快速入门：使用 Terraform 为 Azure Kubernetes 服务 (AKS) 群集配置保管备份

本快速入门介绍如何使用 Terraform 为 Azure Kubernetes 服务 (AKS) 群集配置保管备份。

适用于 AKS 的 Azure 备份是一种云原生的、企业就绪的、以应用程序为中心的备份服务，可让你快速配置 AKS 群集的备份。

先决条件

配置 AKS 备份之前要确保的事项：

• 本快速入门假设读者基本了解 Kubernetes 的概念。 有关详细信息，请参阅 [Azure Kubernetes 服务 (AKS) 的 Kubernetes 核心概念][kubernetes-concepts]。

• 需要一个具有活动订阅的 Azure 帐户。 如果你没有帐户，请免费创建一个。

• 安装和配置 Terraform。

• 下载 kubectl。

• 使用 random_pet 为 Azure 资源组名称创建一个随机值。

• 使用 azurerm_resource_group 创建 Azure 资源组。

• 使用 azurerm_client_config访问 AzureRM 提供程序的配置以获取 Azure 对象 ID。

• 使用 azurerm_kubernetes_cluster创建 Kubernetes 群集。

• 使用 azapi_resource创建 AzAPI 资源。

• 使用 azurerm_storage_account创建存储帐户。

• 使用 azurerm_storage_container创建 Blob 容器。

• 使用 azurerm_kubernetes_cluster_extension 在 AKS 群集中安装备份扩展。

• 使用 azurerm_data_protection_backup_vault创建备份保管库。

• 使用 azurerm_data_protection_backup_vault为 AKS 群集创建备份策略。

• 使用 azurerm_kubernetes_cluster_trusted_access_role_binding启用 AKS 群集与备份保管库之间的受信任的访问。

• 使用 azurerm_role_assignment启用角色分配。

• 使用 azurerm_data_protection_backup_policy_kubernetes_cluster为 AKS 群集配置备份。

登录到 Azure 帐户

登录到 Azure 帐户并使用以下方法之一进行身份验证：

Terraform 仅支持通过 Azure CLI 向 Azure 进行身份验证。 不支持使用 Azure PowerShell 进行身份验证。 因此，虽然可以在进行 Terraform 工作时使用 Azure PowerShell 模块，不过首先需要向 Azure 进行身份验证。

实现 Terraform 代码

若要实现 AKS 备份流的 Terraform 代码，请运行以下脚本：

1. 创建用于测试示例 Terraform 代码的目录，并将其设为当前目录。

2. 创建名为 providers.tf 的文件并插入下列代码：

   terraform {
     required_providers {
       azurerm = {
         source = "hashicorp/azurerm"
         version = "3.99.0"
       }
     }
   }
   
   provider "azurerm" {
      features {}
      subscription_id   = "<azure_subscription_id>"
      tenant_id = "<azure_subscription_tenant_id>"
   }
   

3. 创建名为 main.tf 的文件并插入下列代码：

    #Get Subscription and Tenant Id from Config
   
   data "azurerm_client_config" "current" {
   }
   
   #Create a Resource Group where Backup Vault and AKS Cluster will be created
   resource "azurerm_resource_group" "rg" {
     location = var.resource_group_location
     name     = var.resource_group_name
   }
   
   #Create a Resource Group where Storage Account and Snapshots related to backup will be created
   resource "azurerm_resource_group" "backuprg" {
     location = var.backup_resource_group_location
     name = var.backup_resource_group_name
   }
   
   #Create an AKS Cluster 
   resource "azurerm_kubernetes_cluster" "akscluster" {
     resource_group_name = azurerm_resource_group.rg.name
     name           = var.aks_cluster_name
     location       = azurerm_resource_group.rg.location
     dns_prefix     = var.dns_prefix
   
     identity {
       type = "SystemAssigned"
     }
   
     default_node_pool {
       name       = "agentpool"
       vm_size    = "Standard_D2_v2"
       node_count = var.node_count
     }
   
     network_profile {
       network_plugin    = "kubenet"
       load_balancer_sku = "standard"
     }
   
     depends_on = [azurerm_resource_group.rg,azurerm_resource_group.backuprg]
   }
   
   #Create a Backup Vault
   resource "azurerm_data_protection_backup_vault" "backupvault" {
     name                = var.backupvault_name
     resource_group_name = resource.azurerm_resource_group.rg.name
     location            = resource.azurerm_resource_group.rg.location
     datastore_type      = var.datastore_type
     redundancy          = var.redundancy
   
     identity {
       type = "SystemAssigned"
     }
     depends_on = [azurerm_kubernetes_cluster.akscluster]
   }
   
   #Create a Backup Policy with 4 hourly backups and 7 day retention duration
   resource "azurerm_data_protection_backup_policy_kubernetes_cluster" "policy" {
     name                = var.backuppolicy_name
     resource_group_name = var.resource_group_name
     vault_name          = var.backupvault_name
   
     backup_repeating_time_intervals = ["R/2024-04-14T06:33:16+00:00/PT4H"]
     default_retention_rule {
       life_cycle {
         duration        = "P7D"
         data_store_type = "OperationalStore"
       }
     }
   depends_on = [resource.azurerm_data_protection_backup_vault.backupvault]
   }
   
