将容器实例部署到 Azure 虚拟网络Deploy container instances into an Azure virtual network

Azure 虚拟网络为 Azure 资源和本地资源提供安全的专用网络。Azure Virtual Network provides secure, private networking for your Azure and on-premises resources. 将容器组部署到 Azure 虚拟网络后,容器可与该虚拟网络中的其他资源安全通信。By deploying container groups into an Azure virtual network, your containers can communicate securely with other resources in the virtual network.

本文演示如何在 Azure CLI 中使用 az container create 命令将容器组部署到新的虚拟网络或现有虚拟网络。This article shows how to use the az container create command in the Azure CLI to deploy container groups to either a new virtual network or an existing virtual network.

有关网络方案和限制,请参阅 Azure 容器实例的虚拟网络方案和资源For networking scenarios and limitations, see Virtual network scenarios and resources for Azure Container Instances.

重要

虚拟网络中的容器组部署通常适用于大多数同时可使用 Azure 容器实例的区域中的 Linux 容器。Container group deployment to a virtual network is generally available for Linux containers, in most regions where Azure Container Instances is available. 有关详细信息,请参阅区域和资源可用性For details, see Regions and resource availability.

本文中的示例已针对 Bash shell 设置了格式。Examples in this article are formatted for the Bash shell. 若要使用其他 shell(例如 PowerShell 或命令提示符),请相应地调整续行符。If you prefer another shell such as PowerShell or Command Prompt, adjust the line continuation characters accordingly.

部署到新虚拟网络Deploy to new virtual network

若要部署到新虚拟网络并让 Azure 自动创建网络资源,请在执行 az container create 时指定以下信息:To deploy to a new virtual network and have Azure create the network resources for you automatically, specify the following when you execute az container create:

  • 虚拟网络名称Virtual network name
  • 采用 CIDR 格式的虚拟网络地址前缀Virtual network address prefix in CIDR format
  • 子网名称Subnet name
  • 采用 CIDR 格式的子网地址前缀Subnet address prefix in CIDR format

虚拟网络和子网地址前缀分别指定虚拟网络和子网的地址空间。The virtual network and subnet address prefixes specify the address spaces for the virtual network and subnet, respectively. 这些值以无类域间路由 (CIDR) 表示法表示,例如 10.0.0.0/16These values are represented in Classless Inter-Domain Routing (CIDR) notation, for example 10.0.0.0/16. 有关使用子网的详细信息,请参阅添加、更改或删除虚拟网络子网For more information about working with subnets, see Add, change, or delete a virtual network subnet.

使用此方法部署第一个容器组后,可以通过指定虚拟网络和子网名称或者 Azure 自动创建的网络配置文件,来部署到同一子网。Once you've deployed your first container group with this method, you can deploy to the same subnet by specifying the virtual network and subnet names, or the network profile that Azure automatically creates for you. 由于 Azure 将该子网委托给了 Azure 容器实例,因此只能将容器组部署到该子网。Because Azure delegates the subnet to Azure Container Instances, you can deploy only container groups to the subnet.

示例Example

以下 az container create 命令指定新虚拟网络和子网的设置。The following az container create command specifies settings for a new virtual network and subnet. 提供支持在虚拟网络中部署容器组的区域中创建的资源组的名称。Provide the name of a resource group that was created in a region where container group deployments in a virtual network are available. 此命令将部署公共 Microsoft aci-helloworld 容器,该容器运行一个提供静态网页的小型 Node.js Web 服务器。This command deploys the public Microsoft aci-helloworld container that runs a small Node.js webserver serving a static web page. 在下一部分,我们要将另一个容器组部署到同一子网,并测试这两个容器实例之间的通信。In the next section, you'll deploy a second container group to the same subnet, and test communication between the two container instances.

az container create \
  --name appcontainer \
  --resource-group myResourceGroup \
  --image mcr.microsoft.com/azuredocs/aci-helloworld \
  --vnet aci-vnet \
  --vnet-address-prefix 10.0.0.0/16 \
  --subnet aci-subnet \
  --subnet-address-prefix 10.0.0.0/24

使用此方法部署到新虚拟网络时,部署可能需要花费几分钟时间,因为在此期间需要创建网络资源。When you deploy to a new virtual network by using this method, the deployment can take a few minutes while the network resources are created. 完成初始部署后,对于同一子网的后续容器组部署可以更快地完成。After the initial deployment, additional container group deployments to the same subnet complete more quickly.

