Terraform嵌套循环：在所有资源组中创建虚拟网络

需求 #

要在所有已定义的resource_groups中，创建每一个已定义的virtual_networks，即每个资源组都要包含所有虚拟网络实例。

变量定义 #

inputs = {
  virtual_networks = {
    "test-net1": {
      address_space = ["10.0.0.0/24"]
    }

    "test-net2": {
      address_space = ["10.0.1.0/24"]
    }
  }
  resource_groups = {
    "group1": {
      location  = "West Europe"
    }
    "group2": {
      location  = "East Europe"
    }
  }
}

当前实现的局限 #

现有resource块仅能遍历资源组，且只能创建第一个虚拟网络，代码如下：

resource "azurerm_virtual_network" "virtual_network" {
  for_each = var.resource_groups

  name                = <FIRST KEY OF var.virtual_networks>
  resource_group_name = each.key
  location            = each.value["location"]
  address_space       = <ADDRESS_SPACE VALUE OF FIRST NETWORK FROM var.virtual_networks>
}

尝试过的方法及问题 #

曾尝试通过local变量合并资源组和虚拟网络，但生成的结构无法直接用于resource块的遍历：

locals = {
  resource_groups = {
    for key, resource_groups in var.resource_groups : "${key}" => 
    merge(
      var.virtual_networks,
      resource_groups
    )
  }
}

该local变量输出结果：

group1 = {
  location             = "West Europe"
  test-net1            = {
    address_space = [
      "10.0.0.0/24",
    ]
  }
  test-net2 = {
    address_space = [
      "10.0.1.0/24",
    ]
  }
}
group2  = {
  location             = "East Europe"
  test-net1            = {
    address_space = [
      "10.0.0.0/24",
    ]
  }
  test-net2 = {
    address_space = [
      "10.0.1.0/24",
    ]
  }
}

这个结构按资源组分组，无法直接遍历每个「资源组-虚拟网络」的组合。

正确解决方案 #

需要构建一个包含资源组与虚拟网络笛卡尔积的local变量，每个元素对应一个要创建的虚拟网络实例：

locals {
  vnet_per_rg = flatten([
    for rg_name, rg_data in var.resource_groups : [
      for vnet_name, vnet_data in var.virtual_networks : {
        key             = "${rg_name}-${vnet_name}"
        rg_name         = rg_name
        rg_location     = rg_data.location
        vnet_name       = vnet_name
        vnet_addresses  = vnet_data.address_space
      }
    ]
  ])
  # 转换为映射，方便for_each使用
  vnet_per_rg_map = {
    for item in local.vnet_per_rg : item.key => item
  }
}

然后在resource块中遍历这个映射：

resource "azurerm_virtual_network" "virtual_network" {
  for_each = local.vnet_per_rg_map

  name                = each.value.vnet_name
  resource_group_name = each.value.rg_name
  location            = each.value.rg_location
  address_space       = each.value.vnet_addresses
}

这样就能在每个资源组中创建所有定义的虚拟网络，最终会生成4个虚拟网络实例：group1-test-net1、group1-test-net2、group2-test-net1、group2-test-net2。

内容的提问来源于stack exchange，提问作者Portal Mario