Terraform：使用 local_account_disabled=true 創建 azure kube.netes 服務時出錯

Question

嘗試用Terraform創建AKS時出現錯誤。創建了AKS，但最后還是報錯，很難看。

        │ Error: retrieving Access Profile for Cluster: (Managed Cluster Name 
"aks-1" / Resource Group "pengine-aks-rg"): 
    containerservice.ManagedClustersClient#GetAccessProfile: Failure responding to request:
     StatusCode=400 -- Original Error: autorest/azure: Service returned an error. Status=400 
    Code="BadRequest" Message="Getting static credential is not allowed because this cluster 
    is set to disable local accounts."

這是我的 terraform 代碼：

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=2.96.0"
    }
  }
}

resource "azurerm_resource_group" "aks-rg" {
  name     = "aks-rg"
  location = "West Europe"
}

resource "azurerm_kubernetes_cluster" "aks-1" {
  name                = "aks-1"
  location            = azurerm_resource_group.aks-rg.location
  resource_group_name = azurerm_resource_group.aks-rg.name
  dns_prefix          = "aks1"
  local_account_disabled = "true"

  default_node_pool {
    name       = "nodepool1"
    node_count = 3
    vm_size    = "Standard_D2_v2"
  }

  identity {
    type = "SystemAssigned"
  }

  tags = {
    Environment = "Test"
  }
}

這是 Terraform 錯誤嗎？ 我可以避免錯誤嗎？

Answer 1

如果禁用本地帳戶，則需要激活 AKS 管理的 Azure Active Directory 集成，因為您沒有更多本地帳戶可以針對 AKS 進行身份驗證。

此示例啟用 RBAC、Azure AAD 和 Azure RBAC：

resource "azurerm_kubernetes_cluster" "aks-1" {
  ... 

  role_based_access_control {
    enabled = true

    azure_active_directory {
      managed                = true
      tenant_id              = data.azurerm_client_config.current.tenant_id
      admin_group_object_ids =  ["OBJECT_IDS_OF_ADMIN_GROUPS"]
      azure_rbac_enabled     = true
    }
  }
}

如果您不想要 AAD 集成，則需要設置local_account_disabled = "false" 。