如何获取Hub虚拟网络资源ID并用于Spoke网络对等配置？

方案1：在同一循环模块内动态引用Hub的resourceId #

适用于希望在同一个参数数组中定义Hub和Spoke，通过内部模块的循环引用实现配置传递。

步骤1：调整顶层参数定义 #

移除Spoke参数中占位的peerings配置，或留空数组：

var virtualNetworkParams = [
  {
    name: 'vnet1-hub'
    resourceGroupName: '<hub-resource-group-name>'
    location: '<azure-region>'
    addressPrefixes: ['10.0.0.0/16']
    subnets: [
      {
        name: 'default'
        addressPrefix: '10.0.0.0/24'
      }
    ]
    peerings: []
  }
  {
    name: 'vnet1-spoke'
    resourceGroupName: '<spoke-resource-group-name>'
    location: '<azure-region>'
    addressPrefixes: ['10.1.0.0/16']
    subnets: [
      {
        name: 'default'
        addressPrefix: '10.1.0.0/24'
      }
    ]
    peerings: []
  }
]

module virtualNetworkModule '../templates/virtualnetwork.deploy.bicep' = {
  name: 'deploy-vnets'
  scope: resourceGroup('<parent-resource-group>')
  params: {
    vNetParam: virtualNetworkParams
  }
}

步骤2：修改virtualnetwork.deploy.bicep模块 #

在内部模块中定位Hub的索引，动态为Spoke生成包含Hub resourceId的对等配置：

param vNetParam array

// 定位Hub虚拟网络的索引
var hubVnetName = 'vnet1-hub'
var hubVnetIndex = findIndex(vNetParam, vnet => vnet.name == hubVnetName)

// 循环部署所有虚拟网络
module vNetModule '../../../../Microsoft.Network/virtualNetworks/deploy.bicep' = [for (vnet, i) in vNetParam: {
  name: 'deploy-${vnet.name}'
  scope: resourceGroup(vnet.resourceGroupName)
  params: {
    name: vnet.name
    location: vnet.location
    addressPrefixes: vnet.addressPrefixes
    subnets: vnet.subnets
    // 仅为Spoke网络生成对等配置，引用Hub的resourceId
    peerings: vnet.name != hubVnetName ? [
      {
        remoteVirtualNetworkId: vNetModule[hubVnetIndex].outputs.resourceId
        allowForwardedTraffic: true
        allowGatewayTransit: false
        useRemoteGateways: false
      }
    ] : vnet.peerings
  }
}]

output vNetResourceIds array = [for (vnet, i) in vNetParam: {
  name: vnet.name
  resourceId: vNetModule[i].outputs.resourceId
}]

方案2：拆分Hub和Spoke的部署模块 #

这种方案逻辑更直观，先部署Hub网络获取resourceId，再传入Spoke的部署参数中。

步骤1：顶层分别部署Hub和Spoke #

// 部署Hub虚拟网络
module hubVnetModule '../templates/virtualnetwork.deploy.bicep' = {
  name: 'deploy-hub-vnet'
  scope: resourceGroup('<hub-resource-group-name>')
  params: {
    vNetParam: [
      {
        name: 'vnet1-hub'
        resourceGroupName: '<hub-resource-group-name>'
        location: '<azure-region>'
        addressPrefixes: ['10.0.0.0/16']
        subnets: [
          {
            name: 'default'
            addressPrefix: '10.0.0.0/24'
          }
        ]
        peerings: []
      }
    ]
  }
}

// 部署Spoke虚拟网络，直接引用Hub的输出resourceId
module spokeVnetModule '../templates/virtualnetwork.deploy.bicep' = {
  name: 'deploy-spoke-vnet'
  scope: resourceGroup('<spoke-resource-group-name>')
  params: {
    vNetParam: [
      {
        name: 'vnet1-spoke'
        resourceGroupName: '<spoke-resource-group-name>'
        location: '<azure-region>'
        addressPrefixes: ['10.1.0.0/16']
        subnets: [
          {
            name: 'default'
            addressPrefix: '10.1.0.0/24'
          }
        ]
        peerings: [
          {
            remoteVirtualNetworkId: hubVnetModule.outputs.vNetResourceIds[0].resourceId
            allowForwardedTraffic: true
            allowGatewayTransit: false
            useRemoteGateways: false
          }
        ]
      }
    ]
  }
}

步骤2：确保底层虚拟网络模块支持peerings参数 #

你的Microsoft.Network/virtualNetworks/deploy.bicep需要包含对等连接的部署逻辑，示例如下：

param name string
param location string
param addressPrefixes array
param subnets array = []
param peerings array = []

resource vNet 'Microsoft.Network/virtualNetworks@2023-05-01' = {
  name: name
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: addressPrefixes
    }
    subnets: subnets
    virtualNetworkPeerings: [for peering in peerings: {
      name: '${name}-to-${split(peering.remoteVirtualNetworkId, '/')[8]}'
      properties: {
        remoteVirtualNetwork: {
          id: peering.remoteVirtualNetworkId
        }
        allowForwardedTraffic: peering.allowForwardedTraffic
        allowGatewayTransit: peering.allowGatewayTransit
        useRemoteGateways: peering.useRemoteGateways
      }
    }]
  }
}

output resourceId string = vNet.id

内容的提问来源于stack exchange，提问作者chwunder