Terraform 升级到 0.14.0/azurerm 到 2.65.0 导致应用程序网关配置中的 SSL 证书出现问题

Question

将 terraform 升级到 0.14.0 并将 azurerm 升级到 2.65.0 后，我在应用程序网关部分遇到了三个关于 ssl 证书配置的错误。

错误：预期“ssl_certificate.0.key_vault_secret_id”不是空字符串，得到

on ~/modules/someservice/gateways.tf line 120, in resource "azurerm_application_gateway" "network":
102:   ssl_certificate {

错误：无法设置计算属性

on ~/modules/someservice/gateways.tf line 120, in resource "azurerm_application_gateway" "network":
120:   ssl_certificate {

无法设置计算属性，但已为 “ssl_certificate.0.id”.

错误：无法设置计算属性

on ~/modules/someservice/gateways.tf line 120, in resource "azurerm_application_gateway" "network":
120:   ssl_certificate {

无法设置计算属性，但已为 “ssl_certificate.0.public_cert_data”.

但是 key_vault_secret_id 配置在我的代码中不存在：

ssl_certificate {
    name     = local.certificate_name
    data     = filebase64("./ssl-cert/appgwcert.pfx")
    password = "SecretPwd"
  }

应用程序网关的片段：

terraform {
  required_version = "= 0.14.0"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "2.65.0"
    }
  }
}

provider "azurerm" {
  features {}
}


# #################################################################
 
resource "azurerm_public_ip" "pub-ip" {
  name                = "appgw-pubIP"
  resource_group_name = local.resour_group_name
  location            = local.resour_group_location
  allocation_method   = "Dynamic"
}


resource "azurerm_subnet" "subnet-01" {
  name                 = "seubnet-app-gateway"
  resource_group_name  = local.resour_group_name
  virtual_network_name = "vnet-app-gateway"
  address_prefixes     = ["10.21.0.0/24"]
}

#&nbsp;since these variables are re-used - a locals block makes this more maintainable
locals {
  resour_group_name              = "app-gateway-test-01"
  resour_group_location          = "westus2"
  backend_address_pool_name      = "backend-pool-test-01"
  frontend_port_name             = "port_443"
  frontend_ip_configuration_name = "appGwPublicFrontendIp"
  http_setting_name              = "http-settings-test-01"
  listener_name                  = "https-listener-01"
  request_routing_rule_name      = "routrul-test-01"
  certificate_name               = "appgw-cert-test-01"
}

resource "azurerm_application_gateway" "network" {
  name                = "app-gateway-test-01"
  resource_group_name = local.resour_group_name
  location            = local.resour_group_location

  sku {
    name     = "Standard_V2"
    tier     = "Standard"
    capacity = 2
  }

  gateway_ip_configuration {
    name      = "appGatewayIpConfig"
    subnet_id = azurerm_subnet.subnet-01.id
  }

  frontend_port {
    name = local.frontend_port_name
    port = 443
  }

  frontend_ip_configuration {
    name                 = local.frontend_ip_configuration_name
    public_ip_address_id = azurerm_public_ip.pub-ip.id
  }

  backend_address_pool {
    name = local.backend_address_pool_name
  }

  backend_http_settings {
    name                  = local.http_setting_name
    cookie_based_affinity = "Disabled"
    port                  = 80
    protocol              = "Http"
    request_timeout       = 20
  }

  http_listener {
    name                           = local.listener_name
    frontend_ip_configuration_name = local.frontend_ip_configuration_name
    frontend_port_name             = local.frontend_port_name
    protocol                       = "Https"
    ssl_certificate_name           = local.certificate_name
  }

  ssl_certificate {
    name     = local.certificate_name
    # reference the dummy certificate
    data     = filebase64("./ssl-cert/appgwcert.pfx")
    # this is only a dummy and not the actual certificate to be used thus no harm in storing the password
    password = "SecretPwd"
  }

