Terraform 有条件地为子网创建服务端点

Question

我有一个用于在 Azure 中创建虚拟网络和子网的 Terraform 脚本。该代码继承了一个模块，该模块同时创建了 vnet 和子网。我正在尝试创建一个 VNET 和两个子网，但只想为特定子网启用服务端点。 需要有关如何操作的帮助

module "vnet" { 
        source                          = "./modules/VirtualNetwork"
        VirtualNetwork_Name             = "${var.prefix}-${var.resource_group_name}-VNET1"
        Resource_Group_Name             = azurerm_resource_group.resource_group.name
        Location                        = azurerm_resource_group.resource_group.location
        VirtualNetwork_AddressSpace     = ["10.4.0.0/23"]
        Subnet_Name                     = ["snet-1","snet-2"]
        Subnet_Addresses                = ["10.4.0.0/24","10.4.1.0/24"]
       
        Service_Endpoints               = vnet.Subnet_Name == "snet-1" ? ["Microsoft.AzureCosmosDB"] : [""]
   
if subnet=="snet-1" then ["Microsoft.AzureCosmosDB"] else ["nothing"]

        Tags                            = {
                                                environment     = "prod"
                                                resource        = "VNET"
                                                cost_center     = "Test Cost Ceneter"
                                            }                       

}

以下代码用于网络模块

# Creates the virtual network for the resources
resource "azurerm_virtual_network" "vnet" {

  name                = var.VirtualNetwork_Name
  location            = var.Location
  resource_group_name = var.Resource_Group_Name
  address_space       = var.VirtualNetwork_AddressSpace
  tags                = var.Tags
}



# Create two subnet for the vnet
resource "azurerm_subnet" "subnet" {

  name                    = var.Subnet_Name[count.index]
  address_prefix          = var.Subnet_Addresses[count.index]
  resource_group_name     = var.Resource_Group_Name
  virtual_network_name    = azurerm_virtual_network.vnet.name
  count                   = length(var.Subnet_Name)
  # service_endpoints       = ["Microsoft.AzureCosmosDB"]
  service_endpoints       = var.Service_Endpoints
}

Answer 1

根据您的要求，您只想为特定子网启用服务端点。您可以在 azurerm_subnet 块中设置 conditional-expressions。

您可以像这样更改代码，我已经在我这边进行了验证。

main.if在根目录下。

variable "subnet_name" {
    default = ["subnet1","subnet2"]
}
# retrieve a specific subnet via the index of subnet list.
locals {
    subnet_name_enable_service_endpoint = element(var.subnet_name,0)
}

...

module "vnet" { 
       
        source                          = "./modules/VirtualNetwork"
        VirtualNetwork_Name             = "${var.prefix}-${var.resource_group_name}-VNET1"
        Resource_Group_Name             = azurerm_resource_group.main.name
        Location                        = azurerm_resource_group.main.location
        VirtualNetwork_AddressSpace     = ["10.4.0.0/23"]
        Subnet_Addresses                = ["10.4.0.0/24","10.4.1.0/24"]
        Subnet_Name                     = var.subnet_name
        specfic_subnet_name             = local.subnet_name_enable_service_endpoint
        Service_Endpoints               = ["Microsoft.AzureCosmosDB"]

        Tags                            = {
                                                environment     = "prod"
                                                resource        = "VNET"
                                                cost_center     = "Test Cost Ceneter"
                                            }                       

}

网络模块配置在路径./modules/VirtualNetwork.

# declare a variable for accepting the specific subnet.
variable "specfic_subnet_name" {
    
}
...
#Create Virtual Network in Primary Resource Group
resource "azurerm_virtual_network" "primary" {
  name                = var.VirtualNetwork_Name
  resource_group_name = var.Resource_Group_Name
  address_space       = var.VirtualNetwork_AddressSpace
  location            = var.Location

  tags = var.Tags

}


#Create Subnet in Virtual Network
resource "azurerm_subnet" "primary" {
  count = length(var.Subnet_Name)
  name                 = var.Subnet_Name[count.index]
  resource_group_name  = var.Resource_Group_Name
  virtual_network_name = azurerm_virtual_network.primary.name
  address_prefixes     = [element(var.Subnet_Addresses,count.index)]
  service_endpoints    = element(var.Subnet_Name,count.index) == var.specfic_subnet_name ? var.Service_Endpoints : [""]
  
}

Answer 2

./modules/VirtualNetwork只有子网创建部分

# Create two subnet for the vnet
resource "azurerm_subnet" "subnet" {

  name                    = var.Subnet_Name[count.index]
  address_prefix          = var.Subnet_Addresses[count.index]
  resource_group_name     = var.Resource_Group_Name
  virtual_network_name    = azurerm_virtual_network.vnet.name
  count                   = length(var.Subnet_Name)
 
  service_endpoints       =  element(var.Service_Endpoints,count.index) 
}

main.tf

module "vnet" { 
        source                          = "./modules/VirtualNetwork"
        VirtualNetwork_Name             = "${var.prefix}-${var.resource_group_name}-VNET1"
        Resource_Group_Name             = azurerm_resource_group.resource_group.name
        Location                        = azurerm_resource_group.resource_group.location
        VirtualNetwork_AddressSpace     = ["10.4.0.0/23"]
        Subnet_Name                     = ["snet-1","snet-2"]
        Subnet_Addresses                = ["10.4.0.0/24","10.4.1.0/24"]
       
        Service_Endpoints               = [["Microsoft.AzureCosmosDB",""], [""]] 
}

关键是将服务端点作为列表传递 Service_Endpoints = [["Microsoft.AzureCosmosDB",""], [""]]。根据子网的索引，它将分配服务端点

Terraform 有条件地为子网创建服务端点

Terraform conditional creation of Service endpoint for a subnet

azure

azure-virtual-network

terraform

terraform-provider-azure