   #Create a Trusted Access Role Binding between AKS Cluster and Backup Vault
   resource "azurerm_kubernetes_cluster_trusted_access_role_binding" "trustedaccess" {
     kubernetes_cluster_id = azurerm_kubernetes_cluster.akscluster.id
     name                  = "backuptrustedaccess"
     roles                 = ["Microsoft.DataProtection/backupVaults/backup-operator"]
     source_resource_id    = azurerm_data_protection_backup_vault.backupvault.id
     depends_on = [resource.azurerm_data_protection_backup_vault.backupvault, azurerm_kubernetes_cluster.akscluster]
   }
   
   #Create a Backup Storage Account provided in input for Backup Extension Installation
   resource "azurerm_storage_account" "backupsa" {
     name                     = "tfaksbackup1604"
     resource_group_name      = azurerm_resource_group.backuprg.name
     location                 = azurerm_resource_group.backuprg.location
     account_tier             = "Standard"
     account_replication_type = "LRS"
     depends_on = [azurerm_kubernetes_cluster_trusted_access_role_binding.trustedaccess]
   }
   
   #Create a Blob Container where backup items will stored
   resource "azurerm_storage_container" "backupcontainer" {
     name                  = "tfbackup"
     storage_account_name  = azurerm_storage_account.backupsa.name
     container_access_type = "private"
     depends_on = [azurerm_storage_account.backupsa]
   }
   
   #Create Backup Extension in AKS Cluster
   resource "azurerm_kubernetes_cluster_extension" "dataprotection" {
     name = var.backup_extension_name
     cluster_id = azurerm_kubernetes_cluster.akscluster.id
     extension_type = var.backup_extension_type
     configuration_settings = {
       "configuration.backupStorageLocation.bucket" = azurerm_storage_container.backupcontainer.name
        "configuration.backupStorageLocation.config.storageAccount" = azurerm_storage_account.backupsa.name
        "configuration.backupStorageLocation.config.resourceGroup" = azurerm_storage_account.backupsa.resource_group_name
        "configuration.backupStorageLocation.config.subscriptionId" =  data.azurerm_client_config.current.subscription_id
        "credentials.tenantId" = data.azurerm_client_config.current.tenant_id
       }
     depends_on = [azurerm_storage_container.backupcontainer]
   }
   
   #Assign Role to Extension Identity over Storage Account
   resource "azurerm_role_assignment" "extensionrole" {
     scope                = azurerm_storage_account.backupsa.id
     role_definition_name = "Storage Account Contributor"
     principal_id         = azurerm_kubernetes_cluster_extension.dataprotection.aks_assigned_identity[0].principal_id
     depends_on = [azurerm_kubernetes_cluster_extension.dataprotection]
   }
   
   #Assign Role to Backup Vault over AKS Cluster
   resource "azurerm_role_assignment" "vault_msi_read_on_cluster" {
     scope                = azurerm_kubernetes_cluster.akscluster.id
     role_definition_name = "Reader"
     principal_id         = azurerm_data_protection_backup_vault.backupvault.identity[0].principal_id
     depends_on = [azurerm_kubernetes_cluster.akscluster,resource.azurerm_data_protection_backup_vault.backupvault]
   }
   
   #Assign Role to Backup Vault over Snapshot Resource Group
   resource "azurerm_role_assignment" "vault_msi_read_on_snap_rg" {
     scope                = azurerm_resource_group.backuprg.id
     role_definition_name = "Reader"
     principal_id         = azurerm_data_protection_backup_vault.backupvault.identity[0].principal_id
     depends_on = [azurerm_kubernetes_cluster.akscluster,resource.azurerm_data_protection_backup_vault.backupvault]
   }
   
   #Assign Role to AKS Cluster over Snapshot Resource Group
   resource "azurerm_role_assignment" "cluster_msi_contributor_on_snap_rg" {
     scope                = azurerm_resource_group.backuprg.id
     role_definition_name = "Contributor"
     principal_id         = try(azurerm_kubernetes_cluster.akscluster.identity[0].principal_id,null)
     depends_on = [azurerm_kubernetes_cluster.akscluster,resource.azurerm_kubernetes_cluster.akscluster,resource.azurerm_resource_group.backuprg]
   }
   
