通过VNet集成连接AKS与Web App的问题排查

问题核心 #

要实现Web App通过VNet集成而非公网LB连接AKS LoadBalancer，遇到子网委托冲突：

• Web App的VNet集成要求子网必须委托给Microsoft.Web/serverFarms
• AKS无法使用已委托给其他服务的子网，即使单独创建Microsoft.ContainerService/managedClusters委托的子网，仍报错aks-subnet cannot be used as it's a delegated subnet

解决方案 #

必须创建两个完全独立的子网，分别满足Web App和AKS的委托要求，同时配置网络规则允许子网间流量互通：

1. 子网规划 #

• Web App专用子网：委托给Microsoft.Web/serverFarms，仅用于Web App的VNet集成
• AKS专用子网：委托给Microsoft.ContainerService/managedClusters，用于AKS节点及内部LoadBalancer服务

2. Bicep部署示例 #

虚拟网络与子网配置

resource vnet 'Microsoft.Network/virtualNetworks@2023-05-01' = {
  name: 'my-vnet'
  location: resourceGroup().location
  properties: {
    addressSpace: {
      addressPrefixes: [
        '10.0.0.0/16'
      ]
    }
    subnets: [
      // Web App VNet集成子网
      {
        name: 'webapp-integration-subnet'
        properties: {
          addressPrefix: '10.0.1.0/24'
          delegations: [
            {
              name: 'webapp-delegation'
              properties: {
                serviceName: 'Microsoft.Web/serverFarms'
              }
            }
          ]
        }
      }
      // AKS集群子网
      {
        name: 'aks-cluster-subnet'
        properties: {
          addressPrefix: '10.0.2.0/24'
          delegations: [
            {
              name: 'aks-delegation'
              properties: {
                serviceName: 'Microsoft.ContainerService/managedClusters'
              }
            }
          ]
        }
      }
    ]
  }
}

AKS集群配置（指定专用子网）

resource aksCluster 'Microsoft.ContainerService/managedClusters@2023-07-01' = {
  name: 'my-aks-cluster'
  location: resourceGroup().location
  properties: {
    agentPoolProfiles: [
      {
        name: 'system-pool'
        count: 3
        vmSize: 'Standard_D2s_v3'
        vnetSubnetID: vnet.subnets[1].id // 绑定AKS专用子网
        osType: 'Linux'
        mode: 'System'
      }
    ]
    // 补充AKS必要配置：servicePrincipalProfile、dnsPrefix等
  }
}

Web App与VNet集成配置

// 需使用支持VNet集成的Premium SKU
resource appServicePlan 'Microsoft.Web/serverFarms@2023-06-01' = {
  name: 'my-premium-appplan'
  location: resourceGroup().location
  sku: {
    name: 'P1v3'
    tier: 'PremiumV3'
    size: 'P1v3'
    family: 'Pv3'
    capacity: 1
  }
}

resource webApp 'Microsoft.Web/sites@2023-06-01' = {
  name: 'my-webapp'
  location: resourceGroup().location
  properties: {
    serverFarmId: appServicePlan.id
    virtualNetworkSubnetId: vnet.subnets[0].id // 绑定Web App专用子网
    siteConfig: {
      // 补充Web App运行时配置
    }
  }
}

3. 关键注意事项 #

• Web App必须使用Premium或Isolated SKU，基础/标准SKU不支持VNet集成功能
• 配置子网NSG规则，允许Web App子网访问AKS内部LoadBalancer的服务端口（如80/443）
• AKS的内部LoadBalancer服务需添加注解：service.beta.kubernetes.io/azure-load-balancer-internal: "true"，确保其IP落在AKS专用子网范围内

内容的提问来源于stack exchange，提问作者kasravi