同一资源组多VNet中Function Apps访问KeyVault私有密钥问题

部署环境与配置 #

使用Bicep部署1个KeyVault和2个Function App，将编译后的ARM模板通过Azure门户「部署自定义模板」测试。KeyVault核心配置如下：

• 禁用公网访问
• 配置私有端点及关联的私有DNS区域链接

对应的核心Bicep代码：

var is_private_access = SUBNET_ID != ''

resource KeyVault 'Microsoft.KeyVault/vaults@2024-04-01-preview' = {
  name: key_vault_unique_name
  location: REGION
  properties: {
    accessPolicies: ENABLE_RBAC_AUTHORIZATION ? [] : ACCESS_POLICIES
    createMode: CREATE_MODE
    enabledForDeployment: ENABLED_FOR_DEPLOYMENT
    enabledForDiskEncryption: ENABLED_FOR_DISK_ENCRYPTION
    enabledForTemplateDeployment: ENABLED_FOR_TEMPLATE_DEPLOYMENT
    enablePurgeProtection: ENABLE_PURGE_PROTECTION
    enableRbacAuthorization: ENABLE_RBAC_AUTHORIZATION
    enableSoftDelete: ENABLE_SOFT_DELETE
    networkAcls: {}
    publicNetworkAccess: is_private_access ? 'disabled' : 'enabled'
    sku: {
      family: 'A'
      name: 'Standard'
    }
    softDeleteRetentionInDays: SOFT_DELETE_RETENTION_DAYS
    tenantId: TENANT_ID
    vaultUri: VAULT_URI
  }
}

resource PrivateEndpoint 'Microsoft.Network/privateEndpoints@2021-02-01' = if (is_private_access) {
  name: take('VaultPrivateEndpoint-${KEY_VAULT_UNIQUE_STRING}', 64)
  location: REGION
  properties: {
    subnet: {
      id: SUBNET_ID
    }
    privateLinkServiceConnections: [
      {
        name: '${KeyVault.name}-file-private-link-connection'
        properties: {
          privateLinkServiceId: KeyVault.id
          groupIds: [
            'vault'
          ]
        }
      }
    ]
  }
}

resource VaultPrivateDnsZone 'Microsoft.Network/privateDnsZones@2020-06-01' existing = if (is_private_access) {
  name: 'privatelink.vaultcore.azure.net'
}

resource PrivateDnsZoneLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2020-06-01' = if (is_private_access) {
  parent: VaultPrivateDnsZone
  name: take('virtual-network-link-${KEY_VAULT_UNIQUE_STRING}', 64)
  location: REGION
  properties: {
    registrationEnabled: false
    virtualNetwork: {
      id: VNET_ID
    }
  }
}

resource PrivateDnsZoneGroup 'Microsoft.Network/privateEndpoints/privateDnsZoneGroups@2023-11-01' = if (is_private_access) {
  parent: PrivateEndpoint
  name: 'VaultDnsGroup'
  properties: {
    privateDnsZoneConfigs: [
      {
        name: 'vaultConfig'
        properties: {
          privateDnsZoneId: VaultPrivateDnsZone.id
        }
      }
    ]
  }
}

两个Function App分别部署在独立的VNet和子网中，每个子网都配置了指向privatelink.vaultcore.azure.net私有DNS区域的私有端点及链接。

故障现象 #

• 第一个VNet的私有端点部署完成后，对应Function App可正常从KeyVault拉取密钥填充环境变量
• 部署第二个VNet的私有端点后，两个Function App均无法连接KeyVault

排查结果 #

• 第二个私有端点部署时，会在privatelink.vaultcore.azure.net私有DNS区域中覆盖KeyVault对应的A记录，将原有IP替换为第二个私有端点的IP
• 手动为该A记录添加两个私有端点的IP可临时恢复连接，但私有端点的IP是部署阶段自动生成的，无法在ARM模板中直接引用，导致该临时方案无法通过模板自动化部署

补充说明 #

遵循微软KeyVault私有部署指南及故障排查文档时，文档建议为每个VNet创建私有DNS区域，但同一资源组内无法创建多个同名的privatelink.vaultcore.azure.net私有DNS区域，该方案不具备可行性。

内容的提问来源于stack exchange，提问作者Sahar LaOr