Terraform 允许 AKS 使用 ACR
Terraform allow AKS to use ACR
这是我的 Terraform 代码,用于创建 AKS 集群并允许它使用我的 ACR(在同一订阅中):
resource "azurerm_kubernetes_cluster" "aks" {
name = var.aks-cluster-name
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
kubernetes_version = "1.18.8"
dns_prefix = "${var.aks-cluster-name}-dns"
default_node_pool {
name = "default"
vm_size = "Standard_D2_v2"
enable_auto_scaling = false
node_count = 3
availability_zones = ["1", "2", "3"]
type = "VirtualMachineScaleSets"
enable_node_public_ip = false
}
network_profile {
network_plugin = "azure"
load_balancer_sku = "standard"
}
identity {
type = "SystemAssigned"
}
addon_profile {
oms_agent {
enabled = true
log_analytics_workspace_id = data.azurerm_log_analytics_workspace.log_workspace.id
}
kube_dashboard {
enabled = false
}
azure_policy {
enabled = false
}
}
}
data "azurerm_container_registry" "acr_name" {
name = "myacr"
resource_group_name = "acr_rg"
}
resource "azurerm_role_assignment" "aks_to_acr_role" {
scope = data.azurerm_container_registry.acr_name.id
role_definition_name = "AcrPull"
principal_id = azurerm_kubernetes_cluster.aks.kubelet_identity[0].object_id
}
我遇到这个错误(Status=403 Code="AuthorizationFailed"):
azurerm_role_assignment.aks_to_acr_role: Creating...
Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client 'xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx' with object id 'xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx
d/resourceGroups/acr_rg/providers/Microsoft.ContainerRegistry/registries/gcrclientacr/providers/Microsoft.Authorization/roleAssignments/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx' or the scope is invalid. If access was recently granted, please refresh your credentials."
on main.tf line 91, in resource "azurerm_role_assignment" "aks_to_acr_role":
91: resource "azurerm_role_assignment" "aks_to_acr_role" {
我为我的 AKS 使用了托管标识而不是主要服务。
感谢您的帮助..
问题是服务主体 运行 terraform 代码无权将 AcrPull 角色分配授予 AKS 托管标识。这是一个 AD 权限问题。
要么授予服务主体(执行 terraform 代码的人)所有者角色(贡献者是不够的),要么授予它具有执行 Microsoft.Authorization/roleAssignments/write
操作权限的自定义角色。
这是我的 Terraform 代码,用于创建 AKS 集群并允许它使用我的 ACR(在同一订阅中):
resource "azurerm_kubernetes_cluster" "aks" {
name = var.aks-cluster-name
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
kubernetes_version = "1.18.8"
dns_prefix = "${var.aks-cluster-name}-dns"
default_node_pool {
name = "default"
vm_size = "Standard_D2_v2"
enable_auto_scaling = false
node_count = 3
availability_zones = ["1", "2", "3"]
type = "VirtualMachineScaleSets"
enable_node_public_ip = false
}
network_profile {
network_plugin = "azure"
load_balancer_sku = "standard"
}
identity {
type = "SystemAssigned"
}
addon_profile {
oms_agent {
enabled = true
log_analytics_workspace_id = data.azurerm_log_analytics_workspace.log_workspace.id
}
kube_dashboard {
enabled = false
}
azure_policy {
enabled = false
}
}
}
data "azurerm_container_registry" "acr_name" {
name = "myacr"
resource_group_name = "acr_rg"
}
resource "azurerm_role_assignment" "aks_to_acr_role" {
scope = data.azurerm_container_registry.acr_name.id
role_definition_name = "AcrPull"
principal_id = azurerm_kubernetes_cluster.aks.kubelet_identity[0].object_id
}
我遇到这个错误(Status=403 Code="AuthorizationFailed"):
azurerm_role_assignment.aks_to_acr_role: Creating...
Error: authorization.RoleAssignmentsClient#Create: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="AuthorizationFailed" Message="The client 'xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx' with object id 'xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx' does not have authorization to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx
d/resourceGroups/acr_rg/providers/Microsoft.ContainerRegistry/registries/gcrclientacr/providers/Microsoft.Authorization/roleAssignments/xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx' or the scope is invalid. If access was recently granted, please refresh your credentials."
on main.tf line 91, in resource "azurerm_role_assignment" "aks_to_acr_role":
91: resource "azurerm_role_assignment" "aks_to_acr_role" {
我为我的 AKS 使用了托管标识而不是主要服务。
感谢您的帮助..
问题是服务主体 运行 terraform 代码无权将 AcrPull 角色分配授予 AKS 托管标识。这是一个 AD 权限问题。
要么授予服务主体(执行 terraform 代码的人)所有者角色(贡献者是不够的),要么授予它具有执行 Microsoft.Authorization/roleAssignments/write
操作权限的自定义角色。