如何用Terraform配置Azure Frontdoor Standard通配符多源

需求说明 #

我需要为部署在AKS集群（通过请求Host头路由至对应Pod）的SaaS应用，配置Azure Frontdoor Standard通配符域名资源。已完成通配符证书与多源组配置，但不清楚如何在Terraform或ARM模板中设置源组Host头。

常规单域名场景下，用户访问www.address1.com时，请求会携带该Host头发送至AKS集群的cluster1-eastus.address1.com源，从而路由到对应Pod。但在通配符场景下，希望用户访问www1.address1.com或www2.address1.com时，能将用户输入的Host头直接传递给AKS集群以实现正确路由，且无法在源中设置*.address1.com。

核心配置逻辑 #

通过在Frontdoor路由规则中设置host_header为request_host（Terraform）或RequestHost（ARM/CLI/PowerShell），即可将用户请求的原始Host头原样转发给AKS源，无需在源地址中配置通配符。

Terraform配置示例 #

resource "azurerm_frontdoor" "example" {
  name                                         = "example-frontdoor"
  resource_group_name                          = azurerm_resource_group.example.name
  enforce_backend_pools_certificate_name_check = false

  backend_pool {
    name = "aks-backend-pool"

    backend {
      address           = "cluster1-eastus.address1.com" # 固定源地址，不能用通配符
      http_port         = 80
      https_port        = 443
      weight            = 50
      priority          = 1
      enabled           = true
    }
  }

  frontend_endpoint {
    name      = "wildcard-endpoint"
    host_name = "*.address1.com"
    session_affinity_enabled = false

    custom_https_configuration {
      certificate_source                      = "AzureKeyVault"
      key_vault_certificate_secret_name       = azurerm_key_vault_certificate.example.name
      key_vault_certificate_secret_version    = azurerm_key_vault_certificate.example.version
      key_vault_id                            = azurerm_key_vault.example.id
      minimum_tls_version                     = "1.2"
      protocol_type                           = "ServerNameIndication"
    }
  }

  routing_rule {
    name               = "wildcard-routing-rule"
    accepted_protocols = ["Http", "Https"]
    patterns_to_match  = ["/*"]
    frontend_endpoints = [azurerm_frontdoor.example.frontend_endpoint[0].name]

    forwarding_configuration {
      forwarding_protocol = "HttpsOnly"
      backend_pool_name   = azurerm_frontdoor.example.backend_pool[0].name
      host_header         = "request_host" # 核心配置：转发原始请求Host头
    }
  }
}

ARM模板示例 #

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Network/frontDoors",
      "apiVersion": "2021-06-01",
      "name": "example-frontdoor",
      "location": "global",
      "properties": {
        "enabledState": "Enabled",
        "enforceBackendPoolsCertificateNameCheck": false,
        "frontendEndpoints": [
          {
            "name": "wildcard-endpoint",
            "properties": {
              "hostName": "*.address1.com",
              "sessionAffinityEnabled": false,
              "customHttpsConfiguration": {
                "certificateSource": "AzureKeyVault",
                "keyVaultCertificateSourceParameters": {
                  "secretName": "<your-keyvault-cert-secret-name>",
                  "secretVersion": "<your-cert-version>",
                  "vault": {
                    "id": "<your-keyvault-resource-id>"
                  }
                },
                "minimumTlsVersion": "1.2",
                "protocolType": "ServerNameIndication"
              }
            }
          }
        ],
        "backendPools": [
          {
            "name": "aks-backend-pool",
            "properties": {
              "backends": [
                {
                  "address": "cluster1-eastus.address1.com",
                  "httpPort": 80,
                  "httpsPort": 443,
                  "weight": 50,
                  "priority": 1,
                  "enabled": true
                }
              ]
            }
          }
        ],
        "routingRules": [
          {
            "name": "wildcard-routing-rule",
            "properties": {
              "acceptedProtocols": ["Http", "Https"],
              "patternsToMatch": ["/*"],
              "frontendEndpoints": [
                {
                  "id": "[resourceId('Microsoft.Network/frontDoors/frontendEndpoints', 'example-frontdoor', 'wildcard-endpoint')]"
                }
              ],
              "forwardingConfiguration": {
                "forwardingProtocol": "HttpsOnly",
                "backendPool": {
                  "id": "[resourceId('Microsoft.Network/frontDoors/backendPools', 'example-frontdoor', 'aks-backend-pool')]"
                },
                "hostHeader": "RequestHost" // 核心配置：转发原始请求Host头
              }
            }
          }
        ]
      }
    }
  ]
}

PowerShell配置示例 #

# 定义变量
$resourceGroupName = "your-resource-group"
$frontdoorName = "example-frontdoor"
$routingRuleName = "wildcard-routing-rule"

# 获取Frontdoor资源
$frontdoor = Get-AzFrontDoor -ResourceGroupName $resourceGroupName -Name $frontdoorName

# 修改路由规则的HostHeader配置
$routingRule = $frontdoor.RoutingRules | Where-Object { $_.Name -eq $routingRuleName }
$routingRule.ForwardingConfiguration.HostHeader = "RequestHost"

# 更新Frontdoor
Set-AzFrontDoor -InputObject $frontdoor

AZ CLI配置示例 #

az network front-door routing-rule update \
  --resource-group your-resource-group \
  --front-door-name example-frontdoor \
  --name wildcard-routing-rule \
  --host-header RequestHost

内容的提问来源于stack exchange，提问作者ossentoo