Bicep配置AKS引用模块子网报错：vnetRG参数未找到，求排查

我需要将Azure Kubernetes Service（AKS）集群部署至现有虚拟网络，因使用CNI网络需预定义子网，且该子网位于不同资源组。我采用模块创建子网再加载为现有资源的方案，编写了如下Bicep代码：

@description('Resource group with the vNet')
param vnetRG string

@description('The vNet that will have the subnet')
param vNet string

param location string = resourceGroup().location

param otherParameter string

param sshPubKey string

module subnet 'subnet.bicep' = {
  name: '${deployment().name}-subnet'
  scope: resourceGroup( vnetRG )
  params: {
    virtualNetworkName: vNet
  }
}

resource subnetFromModule "Microsoft.Network/virtualNetworks/subnets@2022-07-01" existing = {
  name: subnet.outputs.subnetName
  scope: resourceGroup( vnetRG )
}

// The Azure Kubernetes Service cluster.
resource aks "Microsoft.ContainerService/managedClusters@2022-05-02-preview" = {
  name: otherParameter
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    dnsPrefix: 'dummy'
    publicNetworkAccess: 'Enabled'
    networkProfile: {
      networkPlugin: 'azure'
    }
    agentPoolProfiles: [
      {
        name: 'lnxnod'
        osDiskSizeGB: 60
        count: 3
        vmSize: 'Standard_D2s_v3'
        osType: 'Linux'
        mode: 'System'
        vnetSubnetID: subnetFromModule.id
      }
    ]
    linuxProfile: {
      adminUsername: otherParameter
      ssh: {
        publicKeys: [
          {
            keyData: sshPubKey
          }
        ]
      }
    }
  }
}

output subnetId string = subnetFromModule.id

部署时触发错误：

InvalidTemplateDeploymentError - Provisioning of resource(s) for container service lsdkf in resource group testclusterthing failed. Message: Provisioning of resource(s) for container service lsdkf in resource group GLRclusterRG failed. Message: Deployment template validation failed: 'The template parameter 'vnetRG' is not found. Please see https://aka.ms/arm-syntax-parameters for usage details.'.. Details: . Details:

• 问题根源：AKS部署时会自动生成嵌套模板处理资源配置，但这个嵌套模板没有继承主模板的vnetRG参数。当AKS尝试引用跨资源组的子网ID时，嵌套模板无法获取子网所在的资源组信息，导致参数找不到的验证错误。
• 解决步骤：
  1. 直接使用子网模块输出的完整子网ID，无需通过existing资源重新引用。将AKS资源中agentPoolProfiles里的vnetSubnetID字段值从subnetFromModule.id替换为subnet.outputs.subnetId。
  2. 删除多余的subnetFromModule现有资源定义，简化代码结构。
  3. 修改后的关键代码片段：

     agentPoolProfiles: [
       {
         name: 'lnxnod'
         osDiskSizeGB: 60
         count: 3
         vmSize: 'Standard_D2s_v3'
         osType: 'Linux'
         mode: 'System'
         vnetSubnetID: subnet.outputs.subnetId
       }
     ]
     

• 原理说明：子网模块输出的subnetId本身已经包含了资源组、虚拟网络和子网的完整路径信息，AKS可以直接识别并使用该ID，不需要额外传递vnetRG参数，从而避免嵌套模板的参数缺失问题。

内容的提问来源于stack exchange，提问作者Mitten.O