我有一个给我带来麻烦的ARM模板。我将其部署到订阅级别的一个资源组，然后将服务总线部署到该新创建的资源组。服务总线本身具有4个授权规则，一个队列，4个主题，其中两个具有自己的授权规则。这一切都很好。我尝试将后两个AuthorizationRules的PrimaryConnectionString作为秘密添加到其他资源组中的KeyVault，这就是我开始遇到问题的地方。以下是完整的ARM模板。我目前仅尝试从SharedCtxListenerServiceAccessKey主题的shared-context authorizationRule获取PrimaryConnectionString。
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"tags": {
"type": "object",
"metadata": {
"description": "Specifies the tags for the Service Bus related Azure Resources."
}
},
"environment": {
"type": "object",
"metadata": {
"description": "Specifies the Team Environment information."
}
},
"serviceBus": {
"type": "object",
"metadata": {
"description": "Specifies the Service Bus information."
}
}
},
"variables": {
"serviceBus": {
"namespace": {
"name": "[concat('team-', toLower(parameters('environment').name),'-sbn')]"
},
"ResourceGroupName": "[concat('Team-ServiceBus-',parameters('environment').suffix)]"
},
"keyVault": {
"Name": "[concat('Team-Utilities-',parameters('environment').suffix, '-kv')]",
"ResourceGroupName": "[concat('Team-Utilities-',parameters('environment').suffix)]"
}
},
"resources": [
{
"type": "Microsoft.Resources/resourceGroups",
"apiVersion": "2019-10-01",
"name": "[variables('serviceBus').ResourceGroupName]",
"location": "[parameters('environment').location]",
"properties": {
},
"tags": {
"Department": "[parameters('tags').Department]",
"Product": "[parameters('tags').Product]",
"Service": "[parameters('tags').Service]",
"Environment": "[parameters('tags').environment]"
}
},
{
"type": "Microsoft.Resources/deployments",
"name": "ServiceBus_Infrastructure",
"apiVersion": "2017-05-10",
"resourceGroup": "[variables('serviceBus').ResourceGroupName]",
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"name": "[variables('serviceBus').namespace.name]",
"type": "Microsoft.ServiceBus/namespaces",
"apiVersion": "2017-04-01",
"location": "[parameters('environment').location]",
"properties": {
},
"sku": {
"name": "[parameters('serviceBus').namespace.sku.name]",
"tier": "[parameters('serviceBus').namespace.sku.tier]"
},
"tags": {
"Department": "[parameters('tags').Department]",
"Product": "[parameters('tags').Product]",
"Service": "[parameters('tags').Service]",
"Environment": "[parameters('tags').environment]"
},
"resources": [
{
"type": "AuthorizationRules",
"name": "RootManagerSharedAccessKey",
"apiVersion": "2017-04-01",
"properties": {
"rights": [
"Listen",
"Manage",
"Send"
]
},
"dependsOn": [
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
]
},
{
"type": "AuthorizationRules",
"name": "PubSubSharedAccessKey",
"apiVersion": "2017-04-01",
"properties": {
"rights": [
"Listen",
"Send"
]
},
"dependsOn": [
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]",
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name, '/authorizationRules/RootManagerSharedAccessKey')]"
]
},
{
"type": "AuthorizationRules",
"name": "PublishSharedAccessKey",
"apiVersion": "2017-04-01",
"properties": {
"rights": [
"Send"
]
},
"dependsOn": [
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]",
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name, '/authorizationRules/PubSubSharedAccessKey')]"
]
},
{
"type": "AuthorizationRules",
"name": "ClientSharedAccessKey",
"apiVersion": "2017-04-01",
"properties": {
"rights": [
"Listen"
]
},
"dependsOn": [
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]",
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name, '/authorizationRules/PublishSharedAccessKey')]"
]
},
{
"type": "queues",
"name": "activity-log",
"apiVersion": "2017-04-01",
"properties": {
"lockDuration": "PT5M",
"maxSizeInMegabytes": 5120,
"requiresDuplicateDetection": false,
"requiresSession": false,
"defaultMessageTimeToLive": "P10675199DT2H48M5.4775807S",
"deadLetteringOnMessageExpiration": false,
