【发布时间】：2020-11-18 16:55:30
【问题描述】：
当我在 identity 字段中使用带有 SystemAssigned 的 ARM 模板创建 AKS 群集时，会创建一个格式为 MC_<rg_name>_<cluster_name>_location 的辅助资源组。在该组中，有一个 <cluster-name>-agentpool 形式的托管标识，Kubelet 使用该标识。
手臂模板将在帖子的底部，但总体结构如下。我将它们分开部署的原因是因为我在 subscription 级别部署东西：
Deployment A
- Microsoft.ContainerService/managedClusters
Deployment B (dependsOn A)
- Microsoft.Authorization/roleAssignments
- contains reference to `nodeResourceGroup` with API version so I made explicit dependsOn for A
我计划使用Azure Pod Identity，因此我需要为该托管标识分配两个角色：ManagedIdentityOperator 和VirtualMachineContributor。我有一个变量，它构建了引用中使用的此标识的路径：
"agentpool-account":[concat(subscription().id, '/resourceGroups/', variables('managedClusterResourceGroup'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('cluster-name'), '-agentpool')]
"principalId": "[reference(parameters('agentpool-account'), '2018-11-30', 'full').properties.principalId]",
但是，在我第一次部署此模板时（即在创建集群时），RoleAssignment 部署将由于 Resource Group not found 错误而失败。查看部署活动确认RoleAssignment 已部署在MC_group 被创建，尽管在集群部署上有明确的dependsOn。如果我重新部署模板，它将成功，因为 MC_group 现在根据 ARM 存在。
我想知道是否有其他人遇到过这个问题，以及如何解决这个问题的任何提示都会很棒。我遇到了一个链接https://bmoore-msft.blog/2020/07/26/resource-not-found-dependson-is-not-working/，但似乎对我不起作用。
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.1",
"parameters": {
"cluster-name": {
"metadata": {
"description": "The name of the cluster"
},
"type": "string"
},
},
"resources": [
{
"apiVersion": "2019-10-01",
"location": "centralus",
"name": "test",
"type": "Microsoft.Resources/resourceGroups"
},
{
"apiVersion": "2020-06-01",
"dependsOn": [
"[resourceId('Microsoft.Resources/resourceGroups', 'test')]"
],
"name": "cluster-deployment",
"properties": {
"expressionEvaluationOptions": {
"scope": "outer"
},
"mode": "Incremental",
"parameters": {},
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"outputs": {},
"parameters": {},
"resources": [
{
"apiVersion": "2019-06-01",
"dependsOn": [],
"identity": {
"type": "SystemAssigned"
},
"location": "centralus",
"name": "[parameters('cluster-name')]",
"properties": {
"addonProfiles": {
"azurePolicy": {
"enabled": false
},
"httpApplicationRouting": {
"enabled": false
}
},
"agentPoolProfiles": [
{
"availabilityZones": [
"1",
"2",
"3"
],
"count": 3,
"maxPods": 110,
"mode": "System",
"name": "agentpool",
"osDiskSizeGB": 0,
"osType": "Linux",
"storageProfile": "ManagedDisks",
"type": "VirtualMachineScaleSets",
"vmSize": "Standard_D16s_v3"
}
],
"apiServerAccessProfile": {
"enablePrivateCluster": false
},
"dnsPrefix": "[concat(parameters('cluster-name'), '-dns')]",
"enableRBAC": true,
"kubernetesVersion": "1.17.11",
"networkProfile": {
"loadBalancerSku": "standard",
"networkPlugin": "kubenet",
"networkPolicy": "calico"
}
},
"tags": {},
"type": "Microsoft.ContainerService/managedClusters"
}
],
"variables": {}
}
},
"resourceGroup": "test",
"type": "Microsoft.Resources/deployments"
},
{
"apiVersion": "2020-06-01",
"dependsOn": [
"cluster-deployment"
],
"name": "identity-assignment",
"properties": {
"expressionEvaluationOptions": {
"scope": "outer"
},
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"outputs": {},
"parameters": {},
"resources": [
{
"apiVersion": "2017-09-01",
"name": "[guid('test', 'ManagedIdentityOperator')]",
"properties": {
"principalId": "[reference(variables('agentpoolResourceId'), '2018-11-30', 'full').properties.principalId]",
"roleDefinitionId": "[variables('managedIdentityOperatorRoleId')]",
"scope": "[concat(subscription().id, '/resourceGroups/test')]"
},
"type": "Microsoft.Authorization/roleAssignments"
},
{
"apiVersion": "2017-09-01",
"name": "[guid('test', 'VirtualMachineContributor')]",
"properties": {
"principalId": "[reference(variables('agentpoolResourceId'), '2018-11-30', 'full').properties.principalId]",
"roleDefinitionId": "[variables('virtualMachineContributorRoleId')]",
"scope": "[concat(subscription().id, '/resourceGroups/test')]"
},
"type": "Microsoft.Authorization/roleAssignments"
}
]
}
},
"resourceGroup": "test",
"type": "Microsoft.Resources/deployments"
}
],
"variables": {
"agentPoolResourceId": "[concat(subscription().id, '/resourceGroups/', variables('managedClusterResourceGroup'), '/providers/Microsoft.ManagedIdentity/userAssignedIdentities/', parameters('cluster-name'), '-agentpool')]",
"managedClusterResourceGroup": "[concat('MC_test_', parameters('cluster-name'), '_centralus')]",
"managedIdentityOperatorRoleId": "[concat(subscription().id, '/providers/Microsoft.Authorization/roleDefinitions/f1a07417-d97a-45cb-824c-7a7467783830')]",
"virtualMachineContributorRoleId": "[concat(subscription().id, '/providers/Microsoft.Authorization/roleDefinitions/9980e02c-c2be-4d73-94e8-173b1dc7cf3c')]"
}
}
【问题讨论】：
标签： azure azure-resource-manager arm-template azure-resource-group