我目前有一个 ARM 模板，用于部署带有子网的虚拟网络以及 Azure SQL 数据库实例。
与子网和 SQL 防火墙规则相关的核心资源是:
{
"name": "MyVirtualNetwork",
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2019-11-01",
"location": "[resourceGroup().location]",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityGroups', variables('vmNSG'))]"
],
"properties": {
"addressSpace": {
"addressPrefixes": [
"10.0.0.0/16"
]
},
"subnets": [
{
"name": "Client-Subnet",
"properties": {
"addressPrefix": "10.0.0.0/24",
"networkSecurityGroup": {
"id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('vmNSG'))]"
}
}
}
]
}
},
{
"type": "Microsoft.Network/virtualNetworks/subnets",
"apiVersion": "2019-11-01",
"name": "NDC-VirtualNetwork/Client-Subnet",
"properties": {
"addressPrefix": "10.0.0.0/24"
},
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', 'NDC-VirtualNetwork')]"
]
}
和
{
"type": "firewallRules",
"apiVersion": "2015-05-01-preview",
"dependsOn": [
"[resourceId('Microsoft.Sql/servers', variables('uniqueSQLName'))]"
],
"location": "[resourceGroup().location]",
"name": "AllowAllWindowsAzureIps",
"properties": {
"startIpAddress": "0.0.0.0",
"endIpAddress": "0.0.0.0"
}
},
{
"type": "firewallRules",
"apiVersion": "2015-05-01-preview",
"dependsOn": [
"[resourceId('Microsoft.Sql/servers', variables('uniqueSQLName'))]"
],
"location":"[resourceGroup().location]",
"name": "ClientIP",
"properties": {
"startIpAddress": "[parameters('clientIP')]",
"endIpAddress": "[parameters('clientIP')]"
}
}
我现在想要更新模板以允许来自此子网的 VNET 服务端点访问 SQL 并删除“AllowAllWindowsAzureIPs”和“ClientIP”防火墙规则。
为了实现此目的，我从 SQL 资源中删除了两个 firewallRules 资源并添加了以下内容:
{
"name": "[concat(variables('uniqueSQLName'), '-Client-Subnet')]",
"type": "virtualNetworkRules",
"apiVersion": "2015-05-01-preview",
"properties": {
"virtualNetworkSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', 'NDC-VirtualNetwork', 'Client-Subnet')]",
"ignoreMissingVnetServiceEndpoint": true
},
"dependsOn": [
"[resourceId('Microsoft.Sql/servers', variables('uniqueSQLName'))]"
]
}
然后将网络资源更新为:
{
"name": "MyVirtualNetwork",
"type": "Microsoft.Network/virtualNetworks",
"apiVersion": "2019-11-01",
"location": "[resourceGroup().location]",
"dependsOn": [
"[resourceId('Microsoft.Network/networkSecurityGroups', variables('vmNSG'))]"
],
"properties": {
"addressSpace": {
"addressPrefixes": [
"10.0.0.0/16"
]
},
"subnets": [
{
"name": "Client-Subnet",
"properties": {
"addressPrefix": "10.0.0.0/24",
"networkSecurityGroup": {
"id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('vmNSG'))]"
},
"serviceEndpoints": [
{
"service": "Microsoft.Sql",
"locations": [
"australiaeast"
]
}
]
}
}
]
}
},
{
"type": "Microsoft.Network/serviceEndpointPolicies",
"apiVersion": "2019-11-01",
"name": "AllowVNETtoSQL",
"location": "[resourceGroup().location]",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks', 'MyVirtualNetwork')]",
"[resourceId('Microsoft.Sql/servers', variables('uniqueSQLName'))]"
],
"properties": {
"serviceEndpointPolicyDefinitions": [
{
"name": "AllowVNETtoSQLPolicy",
"properties": {
"service": "Microsoft.Sql",
"serviceResources": [
"[resourceId('Microsoft.Sql/servers', variables('uniqueSQLName'))]"
]
}
}
]
}
},
{
"type": "Microsoft.Network/virtualNetworks/subnets",
"apiVersion": "2019-11-01",
"name": "MyVirtualNetwork/Client-Subnet",
"dependsOn": [
"[resourceId('Microsoft.Network/virtualNetworks','MyVirtualNetwork')]",
"[resourceId('Microsoft.Network/serviceEndpointPolicies','AllowVNETtoSQL')]"
],
"properties": {
"addressPrefix": "10.0.0.0/24",
"serviceEndpointPolicies": [
{
"id": "[resourceId('Microsoft.Network/serviceEndpointPolicies','AllowVNETtoSQL')]"
}
],
"serviceEndpoints": [
{
"service": "Microsoft.Sql",
"locations": [
"australiaeast"
]
}
]
}
}
此更改导致我收到两个错误:
- Azure SQL Server 虚拟网络规则遇到用户错误:无法继续操作，因为子网为虚拟网络的客户端子网 未预配/subscriptions//resourceGroups//providers/Microsoft.Network/virtualNetworks/MyVirtualNetwork。它们处于正在更新状态。
- 服务端点策略定义
/subscriptions//resourceGroups//providers/Microsoft.Network/serviceEndpointPolicies/AllowVNETtoSQL/serviceEndpointPolicyDefinitions/AllowVNETtoSQLPolicy 引用
无效的服务名称 Microsoft.Sql。支持的服务名称有:Microsoft.Storage、Microsoft.Sql、Microsoft.AzureActiveDirectory、Microsoft.AzureCosmosDB、Microsoft.Web、 Microsoft.NetworkServiceEndpointTest、Microsoft.KeyVault、Microsoft.EventHub、Microsoft.ServiceBus、Microsoft.ContainerRegistry、Microsoft.CognitiveServices、全局。 (代码: ServiceEndpointPolicyDefinitionHasServiceWithInvalidServiceName)
我的问题如下:
- 任何人都可以解释第二个错误，其中指出 Microsoft.Sql 无效，但随后将其列为支持的服务名称吗？
- 我缺少什么依赖项来允许服务端点完成部署？我已经拥有具有属性
"ignoreMissingVnetServiceEndpoint": true的 SQL 虚拟网络规则 我对此的理解是 SQL 资源将创建服务端点防火墙规则 OK 并跳过对子网状态和子网状态的任何检查然后，子网将愉快地转换为启用状态，并允许将来的连接。
最佳答案
对于第 1 点:向失败的服务添加依赖项以依赖于资源，该错误应该会消失。 2.不确定，我的猜测是-隐形字符或类似的东西。尝试从错误文本中复制\粘贴。
对于您的问题:您不需要任何东西来启用服务端点。只需创建它们，然后您就可以使用它们。忽略应该像你想象的那样工作
关于azure - 尝试在 ARM 模板中添加 VNET 服务端点时出现问题，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/62978498/