作为我的 Terraform 的一部分,我正在尝试执行以下流程:
代码如下:
data "azurerm_client_config" "current" {}
resource "azurerm_key_vault" "kv" {
name = var.name
location = var.location
resource_group_name = var.resource_group_name
sku_name = var.sku_name
enabled_for_disk_encryption = true
enabled_for_template_deployment = true
tenant_id = data.azurerm_client_config.current.tenant_id
soft_delete_retention_days = var.soft_delete_retention_days
purge_protection_enabled = true
enable_rbac_authorization = var.enable_rbac_authorization
public_network_access_enabled = var.public_network_access_enabled
tags = merge({ StartDate = formatdate("DD-MM-YYYY", time_static.time.rfc3339) }, var.env_tags)
lifecycle {
ignore_changes = [tags]
}
}
resource "azurerm_role_assignment" "kv_admin" {
count = var.vars_dataintelligence.dwh-keyvault.enable_rbac_authorization ? 1 : 0
scope = module.kv-dataintelligence.id
role_definition_name = "Key Vault Administrator"
principal_id = data.azurerm_client_config.current.object_id
}
... long code that creates VM here ....
resource "azurerm_key_vault_secret" "admin_password_secret" {
name = format("%s-%s", azurerm_windows_virtual_machine.name, "admin-pswd")
key_vault_id = azurerm_key_vault.id
value = azurerm_windows_virtual_machine.admin_password
depends_on = [azurerm_role_assignment.kv_admin]
}
不幸的是,由于 Azure 凭据的工作方式,我收到一条错误消息,指出服务主体无权访问所述 Key Vault 来添加该凭据,并且“如果最近授予访问权限,请刷新您的凭据”。 如果我重新运行流程机密,则会正确添加(因为服务主体现在刷新其凭据),但这不是一个完美的状态,因为在执行 1 时我总是会收到错误。
想到的一个解决方法是在运行 TF 之前先行授予服务主体所需的更高范围(资源组/订阅)的访问权限,但这听起来也不像理想的场景,但慢慢地开始认为这可能是我只有一个玩。
或者,可以尝试实现单次重启的逻辑,以防第一次运行脚本的管道失败(在我们的例子中是 GitHub Actions)。
一如既往地感谢任何建议/帮助
使用存储在 terraform 的 keyvault 中的随机密码创建虚拟机。
此要求不会强制运行部署命令两次,因为它是由于用户或 SP 首先分配角色的权限问题而发生的。
我知道密钥保管库管理员将单独为用户或 SP 创建权限,但分配该角色您需要用户访问管理员角色。该角色将提供跨不同范围分配角色的访问权限。
我有幸一次性达到这个要求
创建密钥时引用虚拟机密码的方式也需要修改。
配置:
variable "vm_admin_password" {
description = "The admin password for the VM."
type = string
sensitive = true
}
data "azurerm_client_config" "current" {}
resource "azurerm_resource_group" "rg" {
name = "testvk-resources"
location = "East US"
}
resource "azurerm_key_vault" "kv" {
name = "testtvskkv12345"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
sku_name = "standard"
tenant_id = data.azurerm_client_config.current.tenant_id
soft_delete_retention_days = 7
purge_protection_enabled = true
enable_rbac_authorization = true
public_network_access_enabled = true
enabled_for_disk_encryption = true
enabled_for_template_deployment = true
}
resource "azurerm_role_assignment" "kv_admin" {
scope = azurerm_key_vault.kv.id
role_definition_name = "Key Vault Administrator"
principal_id = data.azurerm_client_config.current.object_id
}
resource "azurerm_windows_virtual_machine" "vm" {
name = "testvkvm"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
network_interface_ids = [azurerm_network_interface.nic.id]
size = "Standard_D2_v2"
os_disk {
caching = "ReadWrite"
storage_account_type = "Standard_LRS"
}
source_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2016-Datacenter"
version = "latest"
}
computer_name = "hostname"
admin_username = "adminuser"
admin_password = var.vm_admin_password
depends_on = [ azurerm_role_assignment.kv_admin ]
}
resource "azurerm_network_interface" "nic" {
name = "testvk-nic"
location = azurerm_resource_group.rg.location
resource_group_name = azurerm_resource_group.rg.name
ip_configuration {
name = "internal"
subnet_id = azurerm_subnet.subnet.id
private_ip_address_allocation = "Dynamic"
}
}
resource "azurerm_subnet" "subnet" {
name = "subnet1"
resource_group_name = azurerm_resource_group.rg.name
virtual_network_name = azurerm_virtual_network.vnet.name
address_prefixes = ["10.0.2.0/24"]
}
resource "azurerm_virtual_network" "vnet" {
name = "testvk-vnet"
resource_group_name = azurerm_resource_group.rg.name
location = azurerm_resource_group.rg.location
address_space = ["10.0.0.0/16"]
}
resource "azurerm_key_vault_secret" "admin_password_secret" {
name = "admin-password"
key_vault_id = azurerm_key_vault.kv.id
value = var.vm_admin_password
depends_on = [azurerm_role_assignment.kv_admin]
}
部署:
参考:
azurerm_key_vault_secret |资源 | Hashicorp/azurerm |地形 | Terraform 注册表
azurerm_windows_virtual_machine |资源 | Hashicorp/azurerm |地形 | Terraform 注册表