部署到现有虚拟网络Deploy to existing virtual network

将容器组部署到现有虚拟网络:To deploy a container group to an existing virtual network:

  1. 在现有虚拟网络中创建一个子网,使用已在其中部署了容器组的现有子网,或使用已腾空了所有其他资源的现有子网Create a subnet within your existing virtual network, use an existing subnet in which a container group is already deployed, or use an existing subnet emptied of all other resources
  2. 使用 az container create 部署容器组并指定以下信息之一:Deploy a container group with az container create and specify one of the following:
    • 虚拟网络名称和子网名称Virtual network name and subnet name
    • 虚拟网络资源 ID 和子网资源 ID,它允许使用其他资源组中的虚拟网络Virtual network resource ID and subnet resource ID, which allows using a virtual network from a different resource group
    • 网络配置文件名称或 ID,可以使用 az network profile list 获取Network profile name or ID, which you can obtain using az network profile list

示例Example

以下示例将第二个容器组部署到以前创建的同一子网,并验证两个容器实例之间的通信。The following example deploys a second container group to the same subnet created previously, and verifies communication between the two container instances.

首先,获取部署的第一个容器组 appcontainer 的 IP 地址:First, get the IP address of the first container group you deployed, the appcontainer:

az container show --resource-group myResourceGroup \
  --name appcontainer \
  --query ipAddress.ip --output tsv

输出会显示专用子网中容器组的 IP 地址。The output displays the IP address of the container group in the private subnet. 例如:For example:

10.0.0.4

现在,请将 CONTAINER_GROUP_IP 设置为使用 az container show 命令检索到的 IP,并执行以下 az container create 命令。Now, set CONTAINER_GROUP_IP to the IP you retrieved with the az container show command, and execute the following az container create command. 这第二个容器 commchecker 运行基于 Alpine Linux 的映像,并针对第一个容器组的专用子网 IP 地址执行 wgetThis second container, commchecker, runs an Alpine Linux-based image and executes wget against the first container group's private subnet IP address.

CONTAINER_GROUP_IP=<container-group-IP-address>

az container create \
  --resource-group myResourceGroup \
  --name commchecker \
  --image alpine:3.5 \
  --command-line "wget $CONTAINER_GROUP_IP" \
  --restart-policy never \
  --vnet aci-vnet \
  --subnet aci-subnet

完成第二个容器的部署后,请提取其日志,以查看它执行的 wget 命令的输出:After this second container deployment has completed, pull its logs so you can see the output of the wget command it executed:

az container logs --resource-group myResourceGroup --name commchecker

如果第二个容器与第一个容器成功通信,则输出应类似于:If the second container communicated successfully with the first, output is similar to:

Connecting to 10.0.0.4 (10.0.0.4:80)
index.html           100% |*******************************|  1663   0:00:00 ETA

日志输出应显示 wget 可以在本地子网中使用第一个容器的专用 IP 地址连接到该容器,并可从中下载索引文件。The log output should show that wget was able to connect and download the index file from the first container using its private IP address on the local subnet. 两个容器组之间的网络流量保留在虚拟网络中。Network traffic between the two container groups remained within the virtual network.

示例 - YAMLExample - YAML

还可以通过使用 YAML 文件、资源管理器模板或其他编程方法(例如使用 Python SDK)将容器组部署到现有虚拟网络。You can also deploy a container group to an existing virtual network by using a YAML file, a Resource Manager template, or another programmatic method such as with the Python SDK.

例如,使用 YAML 文件时,可以部署到具有委派给了 Azure 容器实例的子网的虚拟网络。For example, when using a YAML file, you can deploy to a virtual network with a subnet delegated to Azure Container Instances. 指定以下属性:Specify the following properties:

  • ipAddress:容器组的专用 IP 地址设置。ipAddress: The private IP address settings for the container group.
    • ports:要打开的端口(如果有)。ports: The ports to open, if any.
    • protocol:打开的端口的协议(TCP 或 UDP)。protocol: The protocol (TCP or UDP) for the opened port.
  • networkProfile:虚拟网络和子网的网络设置。networkProfile: Network settings for the virtual network and subnet.
    • idnetworkProfile 的完整资源管理器资源 ID。id: The full Resource Manager resource ID of the networkProfile.

要获取网络配置文件的 ID,请运行 az network profile list 命令,并指定包含虚拟网络和委托子网的资源组的名称。To get the ID of the network profile, run the az network profile list command, specifying the name of the resource group that contains your virtual network and delegated subnet.

az network profile list --resource-group myResourceGroup \
  --query [0].id --output tsv

示例输出:Sample output:

/subscriptions/<Subscription ID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkProfiles/aci-network-profile-aci-vnet-aci-subnet

获取网络配置文件 ID 后,将以下 YAML 复制到名为 vnet-deploy-aci.yaml 的新文件中。Once you have the network profile ID, copy the following YAML into a new file named vnet-deploy-aci.yaml. networkProfile 下,将 id 值替换为刚刚检索到的 ID,然后保存文件。Under networkProfile, replace the id value with ID you just retrieved, then save the file. 此 YAML 会在虚拟网络中创建名为 appcontaineryaml 的容器组。This YAML creates a container group named appcontaineryaml in your virtual network.

