应用程序网关的两个前端端口使用相同的端口 443 - terraform 中的 Azure 应用程序网关

Question

我正在使用 Terraform 配置 Azure 应用程序网关。

以下是我写的模块：

locals {
  backend_address_pool_name      = format("appgwbeap-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  frontend_port_name             = format("appgwfeport-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  frontend_ip_configuration_name = format("appgwfeip-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  http_setting_name              = format("appgwhtst-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  listener_name                  = format("appgwhttplstnr-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  request_routing_rule_name      = format("appgwrqrt-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  redirect_configuration_name    = format("appgwrdrcfg-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
}

resource "azurerm_application_gateway" "appgw" {
  name                = format("appgw-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  resource_group_name = var.rg_name
  location            = var.location

  sku {
    name     = var.sku_name
    tier     = var.sku_tier
    capacity = var.sku_capacity
  }

  gateway_ip_configuration {
    name      = format("appgwipcfg-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
    subnet_id = var.subnet_id
  }

  frontend_port {
    name = "appgwfeport-app1-uatizweb-gw"
    port = "443"
  }


  frontend_port {
    name = "appgwfeport-app2-uatizweb-gw"
    port = "443"
  }

  ssl_certificate {
    name     = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    data     = filebase64("./certificates/web.app1.sso.gwwu.xxx.com.de-12Jan2021.pfx")
    password = "${var.app1_pfx_password}"
  }
  authentication_certificate {
    name = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    data = file("./certificates/web_app1_sso_gwwu_xxx_com_de-12Jan21.cer")
  }  

  ssl_certificate {
    name     = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    data     = filebase64("./certificates/selfsigned-app2-uat-01Mar21.pfx")
    password = "${var.app1_pfx_password}"
  }
  authentication_certificate {
    name = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    data = file("./certificates/selfsigned-app2-uat-01Mar21.cer")
  }  

  frontend_ip_configuration {
    name                 = "${local.frontend_ip_configuration_name}"
    subnet_id            = var.subnet_id
    private_ip_address   = var.frontend_private_ip
    private_ip_address_allocation = "Static"
  }

  backend_address_pool {
    name = "beap-path-app1-app"
    #fqdns     = var.fqdn_list
    ip_addresses = ["10.xxx.xxx.36"]
  }

  backend_address_pool {
    name = "beap-path-app2-app"
    #fqdns     = var.fqdn_list
    ip_addresses = ["10.xxx.xxx.37"]
  }

  backend_http_settings {
    name                  = "behs-path-app1-app"
    cookie_based_affinity = var.backend_cookie_based_affinity
    affinity_cookie_name  = "ApplicationGatewayAffinity"
    path                  = var.backend_path
    port                  = "443"
    #probe_name            = "probe-app1"
    protocol              = "Https"
    request_timeout       = var.backend_request_timeout
    authentication_certificate {
      name = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    }
  }

  backend_http_settings {
    name                  = "behs-path-app2-app"
    cookie_based_affinity = var.backend_cookie_based_affinity
    affinity_cookie_name  = "ApplicationGatewayAffinity"
    path                  = var.backend_path
    port                  = "443"
    #probe_name            = "probe-app2"
    protocol              = "Https"
    request_timeout       = var.backend_request_timeout
    authentication_certificate {
      name = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    }
  }

  http_listener {
    name                           = "appgwhttplsnr-app1-uatizweb-gw"
    frontend_ip_configuration_name = "${local.frontend_ip_configuration_name}"
    frontend_port_name             = "appgwfeport-app1-uatizweb-gw"
    protocol                       = "Https"
    ssl_certificate_name           = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    require_sni                    = true
    host_name                      = "web.app1.sso.gwwu.xxx.com.de"
  }

  http_listener {
    name                           = "appgwhttplsnr-app2-uatizweb-gw"
    frontend_ip_configuration_name = "${local.frontend_ip_configuration_name}"
    frontend_port_name             = "appgwfeport-app2-uatizweb-gw"
    ssl_certificate_name           = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    require_sni                    = true
    protocol                       = "Https"
    host_name                      = "web.app2.sso.gwwu.xxx.com.de"
  }

  request_routing_rule {
    name                       = "appgwrqrt-app2-uatizweb-gw"
    rule_type                  = var.backend_rule_type
    http_listener_name         = "appgwhttplsnr-app2-uatizweb-gw"
    backend_address_pool_name  = "beap-path-app2-app"
    backend_http_settings_name = "behs-path-app2-app"
  }

  request_routing_rule {
    name                       = "appgwrqrt-app1-uatizweb-gw"
    rule_type                  = var.backend_rule_type
    http_listener_name         = "appgwhttplsnr-app1-uatizweb-gw"
    backend_address_pool_name  = "beap-path-app1-app"
    backend_http_settings_name = "behs-path-app1-app"
  }
}

