【发布时间】：2021-12-26 11:54:50
【问题描述】：
我试图在我的模块中显式调用提供程序以在 AzureCloud 和 AzureChinaCloud 中创建命名空间。 但是，我在这样做时遇到了问题。以下是我的配置：
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "=2.78.0"
}
}
backend "azurerm" {
resource_group_name = "Terraform-rg"
storage_account_name = "terraformstate"
container_name = "tfstate"
subscription_id = "00000000-0000-0000-0000-000000000000"
key = "prod"
}
}
provider "azurerm" {
features {}
}
provider "azurerm" {
features {}
alias = "sub2"
subscription_id = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
client_id = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
client_secret = var.client_secret
tenant_id = "xxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxxxx"
environment = "china"
}
module "helm_ns_creation" {
source = "./namespace/"
providers = {
azurerm = azurerm
azurerm.sub2 = azurerm.sub2
}
applications = var.applications
geo = var.geo
ns_values = ["${file("../namespace/values.yaml")}"]
}
-------------------
provider "kubernetes" {
config_path = "config"
}
provider "helm" {
kubernetes {
config_path = "config"
}
}
resource "kubernetes_namespace" "aks_namespace" {
provider = azurerm.sub2
for_each = {for ns in var.applications : ns.namespace_name => ns}
metadata {
annotations = {
name = "${each.value.namespace_name}"
}
labels = {
name = "${each.value.team_name}"
}
name = "${each.value.namespace_name}"
}
}
locals {
# get json
namespace_data = jsondecode(file(var.inputfile))
principal_ids = distinct([for principal in local.namespace_data.applications : principal.principal_id])
principal_ids_cn = distinct([for principal_cn in local.namespace_data.applications : principal_cn.principal_id_cn])
get_principal_ids = (var.geo == "cn" ? local.principal_ids_cn : local.principal_ids)
}
data "azurerm_subscription" "global" {
}
resource "azurerm_role_assignment" "custom" {
for_each = toset(local.get_principal_ids)
scope = data.azurerm_subscription.global.id
# scope = "/subscriptions/{$var.subscription_id}"
role_definition_name = var.custom_role
principal_id = each.key
}
resource "azurerm_role_assignment" "builtin" {
for_each = toset(local.get_principal_ids)
scope = data.azurerm_subscription.global.id
role_definition_name = var.builtin_role
principal_id = each.key
}
data "azurerm_subscription" "china" {
provider = azurerm.sub2
}
resource "azurerm_role_assignment" "custom_cn" {
for_each = toset(local.get_principal_ids)
scope = data.azurerm_subscription.china.id
# scope = "/subscriptions/{$var.subscription_id}"
role_definition_name = var.custom_role
principal_id = each.key
}
resource "azurerm_role_assignment" "builtin_cn" {
for_each = toset(local.get_principal_ids)
scope = data.azurerm_subscription.china.id
role_definition_name = var.builtin_role
principal_id = each.key
}
当我运行代码在两个不同的云（中国和全球）中创建命名空间时，我仅在中国地区收到以下错误。但是，对于全球也是如此：
│ 错误：无法列出提供者注册状态，可能是由于凭据无效或服务主体没有使用资源管理器API的权限，Azure错误：resources.ProvidersClient#List：响应失败请求：StatusCode=404 -- 原始错误：autorest/azure：服务返回错误。 Status=404 Code="SubscriptionNotFound" Message="找不到订阅'xxxxxxx-xxxxxx-xxxx-xxxx-xxxxxxxxxx'。"
with provider["registry.terraform.io/hashicorp/azurerm"],
│ on main.tf line 18, in provider "azurerm":
│ 18: provider "azurerm" {
现在中国供应商的订阅失败了。我如何使它适用于两个云（中国和全球）。如果需要任何其他详细信息，请告诉我..
【问题讨论】：
-
您好@pk_dhruv，我可以知道您在命名空间定义中提到的提供者
azurerm.mooncake块在哪里吗？因为我看到中国云别名为“sub2”.. -
@AnsumanBal-MT .. 对错误感到抱歉.. 我现在已经编辑了它.. 我也试过在资源部分没有提供程序块，没有区别..
-
我试过没有成功..我仍然得到同样的错误..
-
kubernetes_namespace不是 azurerm 提供者的一部分，它是kubernetes提供者的一部分。所以，为了使用 kubernetes namespace ，你应该使用 kubernetes provider 而不是 azure rm 。你可以参考这个link -
@AnsumanBal-MT .. 我现在在我的查询中更新了代码.. 我需要按照上面的代码使用 azurerm.. 但是，这似乎不起作用并且失败了错误信息..
标签： azure terraform terraform-provider-azure azure-aks