apiVersion: '2019-12-01'
location: chinaeast2
name: appcontaineryaml
properties:
  containers:
  - name: appcontaineryaml
    properties:
      image: mcr.microsoft.com/azuredocs/aci-helloworld
      ports:
      - port: 80
        protocol: TCP
      resources:
        requests:
          cpu: 1.0
          memoryInGB: 1.5
  ipAddress:
    type: Private
    ports:
    - protocol: tcp
      port: '80'
  networkProfile:
    id: /subscriptions/<Subscription ID>/resourceGroups/myResourceGroup/providers/Microsoft.Network/networkProfiles/aci-network-profile-aci-vnet-subnet
  osType: Linux
  restartPolicy: Always
tags: null
type: Microsoft.ContainerInstance/containerGroups

使用 az container create 命令并在 --file 参数中指定 YAML 文件名,以部署容器组:Deploy the container group with the az container create command, specifying the YAML file name for the --file parameter:

az container create --resource-group myResourceGroup \
  --file vnet-deploy-aci.yaml

完成部署后,运行 az container show 命令以显示部署状态。Once the deployment completes, run the az container show command to display its status. 示例输出:Sample output:

Name              ResourceGroup    Status    Image                                       IP:ports     Network    CPU/Memory       OsType    Location
---------------- ---------------  -------- ------------------------------------------  ----------- ---------  --------------- --------  ----------
appcontaineryaml  myResourceGroup  Running   mcr.microsoft.com/azuredocs/aci-helloworld  10.0.0.5:80  Private    1.0 core/1.5 gb  Linux     chinaeast2

清理资源Clean up resources

删除容器实例Delete container instances

处理完所创建的容器实例后,使用以下命令将其删除:When you're done working with the container instances you created, delete them with the following commands:

az container delete --resource-group myResourceGroup --name appcontainer -y
az container delete --resource-group myResourceGroup --name commchecker -y
az container delete --resource-group myResourceGroup --name appcontaineryaml -y

删除网络资源Delete network resources

此功能当前需要执行几个其他命令才能删除前面创建的网络资源。This feature currently requires several additional commands to delete the network resources you created earlier. 如果你在本文的前面几个部分中使用示例命令创建了虚拟网络和子网,则可以使用以下脚本来删除这些网络资源。If you used the example commands in previous sections of this article to create your virtual network and subnet, then you can use the following script to delete those network resources. 该脚本假定你的资源组包含具有单个网络配置文件的单个虚拟网络。The script assumes that your resource group contains a single virtual network with a single network profile.

执行该脚本之前,请将 RES_GROUP 变量设置为包含所要删除的虚拟网络和子网的资源组的名称。Before executing the script, set the RES_GROUP variable to the name of the resource group containing the virtual network and subnet that should be deleted. 如果未使用之前建议的 aci-vnet 名称,请更新虚拟网络的名称。Update the name of the virtual network if you did not use the aci-vnet name suggested earlier. 此脚本已针对 Bash Shell 格式化。The script is formatted for the Bash shell. 若要使用其他 shell(例如 PowerShell 或命令提示符),需要相应地调整变量赋值和访问器。If you prefer another shell such as PowerShell or Command Prompt, you'll need to adjust variable assignment and accessors accordingly.

警告

此脚本会删除资源!This script deletes resources! 它会删除虚拟网络及其包含的所有子网。It deletes the virtual network and all subnets it contains. 运行此脚本之前,请确认你不再需要该虚拟网络中的任何资源,包括其中的任何子网。Be sure that you no longer need any of the resources in the virtual network, including any subnets it contains, prior to running this script. 一旦删除,这些资源就不可恢复Once deleted, these resources are unrecoverable.

# Replace <my-resource-group> with the name of your resource group
# Assumes one virtual network in resource group
RES_GROUP=<my-resource-group>

# Get network profile ID
# Assumes one profile in virtual network
NETWORK_PROFILE_ID=$(az network profile list --resource-group $RES_GROUP --query [0].id --output tsv)

# Delete the network profile
az network profile delete --id $NETWORK_PROFILE_ID -y

# Delete virtual network
az network vnet delete --resource-group $RES_GROUP --name aci-vnet

后续步骤Next steps

若要使用资源管理器模板部署新的虚拟网络、子网、网络配置文件和容器组,请参阅 Create an Azure container group with VNet(使用 VNet 创建 Azure 容器组)。To deploy a new virtual network, subnet, network profile, and container group using a Resource Manager template, see Create an Azure container group with VNet.