Azure Load Balancer使用Bicep部署自定义IP后端池失败问题

尝试通过Bicep部署Azure Load Balancer，后端地址池使用本地通用服务器IP（非Azure VM/VMSS NIC），Bicep代码如下：

resource ilb 'Microsoft.Network/loadBalancers@2022-05-01' = {
  name: ilbName
...
    backendAddressPools: [
      {
        name: 'direct'
        properties: {
          loadBalancerBackendAddresses: [
            {
              name: 'server65'
              properties: {
                ipAddress: '192.168.42.65'
                virtualNetwork: {
                  id: vnetHubId
                }
              }
            }
            {
              name: 'server66'
              properties: {
                ipAddress: '192.168.42.66'
                virtualNetwork: {
                  id: vnetHubId
                }
              }
            }
          ]
        }
      }
    ]
...
}

部署完成后无报错，但Azure门户和CLI查询显示后端地址池无IP：

az network lb address-pool show --lb-name ilb-123456789012 -g portfwd-rg -n direct

{
  "etag": "W/\"037f2314-c311-4378-9486-a076cacc7491\"",
  "id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/portfwd-rg/providers/Microsoft.Network/loadBalancers/ilb-123456789012/backendAddressPools/direct",
  "loadBalancerBackendAddresses": [],
  "loadBalancingRules": [
    {
      "id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/portfwd-rg/providers/Microsoft.Network/loadBalancers/ilb-123456789012/loadBalancingRules/direct",
      "resourceGroup": "portfwd-rg"
    }
  ],
  "name": "direct",
  "provisioningState": "Succeeded",
  "resourceGroup": "portfwd-rg",
  "type": "Microsoft.Network/loadBalancers/backendAddressPools"
}

使用CLI创建相同配置的后端地址池却能正常生效：

az network lb address-pool create --lb-name ilb-123456789012 -g portfwd-rg -n direct2 \
--backend-address name=server65 ip-address=192.168.42.65 \
--backend-address name=server66 ip-address=192.168.42.66 \
--vnet /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/portfwd-rg/providers/Microsoft.Network/virtualNetworks/vnet-hub-123456789012

查询结果：

az network lb address-pool show --lb-name ilb-123456789012 -g portfwd-rg -n direct2

{
  "etag": "W/\"efeef00f-3dd4-4b7c-bfa3-f58030757dea\"",
  "id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/portfwd-rg/providers/Microsoft.Network/loadBalancers/ilb-123456789012/backendAddressPools/direct2",
  "loadBalancerBackendAddresses": [
    {
      "ipAddress": "192.168.42.65",
      "name": "server65",
      "virtualNetwork": {
        "id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/portfwd-rg/providers/Microsoft.Network/virtualNetworks/vnet-hub-123456789012",
        "resourceGroup": "portfwd-rg"
      }
    },
    {
      "ipAddress": "192.168.42.66",
      "name": "server66",
      "virtualNetwork": {
        "id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/portfwd-rg/providers/Microsoft.Network/virtualNetworks/vnet-hub-123456789012",
        "resourceGroup": "portfwd-rg"
      }
    }
  ],
  "name": "direct2",
  "provisioningState": "Succeeded",
  "resourceGroup": "portfwd-rg",
  "type": "Microsoft.Network/loadBalancers/backendAddressPools"
}

CLI调试的PUT请求内容：

{"name": "direct", "properties": {"loadBalancerBackendAddresses": [{"name": "server65", "properties": {"ipAddress": "192.168.42.65", "virtualNetwork": {"id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/portfwd-rg/providers/Microsoft.Network/virtualNetworks/vnet-hub-123456789012"}}}, {"name": "server66", "properties": {"ipAddress": "192.168.42.66", "virtualNetwork": {"id": "/subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/portfwd-rg/providers/Microsoft.Network/virtualNetworks/vnet-hub-123456789012"}}}]}}

解决方案 #

问题出在Bicep代码中嵌套的properties层级。对比CLI生成的PUT请求可以看到，后端地址的ipAddress和virtualNetwork不需要嵌套在额外的properties对象里。

修正后的Bicep代码：

resource ilb 'Microsoft.Network/loadBalancers@2022-05-01' = {
  name: ilbName
...
    backendAddressPools: [
      {
        name: 'direct'
        properties: {
          loadBalancerBackendAddresses: [
            {
              name: 'server65'
              ipAddress: '192.168.42.65'
              virtualNetwork: {
                id: vnetHubId
              }
            }
            {
              name: 'server66'
              ipAddress: '192.168.42.66'
              virtualNetwork: {
                id: vnetHubId
              }
            }
          ]
        }
      }
    ]
...
}

说明 #

• 原始Bicep代码中，每个后端地址的ipAddress和virtualNetwork被包裹在properties下，这不符合API的要求。
• CLI生成的PUT请求里，后端地址的属性是直接平级的name、ipAddress、virtualNetwork，没有额外的properties嵌套。
• 移除多余的properties层级后，部署的后端地址池就能正常显示IP地址了。

内容的提问来源于stack exchange，提问作者Kai Walter