如何用Terraform管控Azure容器环境创建时的额外网络资源？

使用以下Terraform代码创建Azure容器应用环境（Container App Environment）及相关资源时，发现系统自动在随机命名的新资源组中创建了额外的网络资源（如负载均衡器、公共IP等）：

##################### Resource Group #####################

resource "azurerm_resource_group" "rg" {
  name     = var.resource_group_name
  location = var.location
  tags     = var.tags
}


##################### Workspace #####################

resource "azurerm_log_analytics_workspace" "law" {
  name                = var.workspace_name
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  sku                 = "PerGB2018"
  retention_in_days   = 90
  tags                = var.tags
}


##################### Network #####################

resource "azurerm_virtual_network" "network" {
  name                = var.virtual_network_name
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  address_space       = ["10.0.0.0/16"]
  tags                = var.tags

  depends_on = [
    azurerm_resource_group.rg
  ]
}


##################### Subnet #####################

resource "azurerm_subnet" "subnet" {
  name                 = var.subnet_name
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = var.virtual_network_name

  address_prefixes = ["10.0.0.0/23"]

  service_endpoints = ["Microsoft.AzureCosmosDB", "Microsoft.Storage"]

  depends_on = [
    azurerm_resource_group.rg,
    azurerm_virtual_network.network
  ]
}


##################### Container App Environment #####################

resource "azurerm_container_app_environment" "cae" {
  name                           = var.cae_name
  location                       = var.location
  resource_group_name            = var.resource_group_name
  log_analytics_workspace_id     = azurerm_log_analytics_workspace.law.id
  infrastructure_subnet_id       = azurerm_subnet.subnet.id
  internal_load_balancer_enabled = false
  tags                           = var.tags

  depends_on = [
    azurerm_resource_group.rg,
    azurerm_log_analytics_workspace.law,
    azurerm_subnet.subnet
  ]
}

需要解决的问题：

• 如何管控这些自动新增的网络资源？
• 能否自行通过Terraform创建这些资源，将其放入指定的同一资源组，并管控名称、标签等属性？

Azure容器应用环境在使用自定义子网时，默认会自动创建托管网络资源并放入系统生成的随机资源组。要实现完全管控，需采用自定义网络模式，手动创建所需网络资源并关联到容器应用环境。

1. 手动创建所需网络资源 #

提前在指定资源组内创建以下资源，可自定义名称、标签等属性：

# 公共IP地址（容器应用环境入口流量用）
resource "azurerm_public_ip" "cae_pip" {
  name                = "cae-public-ip"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  allocation_method   = "Static"
  sku                 = "Standard"
  tags                = var.tags
}

# 标准负载均衡器
resource "azurerm_lb" "cae_lb" {
  name                = "cae-lb"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  sku                 = "Standard"
  tags                = var.tags

  frontend_ip_configuration {
    name                 = "frontend-ip"
    public_ip_address_id = azurerm_public_ip.cae_pip.id
  }
}

# NAT网关（容器应用出站流量用）
resource "azurerm_nat_gateway" "cae_nat" {
  name                = "cae-nat-gateway"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  sku_name            = "Standard"
  tags                = var.tags
}

# 路由表（关联子网，指向NAT网关）
resource "azurerm_route_table" "cae_route" {
  name                = "cae-route-table"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  tags                = var.tags

  route {
    name                   = "default-nat"
    address_prefix         = "0.0.0.0/0"
    next_hop_type          = "NatGateway"
    next_hop_in_ip_address = azurerm_nat_gateway.cae_nat.id
  }
}

# 更新子网，关联路由表
resource "azurerm_subnet" "subnet" {
  name                 = var.subnet_name
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = var.virtual_network_name
  address_prefixes     = ["10.0.0.0/23"]
  service_endpoints    = ["Microsoft.AzureCosmosDB", "Microsoft.Storage"]
  route_table_id       = azurerm_route_table.cae_route.id
  tags                 = var.tags
}

2. 修改容器应用环境配置，关联自定义资源 #

在azurerm_container_app_environment中添加参数，指定手动创建的网络资源：

resource "azurerm_container_app_environment" "cae" {
  name                           = var.cae_name
  location                       = var.location
  resource_group_name            = var.resource_group_name
  log_analytics_workspace_id     = azurerm_log_analytics_workspace.law.id
  infrastructure_subnet_id       = azurerm_subnet.subnet.id
  internal_load_balancer_enabled = false
  tags                           = var.tags

  # 关联自定义网络资源
  load_balancer_id       = azurerm_lb.cae_lb.id
  public_ip_address_id   = azurerm_public_ip.cae_pip.id
  nat_gateway_id         = azurerm_nat_gateway.cae_nat.id

  depends_on = [
    azurerm_resource_group.rg,
    azurerm_log_analytics_workspace.law,
    azurerm_subnet.subnet,
    azurerm_lb.cae_lb,
    azurerm_public_ip.cae_pip,
    azurerm_nat_gateway.cae_nat
  ]
}

3. 关键注意事项 #

• 配置完成后，Azure不会再自动创建随机资源组和托管网络资源，所有资源均由Terraform管控。
• 确保所有网络资源的SKU与容器应用环境要求匹配（如均为Standard级）。
• 子网需满足容器应用环境的最低要求：地址空间至少/23，且未被其他资源占用。

内容的提问来源于stack exchange，提问作者zXynK