  request_routing_rule {
    name                       = local.request_routing_rule_name
    rule_type                  = "Basic"
    http_listener_name         = local.listener_name
    backend_address_pool_name  = local.backend_address_pool_name
    backend_http_settings_name = local.http_setting_name
  }

  lifecycle {
    ignore_changes = [ssl_certificate, http_listener] 
    }
}

我不知道如何解决？

Answer 1

您的代码中几乎没有问题，我已经修复了这些问题并在我的环境中进行了测试。

Public IP 应该有 Sku = Standard 和 allocation_method = static。
应用程序网关中的 Sku 名称 是 standard_v2 但 tier 是 Standard ，它应该是相同的，即 standard_v2 .
我使用了 terraform 版本 1.0.5 而不是使用 terraform 版本 0.14.0.

所以，修改后的代码如下：

terraform {
  required_version = "1.0.5"
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "2.65.0"
    }
  }
}
provider "azurerm" {
  features {}
}
# #################################################################
 
resource "azurerm_public_ip" "pub-ip" {
  name                = "appgw-pubIP"
  resource_group_name = local.resour_group_name
  location            = local.resour_group_location
  allocation_method   = "Static"
  sku = "standard"
}


resource "azurerm_subnet" "subnet-01" {
  name                 = "seubnet-app-gateway"
  resource_group_name  = local.resour_group_name
  virtual_network_name = "ansuman-vnet"
  address_prefixes     = ["172.31.10.0/24"]
}

#&nbsp;since these variables are re-used - a locals block makes this more maintainable
locals {
  resour_group_name              = "myresourcegroup"
  resour_group_location          = "westus2"
  backend_address_pool_name      = "backend-pool-test-01"
  frontend_port_name             = "port_443"
  frontend_ip_configuration_name = "appGwPublicFrontendIp"
  http_setting_name              = "http-settings-test-01"
  listener_name                  = "https-listener-01"
  request_routing_rule_name      = "routrul-test-01"
  certificate_name               = "appgw-cert-test-01"
}

resource "azurerm_application_gateway" "network" {
  name                = "app-gateway-test-01"
  resource_group_name = local.resour_group_name
  location            = local.resour_group_location

  sku {
    name     = "Standard_v2"
    tier     = "Standard_v2"
    capacity = 2
  }

  gateway_ip_configuration {
    name      = "appGatewayIpConfig"
    subnet_id = azurerm_subnet.subnet-01.id
  }

  frontend_port {
    name = local.frontend_port_name
    port = 443
  }

  frontend_ip_configuration {
    name                 = local.frontend_ip_configuration_name
    public_ip_address_id = azurerm_public_ip.pub-ip.id
  }

  backend_address_pool {
    name = local.backend_address_pool_name
  }

  backend_http_settings {
    name                  = local.http_setting_name
    cookie_based_affinity = "Disabled"
    port                  = 80
    protocol              = "Http"
    request_timeout       = 20
  }

  http_listener {
    name                           = local.listener_name
    frontend_ip_configuration_name = local.frontend_ip_configuration_name
    frontend_port_name             = local.frontend_port_name
    protocol                       = "Https"
    ssl_certificate_name           = local.certificate_name
  }

  ssl_certificate {
    name     = local.certificate_name
    # reference the dummy certificate
    data     = filebase64("C:/powershellpfx.pfx")
    # this is only a dummy and not the actual certificate to be used thus no harm in storing the password
    password = "password@1234"
  }

  request_routing_rule {
    name                       = local.request_routing_rule_name
    rule_type                  = "Basic"
    http_listener_name         = local.listener_name
    backend_address_pool_name  = local.backend_address_pool_name
    backend_http_settings_name = local.http_setting_name
  }

  lifecycle {
    ignore_changes = [ssl_certificate, http_listener] 
    }
}

输出：

Terraform 升级到 0.14.0/azurerm 到 2.65.0 导致应用程序网关配置中的 SSL 证书出现问题

Terraform Upgrade to 0.14.0/azurerm to 2.65.0 Causing an Issue regarding SSL Cert in Application Gateway Configuration

terraform

terraform-provider-azure