Terraform中推测计划的循环错误

Question

如果我在代码中放入以下行，我会得到以下错误：

"MICROSOFT_PROVIDER_AUTHENTICATION_SECRET" = format("@Microsoft.KeyVault(VaultName=%s;SecretName=Webapp-FE-Secret)", module.key-vault.key_vault.self.name)

错误：

Error: Cycle: local.network_acls_ip_rules (expand), module.key-vault.var.key_vault_network_acls_ip_rules (expand), module.key-vault.azurerm_key_vault.default, module.key-vault.output.key_vault (expand), azurerm_app_service.fe, azurerm_app_service.api

如果我不把上面的线，我就不会得到这个错误

我的前端应用程序服务的完整代码是：

resource "azurerm_app_service" "fe" {
location            = module.resourcegroup.resource_group.location
resource_group_name = module.resourcegroup.resource_group.name
tags                = local.tags
app_service_plan_id = azurerm_app_service_plan.default.id
name                = module.name_app_service_fe.location.app_service.name_unique
identity { type = "SystemAssigned" }
auth_settings {
enabled                        = true
default_provider               = "AzureActiveDirectory"
issuer                         = format("https://sts.windows.net/%s/", data.azurerm_client_config.default.tenant_id)
runtime_version                = "~1"
token_store_enabled            = true
unauthenticated_client_action  = "RedirectToLoginPage"
allowed_external_redirect_urls = module.application_webapp_fe.application.self.reply_urls
additional_login_params = {
"response_type" = "code id_token",
"resource"      = module.application_webapp_fe.application.self.application_id
}
active_directory {
client_id         = module.application_webapp_fe.application.self.application_id
client_secret     = module.application_webapp_fe.service_principal.secret.value
allowed_audiences = []
}
}
site_config {
always_on                = true
app_command_line         = ""
default_documents        = []
dotnet_framework_version = "v4.0"
ftps_state               = "Disabled"
health_check_path        = ""
http2_enabled            = true
linux_fx_version         = "STATICSITE|1.0"
local_mysql_enabled      = false
managed_pipeline_mode    = "Integrated"
min_tls_version          = "1.2"
#pre_warmed_instance_count = 0
python_version            = "3.4"
remote_debugging_enabled  = false
remote_debugging_version  = "VS2019"
use_32_bit_worker_process = false
websockets_enabled        = false
windows_fx_version        = ""
cors {
allowed_origins     = []
support_credentials = false
}
}
app_settings = {
"WEBSITE_DNS_SERVER"     = "168.63.129.16"
"WEBSITE_VNET_ROUTE_ALL" = "1"
"MICROSOFT_PROVIDER_AUTHENTICATION_SECRET" = format("@Microsoft.KeyVault(VaultName=%s;SecretName=Webapp-FE-Secret)", module.key-vault.key_vault.self.name)
}
lifecycle {
ignore_changes = [
"site_config",
"auth_settings"
]
}
}

