Terraform 如何获取 Azure Kubernetes AKS 的 vnet ID 用于网络对等连接

你可以选择以下两种思路解决，第一种是生产环境更推荐的最佳实践：

方案一：提前自定义VNET部署AKS（推荐） #

不要让AKS自动生成VNET，你可以提前在Terraform中定义AKS节点使用的VNET和子网，部署AKS时直接指定关联的子网，这样你可以直接拿到VNET的所有属性用于对等连接配置。
修改你的AKS配置示例如下：

# 提前定义AKS用的VNET和子网，可根据你的网段需求调整
resource "azurerm_virtual_network" "aks_vnet" {
  name                = "aks-vnet"
  address_space       = ["10.2.0.0/16"]
  location            = "australiaeast"
  resource_group_name = "my-aksnode-rg"
}

resource "azurerm_subnet" "aks_node_subnet" {
  name                 = "aks-node-subnet"
  resource_group_name  = "my-aksnode-rg"
  virtual_network_name = azurerm_virtual_network.aks_vnet.name
  address_prefixes     = ["10.2.0.0/24"]
}

resource "azurerm_kubernetes_cluster" "my_cluster" {
  name                = "my-aks"
  location            = "australiaeast"
  resource_group_name = "my-aks-rg"
  node_resource_group = "my-aksnode-rg"

  addon_profile {
    ingress_application_gateway {
      enabled    = true
      gateway_id = azurerm_application_gateway.my_appgw.id
    }
  }

  default_node_pool {
    name                 = "np01"
    node_count           = 1
    os_disk_size_gb      = 30
    vm_size              = var.aks_np_vm_sku
    # 新增：指定节点部署的子网
    vnet_subnet_id       = azurerm_subnet.aks_node_subnet.id
  }
  ...
}

之后对等连接的配置就可以直接引用VNET属性：

# AppGw to AKS
resource "azurerm_virtual_network_peering" "appgw_aks_peering" {
  name                      = "appgw-aks-peer"
  resource_group_name       = "my-appgw-rg"
  virtual_network_name      = azurerm_virtual_network.my_vnet.name
  remote_virtual_network_id = azurerm_virtual_network.aks_vnet.id
  allow_virtual_network_access = true
}

# AKS to AppGw
resource "azurerm_virtual_network_peering" "aks_appgw_peering" {
  name                      = "aks-appgw-peer"
  resource_group_name       = "my-aksnode-rg"
  virtual_network_name      = azurerm_virtual_network.aks_vnet.name
  remote_virtual_network_id = azurerm_virtual_network.my_vnet.id
  allow_virtual_network_access = true
}

方案二：通过数据源查询AKS自动生成的VNET #

如果你不想修改现有AKS的部署逻辑，坚持使用自动生成的VNET，可以通过azurerm_virtual_network数据源，在AKS创建完成后查询节点资源组下的VNET信息：

# 查AKS自动生成的VNET
data "azurerm_virtual_network" "aks_auto_vnet" {
  resource_group_name = azurerm_kubernetes_cluster.my_cluster.node_resource_group
  # AKS自动生成的VNET默认名称前缀为aks-vnet-，如果你的环境有特殊规则可以调整匹配规则
  name = "aks-vnet-*"
  depends_on = [azurerm_kubernetes_cluster.my_cluster]
}

之后对等连接的配置直接引用数据源返回的属性即可：

# AppGw to AKS
resource "azurerm_virtual_network_peering" "appgw_aks_peering" {
  name                      = "appgw-aks-peer"
  resource_group_name       = "my-appgw-rg"
  virtual_network_name      = azurerm_virtual_network.my_vnet.name
  remote_virtual_network_id = data.azurerm_virtual_network.aks_auto_vnet.id
  allow_virtual_network_access = true
}

# AKS to AppGw
resource "azurerm_virtual_network_peering" "aks_appgw_peering" {
  name                      = "aks-appgw-peer"
  resource_group_name       = "my-aksnode-rg"
  virtual_network_name      = data.azurerm_virtual_network.aks_auto_vnet.name
  remote_virtual_network_id = azurerm_virtual_network.my_vnet.id
  allow_virtual_network_access = true
}

注意：该方案依赖AKS自动生成VNET的命名规则，如果后续Azure调整命名规则可能导致查询失败，生产环境优先选择方案一。

内容的提问来源于stack exchange，提问作者wertyq