"maxDeliveryCount": 10,
"autoDeleteOnIdle": "P10675199DT2H48M5.4775807S",
"enablePartitioning": false,
"enableExpress": false
},
"dependsOn": [
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
]
},
{
"type": "topics",
"name": "pdf-splitted",
"apiVersion": "2017-04-01",
"properties": {
},
"dependsOn": [
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
]
},
{
"type": "topics",
"name": "platform-admin",
"apiVersion": "2017-04-01",
"properties": {
},
"resources": [
{
"type": "authorizationRules",
"name": "PlatformAdminListenerServiceAccessKey",
"apiVersion": "2017-04-01",
"properties": {
"rights": [
"Listen"
]
},
"dependsOn": [
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name, '/topics/platform-admin')]"
]
}
],
"dependsOn": [
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
]
},
{
"type": "topics",
"name": "shared-context",
"apiVersion": "2017-04-01",
"properties": {
},
"resources": [
{
"type": "authorizationRules",
"name": "SharedCtxListenerServiceAccessKey",
"apiVersion": "2017-04-01",
"properties": {
"rights": [
"Listen"
]
},
"dependsOn": [
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name, '/topics/shared-context')]"
]
}
],
"dependsOn": [
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
]
},
{
"type": "topics",
"name": "transaction-audit",
"apiVersion": "2017-04-01",
"properties": {
},
"dependsOn": [
"[concat('Microsoft.ServiceBus/namespaces/',variables('serviceBus').namespace.name)]"
]
}
]
}
],
"outputs": {
"SharedCtxListenerServiceAccessKeyResourceId": {
"type": "string",
"value": "[resourceId('Microsoft.ServiceBus/namespaces/topics/authorizationRules',variables('serviceBus').namespace.name, 'shared-context','SharedCtxListenerServiceAccessKey')]"
}
}
}
},
"dependsOn": [
"[resourceId('Microsoft.Resources/resourceGroups/', variables('serviceBus').resourceGroupName)]"
]
},
{
"type": "Microsoft.Resources/deployments",
"name": "ServiceBus_Secrets",
"apiVersion": "2017-05-10",
"resourceGroup": "[variables('keyVault').ResourceGroupName]",
"properties": {
"mode": "Incremental",
"template": {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"resources": [
{
"type": "Microsoft.KeyVault/vaults/secrets",
"name": "[concat(variables('keyVault').Name,'/SharedContext-Listener-ConnectionString')]",
"apiVersion": "2016-10-01",
"properties": {
"contentType": "ConnectionString",
"value": "[resourceId('Microsoft.ServiceBus/namespaces/topics/authorizationRules',variables('serviceBus').namespace.name, 'shared-context','SharedCtxListenerServiceAccessKey')]"
}
}
]
}
},
"dependsOn": [
"[concat('Microsoft.Resources/deployments/','ServiceBus_Infrastructure')]"
]
}
]
}
尝试了几种不同的方法之后，我设法使用ServiceBus_Infrastructure部署的输出发送resourceId并将其用作KeyVault的秘密，以此作为测试大多数资源是否按预期运行的方式。我已经尝试在输出中使用listkey（）函数，如下所示：
"SharedCtxListenerServiceAccessKeyResourceId": {
"type": "string",
"value": "[listkeys(resourceId('Microsoft.ServiceBus/namespaces/topics/authorizationRules',variables('serviceBus').namespace.name, 'shared-context','SharedCtxListenerServiceAccessKey'),'2017-04-01').PrimaryConnectionString]"
}
}
但是这给了我这个错误：{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"NotFound","message":"{\r\n \"error\": {\r\n \"code\": \"ParentResourceNotFound\",\r\n \"message\": \"Can not perform requested operation on nested resource. Parent resource 'team-development-sbn' not found.\"\r\n }\r\n}"}]}
这很奇怪，因为服务总线 是在先前的部署中创建的，而这是最后一个部署资源所依赖的。我想我在某处读到，由于服务总线资源位于部署资源中，因此它不一定知道它实际上已经完成，这也许就是为什么找不到它的原因？
我也尝试过在密钥库机密的value字段中执行listKeys（）函数，但是比起说不希望在这里引用（）函数来
我的基本问题是：我如何获取PrimaryConnectionString并将其作为秘钥部署到不同资源组中的密钥库中，最好是在同一模板中使用（因为这是希望可以遵循此模式的众多服务之一）资源已创建并将必要的值存储在中央密钥库中）感谢您的帮助！
答案 0 :(得分：0)
我想如果您重新运行此模板，它将可以正常工作。因此，发生了什么-您正在使用嵌套模板，并且它们同时“渲染”所有内容，因此它们在嵌套模板内确实没有依赖项（嗯，它们确实有，但是有点奇怪）。简而言之，我建议您使用链接的模板（将服务总线部署转换为链接的模板），然后这样做。
ps。老实说，除非您打算使用Arm模板管理订阅级资源，否则请完全放弃订阅级部署。