如何在Terraform中调用Kudu相关方法完成Azure Web App部署？

核心思路 #

Terraform本身没有直接集成Kudu的资源，但可以通过local-exec、null_resource配合Azure CLI/PowerShell脚本，或是直接调用Kudu REST API，实现Web App创建后的命令执行需求。

方法一：用local-exec调用Azure CLI #

在Web App资源创建完成后，通过local-exec provisioner调用Azure CLI获取Kudu凭据并执行命令：

resource "azurerm_linux_web_app" "demo_app" {
  name                = "demo-linux-app"
  resource_group_name = azurerm_resource_group.demo_rg.name
  location            = azurerm_resource_group.demo_rg.location
  service_plan_id     = azurerm_service_plan.demo_plan.id

  site_config {
    application_stack {
      python_version = "3.11"
    }
  }
}

resource "null_resource" "kudu_deploy" {
  depends_on = [azurerm_linux_web_app.demo_app]

  provisioner "local-exec" {
    command = <<EOT
      # 获取Kudu FTP发布凭据
      KUDU_CREDS=$(az webapp deployment list-publishing-profiles --name ${azurerm_linux_web_app.demo_app.name} --resource-group ${azurerm_resource_group.demo_rg.name} --query "[?publishMethod=='FTP'].{user:userName,pass:publishPassword}" -o tsv)
      KUDU_USER=$(echo $KUDU_CREDS | cut -f1)
      KUDU_PASS=$(echo $KUDU_CREDS | cut -f2)
      
      # 调用Kudu REST API执行shell命令（示例：列出站点根目录内容）
      curl -u $KUDU_USER:$KUDU_PASS -X POST https://${azurerm_linux_web_app.demo_app.name}.scm.azurewebsites.net/api/command -H "Content-Type: application/json" -d '{"command":"ls -la /home/site/wwwroot"}'
    EOT
  }
}

• 必须设置depends_on，确保Web App完全创建后再触发Kudu操作
• 可根据实际需求替换curl请求的命令体，比如执行部署脚本、上传静态文件等

方法二：用PowerShell脚本调用Kudu API #

若习惯使用PowerShell，可在local-exec中执行PowerShell命令：

resource "null_resource" "kudu_powershell" {
  depends_on = [azurerm_linux_web_app.demo_app]

  provisioner "local-exec" {
    interpreter = ["pwsh", "-Command"]
    command = <<EOT
      $webAppName = "${azurerm_linux_web_app.demo_app.name}"
      $resourceGroupName = "${azurerm_resource_group.demo_rg.name}"
      
      # 获取发布凭据
      $publishingProfile = az webapp deployment list-publishing-profiles --name $webAppName --resource-group $resourceGroupName --query "[?publishMethod=='FTP']" | ConvertFrom-Json
      $kuduCreds = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("$($publishingProfile.userName):$($publishingProfile.publishPassword)"))
      
      # 调用Kudu API创建演示目录
      $apiUrl = "https://$webAppName.scm.azurewebsites.net/api/command"
      $body = @{ command = "mkdir /home/site/wwwroot/demo" } | ConvertTo-Json
      Invoke-RestMethod -Uri $apiUrl -Headers @{Authorization = "Basic $kuduCreds"} -Method Post -Body $body -ContentType "application/json"
    EOT
  }
}

方法三：用Terraform的http provider直接调用Kudu API #

如果不想依赖本地执行环境，可使用Terraform内置的http provider发起API请求：

# 获取Web App发布凭据
data "azurerm_web_app_publishing_profile" "demo_app" {
  name                = azurerm_linux_web_app.demo_app.name
  resource_group_name = azurerm_resource_group.demo_rg.name
}

# 调用Kudu API克隆代码仓库
resource "http" "kudu_command" {
  depends_on = [azurerm_linux_web_app.demo_app]

  url = "https://${azurerm_linux_web_app.demo_app.name}.scm.azurewebsites.net/api/command"
  method = "POST"
  headers = {
    Authorization = "Basic ${base64encode("${data.azurerm_web_app_publishing_profile.demo_app.ftp_username}:${data.azurerm_web_app_publishing_profile.demo_app.ftp_password}")}"
    Content-Type = "application/json"
  }
  body = jsonencode({
    command = "cd /home/site/wwwroot && git clone https://github.com/your-repo/demo-app.git"
  })
}

• 该方式完全在Terraform内部处理，无需本地安装Azure CLI或PowerShell，但调试难度略高于脚本方式

销毁环境的注意事项 #

由于你的环境为演示后销毁，只需确保所有Kudu操作相关资源（如null_resource、http资源）与Web App通过depends_on关联，Terraform销毁时会自动清理所有关联资源。Kudu操作产生的文件会随Web App销毁一并删除，无需额外处理残留内容。

内容的提问来源于stack exchange，提问作者TheDemonLord