下面是调用模块的main.tf:

module "app_gateway" {
  source                     = "../../../modules/appgateway"
  rg_name                    = var.rg_name
  agency                     = local.agency
  project_code               = local.project_code
  env                        = var.env
  zone                       = var.zone
  tier                       = "appgw"
  location                   = local.location
  vnet_name                  = var.vnet_name
  subnet_id                  = module.agw_subnet.subnet_id
  sku_name                   = var.appgw_sku_name
  sku_capacity               = var.appgw_sku_capacity
  frontend_private_ip        = var.appgw_frontend_ip
  frontend_port              = var.frontend_port
  frontend_protocol          = var.frontend_protocol
  app1_pfx_password          = "${var.app1_pfx_password}"
  backend_protocol           = var.backend_protocol
  backend_port               = var.backend_port
  backend_path               = "/"
  providers = {
    azurerm = azurerm.corpapps
  }
}

我已经使用了多站点，但是当我部署 -i 时出现以下错误： two frontend ports of application gateway are using the same port number 443.

当我将其中一个端口更改为 5443 时 - 它确实已部署并从 Terraform 运行。另外，我可以从 portal.Can 创建两个带有 443（多站点）的前端端口，而不是从 terraform 执行此操作。

terraform 我错过了什么。对此有任何帮助！

Answer 1

我们可以为多站点侦听器使用相同的前端配置（前端 IP、协议、端口或名称），而不是创建两个 frontend_port 名称。

例如修改相关代码：

 resource "azurerm_application_gateway" "appgw" {
    #..
    
      frontend_port {
        name = "appgwfeport-app1-uatizweb-gw"
        port = "443"
      }
    
    
    #  frontend_port {
    #    name = "appgwfeport-app2-uatizweb-gw"
    #    port = "443"
    #  }
    
    #..
    
    
      http_listener {
        name                           = "appgwhttplsnr-app1-uatizweb-gw"
        frontend_ip_configuration_name = "${local.frontend_ip_configuration_name}"
        frontend_port_name             = "appgwfeport-app1-uatizweb-gw"
        protocol                       = "Https"
        ssl_certificate_name           = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
        require_sni                    = true
        host_name                      = "web.app1.sso.gwwu.xxx.com.de"
      }
    
      http_listener {
        name                           = "appgwhttplsnr-app2-uatizweb-gw"
        frontend_ip_configuration_name = "${local.frontend_ip_configuration_name}"
        frontend_port_name             = "appgwfeport-app1-uatizweb-gw"      #change here
        ssl_certificate_name           = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
        require_sni                    = true
        protocol                       = "Https"
        host_name                      = "web.app2.sso.gwwu.xxx.com.de"
      }    
    }

有关详细信息，请阅读 https://docs.microsoft.com/en-us/azure/application-gateway/tutorial-multiple-sites-powershell and https://docs.microsoft.com/en-us/azure/application-gateway/create-multiple-sites-portal#configuration-tab

Answer 2

我们运行在通过 PowerShell 脚本更新 App Gateway 时遇到同样的错误。

场景：已有一个使用 FrontendPort for 80 的现有多站点侦听器。当脚本尝试在同一端口上添加第二个多站点侦听器时，我们收到相同的错误消息。

事实证明，原始侦听器位于 public 前端 IP，而添加的第二个侦听器使用的是私有前端 IP。我没有意识到这一点，但您不能对 public 侦听器和私有侦听器使用相同的前端端口，即使它们都是多站点的也是如此。

无论如何，原始侦听器不应该是 public IP，所以一旦我将原始侦听器调整为使用私有 IP，脚本就没有错误地执行了。

我在此处找到了有关 Private 和 Public IP 无法共享同一端口的解释：

https://github.com/MicrosoftDocs/azure-docs/issues/23652

也许这会对其他人有所帮助。

Answer 3

也许这个 link 会有所帮助：https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-faq#can-i-use-the-same-port-for-both-public-facing-and-private-facing-listeners 简短的回答是——不可能使用相同的私有端口和 public 监听器。作为解决方法，我使用另一个端口（如 10443）进行 https 专用侦听器配置。在我的例子中，它工作正常，因为用户没有使用私有监听器

应用程序网关的两个前端端口使用相同的端口 443 - terraform 中的 Azure 应用程序网关

two frontend ports of application gateway are using the same port 443 - Azure application gateway in terraform

azure

terraform

listener

terraform-provider-azure

azure-application-gateway