两个资源组服务之间的 private_endpoint

Question

我在 azure 中有一个容器注册表，由 terraform 实现，您可以在以下代码中看到：

resource "azurerm_container_registry" "container_registry" {
  name                = replace("${var.name}${var.namespace}", "-", "")
  location            = var.location
  resource_group_name = azurerm_resource_group.resource_group.name

  sku = "Premium"

  public_network_access_enabled = false

  network_rule_set = [
    {
      default_action = "Deny"
      ip_rule = []
      virtual_network = [
        for subnet_id in var.allowed_subnets : {
          action    = "Allow"
          subnet_id = subnet_id
        }
      ]
    }
  ]
}

另一方面，我有一个具有不同资源组的虚拟机。因为我想将 VM 中创建的 docker-images 推送到 registry 我想在这两者之间建立一个私人连接。我的terraform 项目如下：

resource "azurerm_subnet" "subnet" {
  name                = "${var.name}-${var.namespace}"
  resource_group_name = azurerm_resource_group.resource_group.name

  virtual_network_name = azurerm_virtual_network.virtual_network.name
  address_prefixes     = ["10.0.1.0/24"]
  service_endpoints    = ["Microsoft.ContainerRegistry"]

  enforce_private_link_endpoint_network_policies = true
}

resource "azurerm_role_assignment" "role_assignment" {
  scope                = data.terraform_remote_state.container_registry.outputs.container_registry_id
  role_definition_name = "AcrPush"
  principal_id         = azurerm_linux_virtual_machine.virtual_machine.identity[0].principal_id
}

resource "azurerm_private_endpoint" "private_endpoint" {
  name                = "${var.name}-${var.namespace}"
  location            = var.location
  resource_group_name = azurerm_resource_group.resource_group.name
  subnet_id           = azurerm_subnet.subnet.id

  private_service_connection {
    name                           = "container-private-connection"
    subresource_names              = ["registry"] 
    private_connection_resource_id = data.terraform_remote_state.container_registry.outputs.container_registry_id
    is_manual_connection           = false

  }
}

我想通过private_endpoint 我可以为az acr login --name 建立安全连接，但它不起作用并返回 403。你能帮我解决这个问题吗？

Unable to get AAD authorization tokens with message: An error occurred: CONNECTIVITY_REFRESH_TOKEN_ERROR
Access to registry 'tempregistry.azurecr.io' was denied. Response code: 403. Please try running 'az login' again to refresh permissions.
WARNING: Unable to get admin user credentials with message: The resource with name 'tempregistry' and type 'Microsoft.ContainerRegistry/registries' could not be found in subscription 'temp-dev'.
ERROR: Unable to authenticate using AAD or admin login credentials. Please specify both username and password in non-interactive mode

（我删除了额外的代码，例如资源定义和 vnet）

Answer 1

我尝试了代码并收到与您相同的错误：

Unable to get AAD authorization tokens with message: An error occurred: CONNECTIVITY_REFRESH_TOKEN_ERROR
Access to registry 'ansumanacrtest.azurecr.io' was denied. Response code: 403. Please try running 'az login' again to refresh permissions.
WARNING: Unable to get admin user credentials with message: The resource with name 'ansumanacrtest' and type 'Microsoft.ContainerRegistry/registries' could not be found in subscription 'xxxxx'.
ERROR: Unable to authenticate using AAD or admin login credentials. Please specify both username and password in non-interactive mode

要解决上述错误，我们必须在 ACR 所在的同一资源组中提供 VM Reader 角色的托管身份，以读取详细信息ACR 和启用 ACR 中的管理员以创建用户名和密码。

但是当我再次尝试从 Run Command in Portal 进行相同操作时，它给了我 login failed 错误 作为 不允许运行命令使用的 IP 如下：

所以，一旦我获得了 Portal 使用的 IP，然后我将它添加到下面代码中的网络规则集中，我之前使用它来创建资源：

resource "azurerm_container_registry" "container_registry" {
  name                = "ansumanacrtest"
  location            = data.azurerm_resource_group.example.location
  resource_group_name = data.azurerm_resource_group.example.name
  sku = "Premium"
  admin_enabled = true
  public_network_access_enabled = true # as we are running commands from Run Command Script , we have to allow selected public access
#network rule set can be added after you get the IP from portal Run Command
  network_rule_set { 
      default_action = "Deny"
      ip_rule = [{
          action = "Allow"
          ip_range = "20.127.31.73"## IP received from the above error 
      }]
  }
}
resource "azurerm_role_assignment" "role_assignment" {
  scope                = azurerm_container_registry.container_registry.id
  role_definition_name = "AcrPush"
  principal_id         = azurerm_linux_virtual_machine.example.identity[0].principal_id
}

resource "azurerm_role_assignment" "VMcontributor" {
  scope = data.azurerm_resource_group.example.id
  role_definition_name = "Reader"
  principal_id = azurerm_linux_virtual_machine.example.identity[0].principal_id
}


resource "azurerm_private_endpoint" "private_endpoint" {
  name                = "pe-ansumanacr"
  location            = data.azurerm_resource_group.example.location
  resource_group_name = data.azurerm_resource_group.example.name
  subnet_id           = azurerm_subnet.subnet.id

  private_dns_zone_group {
    name = "container-dns-group"
    private_dns_zone_ids = ["${azurerm_private_dns_zone.example.id}"]
  }

  private_service_connection {
    name                           = "container-private-connection"
    subresource_names              = ["registry"] 
    private_connection_resource_id = azurerm_container_registry.container_registry.id
    is_manual_connection           = false

  }
}
resource "azurerm_private_dns_zone" "example" {
  name                = "privatelink.azureacr.io"
  resource_group_name = data.azurerm_resource_group.example.name
}

#private DNS Link
resource "azurerm_private_dns_zone_virtual_network_link" "example" {
  name                  = "${azurerm_container_registry.container_registry.name}-dnslink"
  resource_group_name   = data.azurerm_resource_group.example.name
  private_dns_zone_name = azurerm_private_dns_zone.example.name
  virtual_network_id    = azurerm_virtual_network.example.id
  registration_enabled = false
} 

输出：