Terraform部署AKS至VNET遇user_assigned_identity_id参数不支持错误

错误信息 #

│ Error: Unsupported argument
│
│   on main.tf line 130, in resource "azurerm_kubernetes_cluster" "aks":
│  130:     user_assigned_identity_id = azurerm_user_assigned_identity.identity.id
│
│ An argument named "user_assigned_identity_id" is not expected here.

现有Terraform代码 #

data "azurerm_resource_group" "aks-rg" {
  name     = var.resource_group_name
}

resource "azurerm_role_assignment" "role_acrpull" {
  scope                            = azurerm_container_registry.acr.id
  role_definition_name             = "AcrPull"
  principal_id                     = azurerm_kubernetes_cluster.aks.kubelet_identity.0.object_id
  #skip_service_principal_aad_check = true
}

resource "azurerm_container_registry" "acr" {
  name                = var.acr_name
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  location            = var.location
  sku                 = "Standard"
  admin_enabled       = false
}

resource "azurerm_network_security_group" "pusg" {
  name                = "Public_Security_Group"
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
}

resource "azurerm_virtual_network" "puvnet" {
  name                = "Public_VNET"
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  address_space       = ["10.19.0.0/16"]
  dns_servers         = ["10.19.0.4", "10.19.0.5"]
}

resource "azurerm_subnet" "osubnet" {
  name                 = "Outer_Subnet"
  resource_group_name  = data.azurerm_resource_group.aks-rg.name
  address_prefixes     = ["10.19.1.0/24"]
  virtual_network_name = azurerm_virtual_network.puvnet.name
}

resource "azurerm_subnet" "isubnet" {
  name                 = "Inner_Subnet"
  resource_group_name  = data.azurerm_resource_group.aks-rg.name
  address_prefixes     = ["10.19.2.0/24"]
  virtual_network_name = azurerm_virtual_network.puvnet.name
}

resource "azurerm_subnet" "firewall_subnet" {
  name                 = "AzureFirewallSubnet"
  resource_group_name  = data.azurerm_resource_group.aks-rg.name
  virtual_network_name = azurerm_virtual_network.puvnet.name
  address_prefixes     = ["10.19.3.0/24"]
}

resource "azurerm_user_assigned_identity" "identity" {
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  location            = var.location
  name                = "identityh"
}

resource "azurerm_role_assignment" "networkRole" {
  scope                = data.azurerm_resource_group.aks-rg.id
  role_definition_name = "Network Contributor"
  principal_id         = azurerm_user_assigned_identity.identity.principal_id
}

resource "azurerm_route_table" "routeTable" {
  name                = "rt-FWall"
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
}

resource "azurerm_route" "route1" {
  name                   = "dg-route1"
  resource_group_name    = data.azurerm_resource_group.aks-rg.name
  route_table_name       = azurerm_route_table.routeTable.name
  address_prefix         = "0.0.0.0/0"
  next_hop_type          = "VirtualAppliance"
  next_hop_in_ip_address = azurerm_firewall.firewall.ip_configuration.0.private_ip_address
}

resource "azurerm_subnet_route_table_association" "base" {
  subnet_id      = azurerm_subnet.osubnet.id
  route_table_id = azurerm_route_table.routeTable.id
}

resource "azurerm_public_ip" "firewall_public_ip" {
  name                = "pip-firewall"
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  allocation_method   = "Static"
  sku                 = "Standard"
}

resource "azurerm_firewall" "firewall" {
  name                = "public_firewall"
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  sku_name            = "AZFW_VNet"
  sku_tier            = "Standard"

  ip_configuration {
    name                 = "ipconfig"
    subnet_id            = azurerm_subnet.firewall_subnet.id
    public_ip_address_id = azurerm_public_ip.firewall_public_ip.id
  }
}

resource "azurerm_kubernetes_cluster" "aks" {
  name                = var.cluster_name
  kubernetes_version  = var.kubernetes_version
  location            = var.location
  resource_group_name = data.azurerm_resource_group.aks-rg.name
  dns_prefix          = var.cluster_name

  network_profile {
    network_plugin = "azure"
    outbound_type  = "userDefinedRouting"
  }

  default_node_pool {
    name                = "system"
    node_count          = var.system_node_count
    vm_size             = "Standard_DS2_v2"
    vnet_subnet_id = azurerm_subnet.osubnet.id
  }

  identity {
    type                      = "UserAssigned"
    user_assigned_identity_id = azurerm_user_assigned_identity.identity.id
  }
}

部署环境 #

• 区域：Germany West Central
• Kubernetes版本：1.24.3
• Azurerm Provider版本：3.33
• Terraform版本：1.3

解决方案 #

1. 修复身份参数错误 #

Terraform Azurerm Provider 3.x版本中，azurerm_kubernetes_cluster的identity块参数已变更，原user_assigned_identity_id（单数）不再支持，需替换为user_assigned_identities（复数），格式为键值对，键为用户分配身份的ID，值为空对象。

修改后的identity块代码：

identity {
  type = "UserAssigned"
  user_assigned_identities = {
    azurerm_user_assigned_identity.identity.id = {}
  }
}

2. 解决集群创建超时问题 #

你的AKS使用了userDefinedRouting出站类型，节点依赖防火墙的路由规则访问外部资源完成初始化，但防火墙创建速度慢于AKS，会导致节点无法正常出站从而超时。需添加依赖关系，确保AKS在防火墙创建完成后再部署：

在azurerm_kubernetes_cluster.aks资源中添加depends_on：

resource "azurerm_kubernetes_cluster" "aks" {
  # 原有代码...

  depends_on = [azurerm_firewall.firewall]
}

3. 验证kubelet身份权限 #

azurerm_role_assignment.role_acrpull中引用的kubelet_identity在用户分配身份场景下，需确保该身份拥有AcrPull权限。如果集群使用用户分配身份作为kubelet身份，需在default_node_pool中明确指定：

default_node_pool {
  # 原有代码...
  kubelet_identity {
    client_id = azurerm_user_assigned_identity.identity.client_id
    object_id = azurerm_user_assigned_identity.identity.principal_id
  }
}

此时role_acrpull的principal_id可直接引用azurerm_user_assigned_identity.identity.principal_id，避免依赖集群资源的延迟加载。

内容的提问来源于stack exchange，提问作者user19727086