本快速入门介绍如何使用 Bicep 创建 Azure DNS 专用解析程序。
Bicep 是一种特定于域的语言 (DSL),使用声明性语法来部署 Azure 资源。 它提供简明的语法、可靠的类型安全性以及对代码重用的支持。 Bicep 会针对你的 Azure 基础结构即代码解决方案提供最佳创作体验。
下图总结了所使用的常规设置。 模板中使用的子网地址范围与图中所示的子网地址范围略有不同。
如果没有 Azure 订阅,可在开始前创建一个试用帐户。
本快速入门中使用的 Bicep 文件来自 Azure 快速入门模板。
此 Bicep 文件配置为创建:
- 虚拟网络
- DNS 解析程序
- 入站和出站终结点
- 转发规则和规则集。
@description('name of the new virtual network where DNS resolver will be created')
param resolverVNETName string = 'dnsresolverVNET'
@description('the IP address space for the resolver virtual network')
param resolverVNETAddressSpace string = '10.7.0.0/24'
@description('name of the dns private resolver')
param dnsResolverName string = 'dnsResolver'
@description('the location for resolver VNET and dns private resolver - Azure DNS Private Resolver available in specific region, refer the documenation to select the supported region for this deployment. For more information https://docs.azure.cn/dns/dns-private-resolver-overview#regional-availability')
@allowed([
'chinanorth3',
'chinaeast3'
])
param location string
@description('name of the subnet that will be used for private resolver inbound endpoint')
param inboundSubnet string = 'snet-inbound'
@description('the inbound endpoint subnet address space')
param inboundAddressPrefix string = '10.7.0.0/28'
@description('name of the subnet that will be used for private resolver outbound endpoint')
param outboundSubnet string = 'snet-outbound'
@description('the outbound endpoint subnet address space')
param outboundAddressPrefix string = '10.7.0.16/28'
@description('name of the vnet link that links outbound endpoint with forwarding rule set')
param resolvervnetlink string = 'vnetlink'
@description('name of the forwarding ruleset')
param forwardingRulesetName string = 'forwardingRule'
@description('name of the forwarding rule name')
param forwardingRuleName string = 'contosocom'
@description('the target domain name for the forwarding ruleset')
param DomainName string = 'contoso.com.'
@description('the list of target DNS servers ip address and the port number for conditional forwarding')
param targetDNS array = [
{
ipaddress: '10.0.0.4'
port: 53
}
{
ipaddress: '10.0.0.5'
port: 53
}
]
resource resolver 'Microsoft.Network/dnsResolvers@2022-07-01' = {
name: dnsResolverName
location: location
properties: {
virtualNetwork: {
id: resolverVnet.id
}
}
}
resource inEndpoint 'Microsoft.Network/dnsResolvers/inboundEndpoints@2022-07-01' = {
parent: resolver
name: inboundSubnet
location: location
properties: {
ipConfigurations: [
{
privateIpAllocationMethod: 'Dynamic'
subnet: {
id: '${resolverVnet.id}/subnets/${inboundSubnet}'
}
}
]
}
}
resource outEndpoint 'Microsoft.Network/dnsResolvers/outboundEndpoints@2022-07-01' = {
parent: resolver
name: outboundSubnet
location: location
properties: {
subnet: {
id: '${resolverVnet.id}/subnets/${outboundSubnet}'
}
}
}
resource fwruleSet 'Microsoft.Network/dnsForwardingRulesets@2022-07-01' = {
name: forwardingRulesetName
location: location
properties: {
dnsResolverOutboundEndpoints: [
{
id: outEndpoint.id
}
]
}
}
resource resolverLink 'Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks@2022-07-01' = {
parent: fwruleSet
name: resolvervnetlink
properties: {
virtualNetwork: {
id: resolverVnet.id
}
}
}
resource fwRules 'Microsoft.Network/dnsForwardingRulesets/forwardingRules@2022-07-01' = {
parent: fwruleSet
name: forwardingRuleName
properties: {
domainName: DomainName
targetDnsServers: targetDNS
}
}
resource resolverVnet 'Microsoft.Network/virtualNetworks@2022-01-01' = {
name: resolverVNETName
location: location
properties: {
addressSpace: {
addressPrefixes: [
resolverVNETAddressSpace
]
}
enableDdosProtection: false
enableVmProtection: false
subnets: [
{
name: inboundSubnet
properties: {
addressPrefix: inboundAddressPrefix
delegations: [
{
name: 'Microsoft.Network.dnsResolvers'
properties: {
serviceName: 'Microsoft.Network/dnsResolvers'
}
}
]
}
}
{
name: outboundSubnet
properties: {
addressPrefix: outboundAddressPrefix
delegations: [
{
name: 'Microsoft.Network.dnsResolvers'
properties: {
serviceName: 'Microsoft.Network/dnsResolvers'
}
}
]
}
}
]
}
}
此模板中定义了七个资源:
- Microsoft.Network/virtualnetworks
- Microsoft.Network/dnsResolvers
- Microsoft.Network/dnsResolvers/inboundEndpoints
- Microsoft.Network/dnsResolvers/outboundEndpoints
- Microsoft.Network/dnsForwardingRulesets
- Microsoft.Network/dnsForwardingRulesets/forwardingRules
- Microsoft.Network/dnsForwardingRulesets/virtualNetworkLinks
- 将该 Bicep 文件另存为本地计算机上的 main.bicep。
- 使用 Azure CLI 或 Azure PowerShell 来部署 Bicep 文件
az group create --name exampleRG --location chinanorth3
az deployment group create --resource-group exampleRG --template-file main.bicep
部署完成后,应会看到一条指出部署成功的消息。
使用 Azure 门户、Azure CLI 或 Azure PowerShell 列出资源组中已部署的资源。
#Show the DNS resolver
az dns-resolver show --name "sampleDnsResolver" --resource-group "sampleResourceGroup"
#List the inbound endpoint
az dns-resolver inbound-endpoint list --dns-resolver-name "sampleDnsResolver" --resource-group "sampleResourceGroup"
#List the outbound endpoint
az dns-resolver outbound-endpoint list --dns-resolver-name "sampleDnsResolver" --resource-group "sampleResourceGroup"
如果不再需要资源,请使用 Azure 门户、Azure CLI 或 Azure PowerShell 按以下顺序将其删除。
#Delete the inbound endpoint
az dns-resolver inbound-endpoint delete --dns-resolver-name "sampleDnsResolver" --name "sampleInboundEndpoint" --resource-group "exampleRG"
#Delete the virtual network link
az dns-resolver vnet-link delete --ruleset-name "sampleDnsForwardingRuleset" --resource- group "exampleRG" --name "sampleVirtualNetworkLink"
#Delete DNS forwarding ruleset
az dns-resolver forwarding-ruleset delete --name "samplednsForwardingRulesetName" --resource-group "exampleRG"
#Delete the outbound endpoint
az dns-resolver outbound-endpoint delete --dns-resolver-name "sampleDnsResolver" --name "sampleOutboundEndpoint" --resource-group "exampleRG"
#Delete the DNS resolver
az dns-resolver delete --name "sampleDnsResolver" --resource-group "exampleRG"
在本快速入门中,你创建了虚拟网络和 DNS 专用解析程序。 现在为 Azure 和本地域配置名称解析。