如何用Terraform AzAPI实现Azure VMSS实例手动升级？

需求目标 #

用Terraform实现以下az-cli命令的功能：

az vmss update-instances --resource-group GROUP --name VMSS

之前的错误分析 #

错误尝试1：错误使用azapi_resource_action调用manualUpgrade #

原代码将操作名称合并到type参数中，导致资源类型不匹配：

resource "azapi_resource_action" "aks_vmss_model_updrade" {
  type        = "Microsoft.Compute/virtualMachineScaleSets/manualUpgrade@2023-03-01"
  count       = length(data.azurerm_resources.aks_vmss.resources)
  resource_id = data.azurerm_resources.aks_vmss.resources[count.index].id
  method      = "POST"

  lifecycle {
    replace_triggered_by = [azurerm_virtual_machine_scale_set_extension.aks_vmss_az_agent]
  }
}

错误原因：azapi_resource_action的type需指定父资源类型，操作名称应单独放在action参数中，而非合并到type里。

错误尝试2：错误修改VMSS实例的upgradePolicy #

原代码错误地针对VMSS单个实例修改upgradePolicy，而该属性属于VMSS本身：

resource "azapi_resource" "aks_vmss_model_updrade" {
  name      = "aks-vmss-model-upgrade"
  type      = "Microsoft.Compute/virtualMachineScaleSets/virtualMachines@2022-11-01"
  count     = length(data.azurerm_resources.aks_vmss.resources)
  parent_id = data.azurerm_resources.aks_vmss.resources[count.index].id
  body      = jsonencode({ properties = { upgradePolicy = { mode = "string" } } })

  lifecycle {
    replace_triggered_by = [azurerm_virtual_machine_scale_set_extension.aks_vss_az_agent]
  }
}

错误原因：upgradePolicy是VMSS级别的配置，不属于单个虚拟机实例，且误用azapi_resource修改实例属性方向错误。

正确实现方案 #

方案1：调用updateInstances操作实现单次手动升级 #

通过azapi_resource_action正确调用VMSS的updateInstances操作，匹配az vmss update-instances的功能：

data "azurerm_resources" "aks_vmss" {
  resource_group_name = local.aks_internal_rg_name
  type                = "Microsoft.Compute/virtualMachineScaleSets"
  depends_on = [
    azurerm_kubernetes_cluster_node_pool.user
  ]
}

resource "azurerm_virtual_machine_scale_set_extension" "aks_vmss_az_agent" {
  count                        = length(data.azurerm_resources.aks_vmss.resources)
  virtual_machine_scale_set_id = data.azurerm_resources.aks_vmss.resources[count.index].id

  name                       = "AzureMonitorLinuxAgent"
  publisher                  = "Microsoft.Azure.Monitor"
  type                       = "AzureMonitorLinuxAgent"
  type_handler_version       = "1.25"
  auto_upgrade_minor_version = "true"

  depends_on = [
    azurerm_kubernetes_cluster.aks,
    azurerm_log_analytics_workspace.workspace
  ]
}

resource "azapi_resource_action" "aks_vmss_update_instances" {
  count       = length(data.azurerm_resources.aks_vmss.resources)
  resource_id = data.azurerm_resources.aks_vmss.resources[count.index].id
  type        = "Microsoft.Compute/virtualMachineScaleSets@2023-03-01"
  action      = "updateInstances"
  method      = "POST"
  body        = jsonencode({
    instanceIds = ["*"] # 升级所有实例，可替换为具体实例ID列表如["0", "1"]
  })

  lifecycle {
    replace_triggered_by = [azurerm_virtual_machine_scale_set_extension.aks_vmss_az_agent]
  }
}

关键修正点：

• type指定VMSS的标准资源类型，与resource_id匹配
• 用action参数单独指定要执行的updateInstances操作
• body中通过instanceIds指定要升级的实例范围

方案2：修改VMSS升级策略实现自动升级（可选） #

若需后续自动让实例应用最新模型，可修改VMSS的upgradePolicy（此为持久化配置，非单次手动升级）：

resource "azapi_update_resource" "aks_vmss_upgrade_policy" {
  count       = length(data.azurerm_resources.aks_vmss.resources)
  resource_id = data.azurerm_resources.aks_vmss.resources[count.index].id
  type        = "Microsoft.Compute/virtualMachineScaleSets@2023-03-01"
  body        = jsonencode({
    properties = {
      upgradePolicy = {
        mode = "Automatic" # 可选值：Automatic、Manual、Rolling
        automaticOSUpgradePolicy = {
          enableAutomaticOSUpgrade = true
        }
      }
    }
  })
}

内容的提问来源于stack exchange，提问作者jetnet