使用 Terraform 创建具有托管标识的 Azure AKS 会出现 AutoUpgradePreview not enabled 错误

Question

我正在尝试使用 Terraform 创建具有托管身份的 AKS 集群。到目前为止，这是我的代码，非常基本和标准，来自我在网上找到的一些文档和博客文章。

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "2.79.1"
    }
  }
}

provider "azurerm" {
  features {}

  use_msi = true
}

resource "azurerm_resource_group" "rg" {
  name     = "prod_test"
  location = "northeurope"
}

resource "azurerm_kubernetes_cluster" "cluster" {
  name                = "prod_test_cluster"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  dns_prefix          = "weak"

  default_node_pool {
    name       = "default"
    node_count = "4"
    vm_size    = "standard_ds3_v2"
  }

  identity {
    type = "SystemAssigned"
  }
}

这是我无法解决的错误消息。有什么想法吗？

Error: creating Managed Kubernetes Cluster "prod_test_cluster" (Resource Group "prod_test"): containerservice.ManagedClustersClient#CreateOrUpdate: Failure sending request: StatusCode=0 -- Original Error: Code="BadRequest" Message="Feature Microsoft.ContainerService/AutoUpgradePreview is not enabled. Please see https://aka.ms/aks/previews for how to enable features."
│ 
│   with azurerm_kubernetes_cluster.cluster,
│   on main.tf line 19, in resource "azurerm_kubernetes_cluster" "cluster":
│   19: resource "azurerm_kubernetes_cluster" "cluster" {
│

Answer 1

我在我的环境中对其进行了测试，遇到了与您在下面看到的相同的问题：

因此，为了对问题进行描述，AutoChannelUpgrade 到 2021 年 8 月的 public 预览。根据 terraform azurerm provider 2.79.0 ，它默认将该值传递给 none 后端，但由于我们尚未注册该功能，因此无法提供错误 Feature Microsoft.ContainerService/AutoUpgradePreview is not enabled.
要确认您没有注册该功能，您可以使用下面的命令：
```
az feature show -n AutoUpgradePreview --namespace Microsoft.ContainerService 
```
你会看到它没有注册如下：

现在要克服这个问题，您可以尝试下面给出的两种解决方案：

您可以尝试使用 terraform azurerm provider 2.78.0 而不是 2.79.1。
其他解决方案是注册该功能，然后您就可以使用您正在使用的相同代码。

您可以按照以下步骤操作：

You can use below command to register the feature (it will take around 5 mins to get registered) :

az login --identity 
az feature register --namespace Microsoft.ContainerService -n AutoUpgradePreview

After the above is done you can check the registration stauts with below command :

az feature registration show --provider-namespace Microsoft.ContainerService -n AutoUpgradePreview

After the feature status becomes registered you can do a terraform apply to your code .

I tested it using the below code on my VM:

provider "azurerm" {
features {}
subscription_id = "948d4068-xxxxx-xxxxxx-xxxx-e00a844e059b"
tenant_id = "72f988bf-xxxxx-xxxxxx-xxxxx-2d7cd011db47"
use_msi = true
}

resource "azurerm_resource_group" "rg" {
name     = "terraformtestansuman"
location = "west us 2"
}

resource "azurerm_kubernetes_cluster" "cluster" {
name                = "prod_test_cluster"
location            = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
dns_prefix          = "weak"

default_node_pool {
name       = "default"
node_count = "4"
vm_size    = "standard_ds3_v2"
}
identity {
type = "SystemAssigned"
}
}

Outputs:

参考：

Github Issue

Install Azure CLI if not installed on the VM using Microsoft Installer

使用 Terraform 创建具有托管标识的 Azure AKS 会出现 AutoUpgradePreview not enabled 错误

Create Azure AKS with Managed Identity using Terraform gives AutoUpgradePreview not enabled error

kubernetes

terraform

azure-managed-identity

azure-aks