AKS与ACR之间专用端点（Private Endpoint）Terraform配置异常排查及正确配置求助

看起来你遇到的问题大概率是因为Terraform配置中缺少了Private DNS Zone的关联配置，或者没有正确指定ACR Private Endpoint的子资源类型。手动创建时Azure会自动帮你关联Private DNS Zone，但Terraform需要显式配置这部分。下面是修正后的完整Terraform脚本，我会逐一说明关键补充项：

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.97.0"
    }
  }
  required_version = ">= 1.1.7"
}

provider "azurerm" {
  features {}
  subscription_id = "xxx"
}

resource "azurerm_resource_group" "rg" {
  name     = "aks-rg"
  location = "East US"
}

# 获取AKS自动创建的虚拟网络（AKS默认会创建VNet，我们需要用它来关联Private Endpoint）
data "azurerm_kubernetes_cluster" "aks_existing" {
  name                = azurerm_kubernetes_cluster.aks.name
  resource_group_name = azurerm_resource_group.rg.name
  depends_on          = [azurerm_kubernetes_cluster.aks]
}

resource "azurerm_kubernetes_cluster" "aks" {
  name                = "my-aks"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  dns_prefix          = "myaks"

  default_node_pool {
    name       = "default"
    node_count = 2
    vm_size    = "Standard_B2s"
  }

  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_container_registry" "acr" {
  name                = "my-aks-acr-123"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku                 = "Premium"
  admin_enabled       = true

  network_rule_set {
    default_action = "Deny"
    # 显式允许Private Endpoint访问，让配置更清晰
    private_link_enabled = true
  }
}

# 创建ACR的Private Endpoint
resource "azurerm_private_endpoint" "acr_pe" {
  name                = "acr-private-endpoint"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  subnet_id           = data.azurerm_kubernetes_cluster.aks_existing.default_node_pool[0].subnet_id

  private_service_connection {
    name                           = "acr-private-service-connection"
    private_connection_resource_id = azurerm_container_registry.acr.id
    is_manual_connection           = false
    # 必须指定ACR的子资源类型为"registry"，这是手动创建时Azure自动填充但Terraform需要显式声明的关键项
    subresource_names              = ["registry"]
  }
}

# 创建ACR对应的标准Private DNS Zone
resource "azurerm_private_dns_zone" "acr_dns" {
  name                = "privatelink.azurecr.io"
  resource_group_name = azurerm_resource_group.rg.name
}

# 将Private DNS Zone链接到AKS的虚拟网络，确保AKS节点能解析ACR的私有域名
resource "azurerm_private_dns_zone_virtual_network_link" "acr_dns_link" {
  name                  = "acr-dns-vnet-link"
  resource_group_name   = azurerm_resource_group.rg.name
  private_dns_zone_name = azurerm_private_dns_zone.acr_dns.name
  virtual_network_id    = data.azurerm_kubernetes_cluster.aks_existing.virtual_network_id
  registration_enabled  = false
}

resource "azurerm_role_assignment" "acrpull" {
  principal_id         = azurerm_kubernetes_cluster.aks.kubelet_identity[0].object_id
  role_definition_name = "AcrPull"
  scope               = azurerm_container_registry.acr.id
  skip_service_principal_aad_check = true
}

关键修正点说明： #

• 获取AKS的VNet和子网：AKS默认会自动创建虚拟网络，我们通过data "azurerm_kubernetes_cluster"获取它的ID，确保Private Endpoint部署在AKS节点所在的子网中，保证网络可达。
• Private Endpoint子资源指定：在private_service_connection中必须显式设置subresource_names = ["registry"]，这是ACR Private Endpoint的必填项，手动创建时Azure会默认填充，但Terraform需要你明确声明。
• Private DNS Zone及网络链接：这是最容易忽略的核心配置！AKS节点需要通过DNS解析ACR的私有域名，所以必须创建privatelink.azurecr.io区域，并将其链接到AKS的VNet。手动创建Private Endpoint时Azure会自动完成这一步，但Terraform需要显式配置。
• ACR网络规则显式配置：在ACR的network_rule_set中添加private_link_enabled = true，确保ACR允许通过Private Endpoint访问（Premium SKU默认支持，但显式配置更稳妥）。

部署完成后，你可以在AKS节点上执行nslookup <your-acr-name>.azurecr.io验证解析结果，确认是否指向Private Endpoint的私有IP，此时AKS节点应该就能正常从ACR拉取镜像了。

内容的提问来源于stack exchange，提问作者David S.