Azure Terraform创建VM时Key Vault域名解析失败问题排查

问题概述 #

使用Terraform创建Azure虚拟机时，azurerm_key_vault_secret资源创建超时，报错无法解析Key Vault域名kvapplitest2sbx.vault.azure.net，找不到该主机。

错误信息 #

module.virtual_machine.azurerm_key_vault_secret.client_credentials_login: Still creating... [6m20s elapsed]
module.virtual_machine.azurerm_key_vault_secret.client_credentials_password: Still creating... [6m20s elapsed]

│ Error: checking for presence of existing Secret "toto-login" (Key Vault "https://kvapplitest2sbx.vault.azure.net/"): autorest/Client#Do: Preparing request failed: StatusCode=0 -- Original Error: Get "https://kvapplitest2sbx.vault.azure.net/secrets/toto-login/?api-version=7.4": dial tcp: lookup kvapplitest2sbx.vault.azure.net: no such host
│
│   with module.virtual_machine.azurerm_key_vault_secret.client_credentials_login,
│   on ..\..\modules\virtual_machine\14_keyvault.tf line 13, in resource "azurerm_key_vault_secret" "client_credentials_login":
│   13: resource "azurerm_key_vault_secret" "client_credentials_login" {
│

相关代码 #

main.tf #

terraform {
  required_version = ">= 1.0.0"
}

provider "azurerm" {
  skip_provider_registration = true
  features {}
}

provider "azurerm" {
  skip_provider_registration = true
  alias                      = "gallery"
  subscription_id            = sort(data.azurerm_subscriptions.osfactory.subscriptions.*.subscription_id)[0]
  features {}
}

data "azurerm_subscriptions" "osfactory" {
  display_name_prefix = "Suez IT OSFactory"
}

data "azurerm_resource_group" "cloud_bundle_rg" {
  name = "rg-applitest2-sbx" # To be updated
}

module "virtual_machine" {
  source = "../../modules/virtual_machine"
  providers = {
    azurerm.gallery = azurerm.gallery
  }
  cloudbundle_info = data.azurerm_resource_group.cloud_bundle_rg
  index            = 123
  size             = "Standard_D2s_v3"
  os_disk_type     = "Standard_LRS"
  role             = "example"
  ad_domain        = "green.local"
  os = {
    type    = "Windows"
    version = "2022"
  }
}

outputs.tf #

output "virtual_machine_outputs" {
  value       = module.virtual_machine
  description = "Virtual machine outputs."
}

排查方向 #

• Key Vault资源未创建成功：登录Azure控制台，检查资源组rg-applitest2-sbx中是否存在名为kvapplitest2sbx的Key Vault。若不存在，排查模块中Key Vault的创建逻辑，是否存在依赖缺失、部署超时或配置错误导致创建失败。
• DNS解析异常：在执行Terraform的本地环境中，运行nslookup kvapplitest2sbx.vault.azure.net或ping kvapplitest2sbx.vault.azure.net，确认是否能正常解析域名。若无法解析，检查本地DNS配置，确保能访问公网DNS服务器，或在私有网络环境中配置正确的DNS转发规则。
• Key Vault配置错误：确认Key Vault的名称是否正确，Azure Key Vault域名格式为{vault-name}.vault.azure.net（全局区域）或{vault-name}.{region}.vault.azure.net（特定区域）。若Key Vault配置了私有端点，需确保Terraform执行环境能访问对应私有网络。
• 模块引用错误：检查14_keyvault.tf中对Key Vault的引用逻辑，是否硬编码了错误的域名，或引用的Key Vault资源ID与实际部署的资源不匹配。
• 订阅与权限问题：确认Terraform使用的账号/服务主体有权限访问该Key Vault，且Key Vault所在订阅与主azurerm provider配置的订阅一致（注意代码中存在两个provider，需区分资源所在订阅）。

内容的提问来源于stack exchange，提问作者jack