Azure Container Apps卷挂载失败求助：Terraform部署权限问题

问题场景 #

使用Terraform部署Azure Container Apps时，挂载Azure File卷失败，容器因VolumeMountFailure终止，报错mount error(13): Permission denied，配置已对照官方文档检查，相关错误日志及Terraform代码如下：

错误日志 #

{"TimeStamp":"2024-08-21 15:41:18 \u002B0000 UTC","Type":"Warning","ContainerAppName":"pyapi","RevisionName":"pyapi--hi0d6li","ReplicaName":"pyapi--hi0d6li-7cc8bbcdc5-rjw5x","Msg":"Container \u0027api\u0027 was terminated with exit code \u0027\u0027 and reason \u0027VolumeMountFailure\u0027. One or more errors occurred. (Shell command exited with non-zero status code. StatusCode = 32 | StdOut =  | StdErr = mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)
) (Shell command exited with non-zero status code. StatusCode = 32 | StdOut =  | StdErr = mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) and kernel log messages (dmesg)
)","Reason":"ContainerTerminated","EventSource":"ContainerAppController","Count":5}

Terraform代码 #

#api.tf
data "azurerm_user_assigned_identity" "pyapi_id" {
  name                = "fkallel-aca-id"
  resource_group_name = data.azurerm_resource_group.rg.name
}

resource "azurerm_container_app" "pyapi" {
  name                         = "pyapi"
  container_app_environment_id = azurerm_container_app_environment.fk-apps-env.id
  resource_group_name          = data.azurerm_resource_group.rg.name
  revision_mode                = "Single"
  workload_profile_name        = "Consumption" 

  template {
    container {
      name   = "api"
      image  = "docker.io/nginx:latest"
      cpu    = 0.25
      memory = "0.5Gi"

      volume_mounts {
        name = "nfsv"
        path = "/data"
      }
    }

    volume {
      name         = "nfsv"
      storage_name = "nfs"
      storage_type = "AzureFile"
    }

  }
  ingress {
    allow_insecure_connections = false
    external_enabled           = true
    target_port                = 8080
    transport                  = "auto"

    traffic_weight {
      latest_revision = true
      percentage      = 100
    }
  }
  identity {
    type = "UserAssigned"
    identity_ids = [data.azurerm_user_assigned_identity.pyapi_id.id]
  }
 
}

排查思路 #

• 存储账户权限验证

  • 确认用户分配身份fkallel-aca-id已被授予存储账户的Storage File Data SMB Share Contributor角色，该角色是托管身份挂载Azure File的核心权限。
  • 检查权限作用范围是否覆盖目标文件共享nfs所在的存储账户或共享资源本身，避免权限范围过窄。

• 存储账户网络配置检查

  • 若存储账户启用虚拟网络防火墙，需将Container Apps环境所属的虚拟子网添加到允许访问列表；测试阶段可临时设置存储账户允许所有网络访问，验证是否为网络限制导致。
  • 确认存储账户Secure transfer required设置为启用状态，Azure File SMB挂载依赖安全传输。

• 卷配置与容器路径权限核对

  • 验证Terraform中volume块的storage_name是否与存储账户中已创建的文件共享名称完全一致（名称大小写敏感）。
  • 检查容器内挂载路径/data的权限：nginx镜像默认以nginx用户运行，需确保该用户对/data有读写权限。可通过自定义镜像提前创建目录并设置权限（如RUN mkdir -p /data && chown nginx:nginx /data），或临时用root用户运行容器测试。

• 托管身份关联有效性检查

  • 确认用户分配身份fkallel-aca-id已成功关联到Container App，且身份状态正常（未被禁用或删除）。
  • Consumption模式下的Container Apps环境必须配置虚拟网络，否则托管身份无法访问存储账户，需检查环境网络配置是否合规。

• 日志补充调试

  • 开启存储账户诊断日志，查看是否有身份验证失败记录，定位权限验证环节的具体错误。
  • 使用Azure CLI执行az storage share list --account-name <存储账户名> --auth-mode login --user-assigned-identity <身份ID>，验证该身份是否能正常访问目标文件共享。

内容的提问来源于stack exchange，提问作者user3620514