Terraform部署Panorama VM至GCP时子网属性引用错误排查

错误信息 #

Error: Incorrect attribute value type

  on ../../../../modules/panorama/main.tf line 67, in resource "google_compute_instance" "panorama":
  67:     subnetwork = var.subnet
    |----------------
    | var.subnet is object with no attributes

场景与代码 #

现有VPC数据源及子网模块配置 #

data "google_compute_network" "panorama" {
  project = var.project_id
  name    = "fed-il4-p-net-panorama"
}

module "panorama_subnet" {
  source = "../../../../modules/subnetwork-module"
  subnet_name = "panorama-${var.region_short_name[var.region]}"
  subnet_ip = var.panorama_subnet
  subnet_region = var.region
  project_id = var.project_id
  network = data.google_compute_network.panorama.self_link
}

Panorama VM模块调用代码 #

module "panorama" {
  source = "../../../../modules/panorama"

  name = "${var.project_id}-panorama-${var.region_short_name[var.region]}"
  project = var.project_id
  region = var.region
  zone = data.google_compute_zones.zones.names[0]
  # panorama_version  = var.panorama_version
  ssh_keys = (file(var.ssh_keys))
  network = data.google_compute_network.panorama.self_link
  subnet = module.panorama                <====== 此处无法使用module.panorama.id或.name
  private_static_ip = var.private_static_ip
  custom_image = var.custom_image_pano
  #attach_public_ip  = var.attach_public_ip
}

Panorama VM实例模块核心代码 #

resource "google_compute_instance" "panorama" {
  name                      = var.name
  zone                      = var.zone
  machine_type              = var.machine_type
  min_cpu_platform          = var.min_cpu_platform
  labels                    = var.labels
  tags                      = var.tags
  project                   = var.project
  can_ip_forward            = false
  allow_stopping_for_update = true

  metadata = merge({
    serial-port-enable = true
    ssh-keys           = var.ssh_keys
  }, var.metadata)

  network_interface {
/*
    dynamic "access_config" {
      for_each = var.attach_public_ip ? [""] : []
      content {
        nat_ip = google_compute_address.public[0].address
      }
    }
*/
    network_ip = google_compute_address.private.address
    network = var.network
    subnetwork = var.subnet
  }

问题分析与修复步骤 #

核心问题 #

1. 引用对象错误：调用Panorama模块时，subnet参数错误引用了module.panorama（自身模块），而实际子网是在module.panorama_subnet中创建的。
2. 变量类型不匹配：Panorama模块的var.subnet变量类型可能被定义为object，但GCP实例的subnetwork字段需要的是字符串类型的子网self_link或名称。
3. 子网模块输出缺失：如果子网模块没有输出必要的属性（如self_link），则无法传递正确的值给Panorama模块。

修复步骤 #

1. 修正子网引用对象

将Panorama模块调用中的subnet参数改为引用子网模块：

subnet = module.panorama_subnet.self_link

2. 确保子网模块输出正确属性

在子网模块的outputs.tf中添加输出配置：

output "self_link" {
  type        = string
  description = "Self-link of the created subnetwork"
  value       = google_compute_subnetwork.this.self_link # 注意：替换为子网模块内实际的资源名称
}

3. 修正Panorama模块的变量类型

在Panorama模块的variables.tf中，将subnet变量定义为字符串类型：

variable "subnet" {
  type        = string
  description = "Self-link or name of the subnetwork to attach the Panorama instance to"
}

验证 #

完成上述修改后，重新执行terraform plan，确认错误消失，资源配置符合预期。

内容的提问来源于stack exchange，提问作者d290