密钥库已经有了秘密名称：

Webapp-FE-Secret

这个秘密的价值是我的前端应用程序注册的服务负责人

以下是我的钥匙库模块的代码：

module "key-vault" {
version   = "~> 1.0"
source    = " xxxxx  "
providers = { azurerm = azurerm, random = random }
tenant_id             = data.azurerm_client_config.default.tenant_id
resource_group_name   = module.resourcegroup.resource_group.name
key_vault_location    = module.resourcegroup.resource_group.location
key_vault_environment = var.project.environment.name
key_vault_tags        = module.resourcegroup.resource_group.tags
key_vault_name = substr(replace(var.project.name, "-", ""), 0, 16)
key_vault_network_acls_ip_rules                   = concat(local.network_acls_ip_rules, module.project.azure.cidrs.global.contoso_enterprise_egress.all.coreinf)
key_vault_network_acls_virtual_network_subnet_ids = [local.tfe_vnet_id]
key_vault_secrets = {
CosmosDB-PrimaryKey                          = azurerm_cosmosdb_account.default.primary_key
CosmosDB-PrimaryReadOnlykey                  = azurerm_cosmosdb_account.default.primary_readonly_key
CosmosDB-PrimaryKey-ConnectionString         = azurerm_cosmosdb_account.default.connection_strings[0]
CosmosDB-PrimaryReadOnlykey-ConnectionString = azurerm_cosmosdb_account.default.connection_strings[1]
StorageAccount-PrimaryKey                    = module.storageaccount.storage_account.self.primary_access_key
StorageAccount-SecondaryKey                  = module.storageaccount.storage_account.self.secondary_access_key
StorageAccount-ConnectionString-PrimaryKey   = module.storageaccount.storage_account.self.primary_connection_string
StorageAccount-ConnectionString-SecondaryKey = module.storageaccount.storage_account.self.secondary_connection_string
StorageAccount-FunctionApp-PrimaryKey                    = module.storageaccount-func-app.storage_account.self.primary_access_key
StorageAccount-FunctionApp-SecondaryKey                  = module.storageaccount-func-app.storage_account.self.secondary_access_key
StorageAccount-FunctionApp-ConnectionString-PrimaryKey   = module.storageaccount-func-app.storage_account.self.primary_connection_string
StorageAccount-FunctionApp-ConnectionString-SecondaryKey = module.storageaccount-func-app.storage_account.self.secondary_connection_string
Webapp-FE-Secret    = module.application_webapp_fe.service_principal.secret.value
Webapp-API-Secret   = module.application_webapp_api.service_principal.secret.value
Function-App-Secret = module.application_func_01.service_principal.secret.value
frontendappid  = module.application_webapp_fe.application.self.application_id
frontendappurl = module.application_webapp_fe.application.self.homepage
frontendhost   = format("https://%s", azurerm_app_service.fe.default_site_hostname)
appi-default-instrumentation-key = azurerm_application_insights.default["api"].instrumentation_key
appi-default-app-id              = azurerm_application_insights.default["api"].app_id
appi-default-fe-instrumentation-key = azurerm_application_insights.default["fe"].instrumentation_key
appi-default-fe-app-id              = azurerm_application_insights.default["fe"].app_id
functionappid  = module.application_func_01.application.self.application_id
functionappurl = module.application_func_01.application.self.homepage
functionhost   = format("https://%s", azurerm_function_app.default.default_hostname)
webapiappid  = module.application_webapp_api.application.self.application_id
webapiappuri = module.application_webapp_api.application.self.homepage
webapihost   = format("https://%s", azurerm_app_service.api.default_site_hostname)
}
}

本地块：

locals {
network_acls_ip_rules = distinct(
concat(
formatlist("%s/32", split(",", azurerm_app_service.api.possible_outbound_ip_addresses)),
formatlist("%s/32", split(",", azurerm_app_service.api.outbound_ip_addresses)),
formatlist("%s/32", split(",", azurerm_app_service.fe.possible_outbound_ip_addresses)),
formatlist("%s/32", split(",", azurerm_app_service.fe.outbound_ip_addresses)),
formatlist("%s/32", split(",", azurerm_function_app.default.possible_outbound_ip_addresses)),
formatlist("%s/32", split(",", azurerm_function_app.default.outbound_ip_addresses))
)
)
}

有人能帮我修一下吗。值："MICROSOFT_PROVIDER_AUTHENTICATION_SECRET已经手动放入前端应用程序中，目前在TF状态下丢失。所以我想把它包含在我的代码中，这样Terraform就不会在每次我对代码进行迭代时都被删除

Answer 1

通过包含此行：

"MICROSOFT_PROVIDER_AUTHENTICATION_SECRET" = format("@Microsoft.KeyVault(VaultName=%s;SecretName=Webapp-FE-Secret)", module.key-vault.key_vault.self.name)

您创建了一个循环引用，因为前端应用程序和Keyvault相互依赖(例如，一个不能先于另一个构建(

发生循环引用是因为local.network_acl_ip_rules中也有这些行

formatlist("%s/32", split(",", azurerm_app_service.fe.possible_outbound_ip_addresses)),
formatlist("%s/32", split(",", azurerm_app_service.fe.outbound_ip_addresses)),

因此，需要创建前端应用程序服务，以填充创建Keyvault所需的IP值。但是前端无法创建，因为它需要在应用程序设置中使用Keyvault名称。

快速解决方案是将Keyvault名称硬编码到应用程序设置中。

长期"；"修复"；将使用az-cli或powershell脚本在terraform外部更新appsettings或network_acls，并从terraform调用脚本。。。