   #Create Backup Instance for AKS Cluster
   resource "azurerm_data_protection_backup_instance_kubernetes_cluster" "akstfbi" {
     name                         = "example"
     location                     = azurerm_resource_group.backuprg.location
     vault_id                     = azurerm_data_protection_backup_vault.backupvault.id
     kubernetes_cluster_id        = azurerm_kubernetes_cluster.akscluster.id
     snapshot_resource_group_name = azurerm_resource_group.backuprg.name
     backup_policy_id             = azurerm_data_protection_backup_policy_kubernetes_cluster.policy.id
   
     backup_datasource_parameters {
       excluded_namespaces              = []
       excluded_resource_types          = []
       cluster_scoped_resources_enabled = true
       included_namespaces              = []
       included_resource_types          = []
       label_selectors                  = []
       volume_snapshot_enabled          = true
     }
   
     depends_on = [
       resource.azurerm_data_protection_backup_vault.backupvault,
       azurerm_data_protection_backup_policy_kubernetes_cluster.policy,
       azurerm_role_assignment.extensionrole,
       azurerm_role_assignment.vault_msi_read_on_cluster,
       azurerm_role_assignment.vault_msi_read_on_snap_rg,
       azurerm_role_assignment.cluster_msi_contributor_on_snap_rg
     ]
   }
   

4. 创建名为 variables.tf 的文件并插入下列代码：

   variable "aks_cluster_name" {
     type        = string
     default     = "Contoso_AKS_TF"
     description = "Name of the AKS Cluster."
   }
   
   variable "backup_extension_name" {
     type        = string
     default     = "azure-aks-backup"
     description = "Name of the AKS Cluster Extension."
   }
   
   variable "backup_extension_type" {
     type        = string
     default     = "microsoft.dataprotection.kubernetes"
     description = "Type of the AKS Cluster Extension."
   }
   
   variable "dns_prefix" {
     type        = string
     default     = "contoso-aks-dns-tf"
     description = "DNS Name of AKS Cluster made with Terraform"
   }
   
   variable "node_count" {
     type        = number
     description = "The initial quantity of nodes for the node pool."
     default     = 3
   }
   
   variable "resource_group_location" {
     type        = string
     default     = "eastus"
     description = "Location of the resource group."
   }
   
   variable "backup_resource_group_name" {
     type        = string
     default     = "Contoso_TF_Backup_RG"
     description = "Location of the resource group."
   }
   
   variable "backup_resource_group_location" {
     type        = string
     default     = "eastus"
     description = "Location of the resource group."
   }
   
   variable "resource_group_name" {
     type        = string
     default     = "Contoso_TF_RG"
     description = "Location of the resource group."
   }
   
   variable "cluster_id" {
     type        = string
     default     = "/subscriptions/c3d3eb0c-9ba7-4d4c-828e-cb6874714034/resourceGroups/Contoso_TF_RG/providers/Microsoft.ContainerService/managedClusters/Contoso_AKS_TF"
     description = "Location of the resource group."
   }
   
   variable "backupvault_name" {
     type        = string
     default     = "BackupVaultTF"
     description = "Name of the Backup Vault"
   }
   
   variable "datastore_type" {
     type        = string
     default     = "OperationalStore"
   }
   
   variable "redundancy" {
     type        = string
     default     = "LocallyRedundant"
   }
   
   variable "backuppolicy_name" {
     type        = string
     default     = "aksbackuppolicytfv1"
   }
   

5. 创建名为 outputs.tf 的文件并插入下列代码：

    output "aks_resource_group" {
      value = azurerm_resource_group.rg.name
    }
   
    output "snapshot_resource_group" {
      value = azurerm_resource_group.backuprg.name
    }
   
    output "kubernetes_cluster_name" {
      value = azurerm_kubernetes_cluster.akscluster.name
    }
   
    output "backup_vault_name" {
      value = azurerm_data_protection_backup_vault.backupvault.name
    }
   
    output "backup_instance_id" {
      value = azurerm_data_protection_backup_instance_kubernetes_cluster.akstfbi.id
    }
   

初始化 Terraform

运行 terraform init，将 Terraform 部署进行初始化。 此命令将下载管理 Azure 资源所需的 Azure 提供程序。

terraform init -upgrade

要点：

• 参数 -upgrade 可将必要的提供程序插件升级到符合配置版本约束的最新版本。

创建 Terraform 执行计划

运行 terraform plan 以创建执行计划。

terraform plan -out main.tfplan

要点：

• terraform plan 命令将创建一个执行计划，但不会执行它。 它会确定创建配置文件中指定的配置需要执行哪些操作。 此模式允许你在对实际资源进行任何更改之前验证执行计划是否符合预期。
• 使用可选 -out 参数可以为计划指定输出文件。 使用 -out 参数可以确保所查看的计划与所应用的计划完全一致。

应用 Terraform 执行计划

运行 terraform apply，将执行计划应用到云基础结构。

terraform apply main.tfplan

要点：

• 示例 terraform apply 命令假设你先前运行了 terraform plan -out main.tfplan。
• 如果为 -out 参数指定了不同的文件名，请在对 terraform apply 的调用中使用该相同文件名。
• 如果未使用 -out 参数，请调用不带任何参数的 terraform apply。

Azure 上的 Terraform 故障排除

在 Azure 上使用 Terraform 时，可能会遇到常见问题。 了解如何进行故障排除。

下一步

本快速入门介绍了如何部署 Kubernetes 群集、如何创建备份库，以及如何为 Kubernetes 群集配置备份。

了解有关以下方面的详细信息：