
  location = "East US"
}

resource "azurerm_kubernetes_cluster" "aks" {
  name                = "my-aks"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  dns_prefix          = "myaks"

  default_node_pool {
    name       = "default"
    node_count = 2
    vm_size    = "Standard_B2s"
  }

  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_container_registry" "acr" {
  name                = "my-aks-acr-123"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku                 = "Premium"
  admin_enabled       = true

  network_rule_set {
    default_action = "Deny"
  }
}

resource "azurerm_role_assignment" "acrpull" {
  principal_id                     = azurerm_kubernetes_cluster.aks.kubelet_identity[0].object_id
  role_definition_name             = "AcrPull"
  scope                            = azurerm_container_registry.acr.id
  skip_service_principal_aad_check = true
}

Answer 1

然后，您需要创建一个VNET、一个子网(这段代码中没有一部分)加上一个私有DNS区域：

专用DNS专区：

resource "azurerm_private_dns_zone" "example" {
  name                = "mydomain.com"
  resource_group_name = azurerm_resource_group.example.name
}

AKS部分：

resource "azurerm_kubernetes_cluster" "aks" {
  name                = "my-aks"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  dns_prefix          = "myaks"
  private_cluster_enabled   = true

  default_node_pool {
    name       = "default"
    node_count = 2
    vm_size    = "Standard_B2s"
  }

  identity {
    type = "SystemAssigned"
  }
}

您需要为ACR创建ACR和私有端点：

resource "azurerm_container_registry" "acr" {
  name                = "my-aks-acr-123"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  public_network_access_enabled = false
  sku                 = "Premium"
  admin_enabled       = true
}

resource "azurerm_private_endpoint" "acr" {
  name                = "pvep-acr"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  subnet_id           = YOUR_SUBNET

  private_service_connection {
    name                           = "example-acr"
    private_connection_resource_id = azurerm_container_registry.acr.id
    is_manual_connection           = false
    subresource_names              = ["registry"]
  }

  private_dns_zone_group {
    name                 = data.azurerm_private_dns_zone.example.name
    private_dns_zone_ids = [data.azurerm_private_dns_zone.example.id]
  }
}

resource "azurerm_role_assignment" "acrpull" {
  principal_id                     = azurerm_kubernetes_cluster.aks.kubelet_identity[0].object_id
  role_definition_name             = "AcrPull"
  scope                            = azurerm_container_registry.acr.id
  skip_service_principal_aad_check = true
}