Terraform 使用 for_each 为选定的子网创建 azure 子网委托

Question

我需要一些关于在选定的天蓝色子网上创建委派的帮助。我的代码如下所示。

我的变量文件中定义的变量

variable “subnets” {
type = map(any)
}

我的 tfvar 文件包含以下值

subnets = {
mlops-aue-snt-aks = [“10.255.232.0/24”]
mlops-aue-snt-stg = [“10.255.233.0/26”]
mlops-aue-snt-kv = [“10.255.233.128/27”]
AzureBastionSubnet = [“10.255.233.160/27”]
mlops-aue-snt-shd = [“10.255.234.0/25”]
mlops-aue-snt-db1 = [“10.255.235.0/26”]
mlops-aue-snt-db2 = [“10.255.235.64/26”]
mlops-aue-snt-aci = [“10.255.235.128/26”]
}

这是我的子网代码

resource “azurerm_subnet” “azr_subnet” {
for_each = var.subnets

name = each.key
resource_group_name = azurerm_resource_group.rg.name
virtual_network_name = azurerm_virtual_network.vnet.name
address_prefixes = each.value
enforce_private_link_endpoint_network_policies = true
}

所有子网都是用这个创建的，一切都很好，但现在我需要为 mlops-aue-snt-db1 和 mlops-aue-snt-db2 添加 service_delegation，而对于其他子网则不同。我不确定如何使用我现有的代码来实现这一点。我无法从代码中分离出子网，因为它会强制删除现有的子网并创建不推荐的新子网。我确实阅读了一些关于使用动态块进行更改的帖子，但不确定如何根据我的要求为选择性子网实施它。

谁能建议如何在 terraform 中实现这一点？

Answer 1

您可以使用 dynamic blocks 来做到这一点，并通过稍微更改您的 subnets 来做到这一点。

subnets = {
    mlops-aue-snt-aks = {
            cidr = [“10.255.232.0/24”]
            service_delegation = false
    }    
    # the rest in same format
    mlops-aue-snt-db1 = {
            cidr = [“10.255.235.0/26”]
            service_delegation = true
    }    
    mlops-aue-snt-db2 = {
            cidr = [“10.255.235.64/26”]
            service_delegation = true
    }
    # ...
}

然后

resource "azurerm_subnet" "azr_subnet" {
    for_each = var.subnets

    name = each.key
    resource_group_name = azurerm_resource_group.rg.name
    virtual_network_name = azurerm_virtual_network.vnet.name
    address_prefixes = each.value.cidr
    enforce_private_link_endpoint_network_policies = true
    
    dynamic "delegation" {
        for_each = each.value.service_delegation == "true" ? [1] : []
        
        content {
            name = "delegation"

            service_delegation {
            name    = "Microsoft.ContainerInstance/containerGroups"
            actions = ["Microsoft.Network/virtualNetworks/subnets/join/action", "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action"]
            }        
        }
    
    }
}