使用 ARM 模板管理已启用 Entra ID 的 Azure HDInsight 群集

Azure HDInsight 现在支持与 Microsoft Entra ID 集成，为大数据工作负载启用安全、基于角色的访问控制和简化的标识管理。 通过使用 Azure 资源管理器（ARM）模板，可以采用可重复、自动化和一致的方式部署和管理已启用 Entra ID 的 HDInsight 群集。 本指南介绍如何设置 ARM 模板资源并配置 Entra ID。 你还将了解如何在满足组织的安全和治理规则的同时大规模管理群集。

先决条件

在开始之前，请确保具有以下资源：

• 具有足够权限部署资源的 Azure 订阅。

• Microsoft Entra ID 租户已配置且可访问。

• 具有必要角色分配（例如参与者和用户访问管理员）的服务主体或托管身份，以创建和管理 HDInsight 群集。

• Azure CLI、PowerShell 或 Azure 门户访问权限，用于验证部署并监视群集状态。

• 定义群集配置和 Entra ID 集成设置的 ARM 模板和参数文件。

ARM 模板资源定义

可以通过面向资源组的操作来部署群集资源类型 - 请参阅资源组部署命令

有关每个 API 版本中已更改属性的列表，请参阅更改日志。

资源格式

若要创建 Microsoft.HDInsight/clusters 资源，请将以下 JSON 添加到模板。

				{
					"$schema": "https://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#",
					"contentVersion": "0.9.0.0",
					"parameters": {
						"clusterName": {
							"type": "string",
							"metadata": {
								"description": "The name of the HDInsight cluster to create."
							}
						},
						"location": {
							"type": "string",
							"defaultValue": "chinaeast2euap",
							"metadata": {
								"description": "The location where all azure resources will be deployed."
							}
						},
						"clusterVersion": {
							"type": "string",
							"defaultValue": "5.1",
							"metadata": {
								"description": "HDInsight cluster version."
							}
						},
						"clusterWorkerNodeCount": {
							"type": "int",
							"defaultValue": 4,
							"metadata": {
								"description": "The number of nodes in the HDInsight cluster."
							}
						},
						"clusterKind": {
							"type": "string",
							"defaultValue": "SPARK",
							"metadata": {
								"description": "The type of the HDInsight cluster to create."
							}
						},
						"sshUserName": {
							"type": "string",
							"defaultValue": "sshuser",
							"metadata": {
								"description": "These credentials can be used to remotely access the cluster."
							}
						},
						"clusterRestAuthEntraUsers": {
							"type": "string",
							"metadata": {
								"description": "These Micrsoft Entra users can be used to submit jobs to the cluster and to log into cluster dashboards."
							}
						},
						"sshPassword": {
							"type": "securestring",
							"metadata": {
								"description": "The password must be at least 10 characters in length and must contain at least one digit, one non-alphanumeric character, and one upper or lower case letter."
							}
						},
						"minTlsVersionNumber": {
							"type": "string"
						},
						"isEncryptionInTransitEnabled": {
							"type": "bool"
						}
					},
					"resources": [
						{
							"apiVersion": "2025-01-15-preview",
							"name": "[parameters('clusterName')]",
							"type": "Microsoft.HDInsight/clusters",
							"location": "[parameters('location')]",
							"dependsOn": [],
							"tags": {},
							"zones": null,
							"properties": {
								"clusterVersion": "[parameters('clusterVersion')]",
								"osType": "Linux",
								"tier": "standard",
								"clusterDefinition": {
									"kind": "[parameters('clusterKind')]",
									"componentVersion": {
										"Spark": "3.3"
									},
									"configurations": {
										"gateway": {
											"restAuthCredential.isEnabled": false,
											"restAuthEntraUsers": "[parameters('clusterRestAuthEntraUsers')]"
										}
									}
								},
								"storageProfile": {
									"storageaccounts": [
										{
											"name": "<storageAccountName>.dfs.core.chinacloudapi.cn",
											"isDefault": true,
											"fileSystem": "hmgespark1-2025-10-06t08-34-17-604z",
											"resourceId": "/subscriptions/SubscriptionID>/resourceGroups/<resourceGroupName>/providers/Microsoft.Storage/storageAccounts/<MSIname>",
											"msiResourceId": "/subscriptions/<SubscriptionID>/resourcegroups/<resourceGroupName>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<MSIname>",
											"enableSecureChannel": true
										}
									]
								},
								"computeProfile": {
									"roles": [
										{
											"autoscale": null,
											"name": "headnode",
											"minInstanceCount": 1,
											"targetInstanceCount": 2,
											"hardwareProfile": {
												"vmSize": "Standard_E8_V3"
											},
											"osProfile": {
												"linuxOperatingSystemProfile": {
													"username": "[parameters('sshUserName')]",
													"password": "[parameters('sshPassword')]"
												},
												"windowsOperatingSystemProfile": null
											},
											"virtualNetworkProfile": null,
											"scriptActions": [],
											"dataDisksGroups": null
										},
										{
											"autoscale": {
												"capacity": {
													"minInstanceCount": 4,
													"maxInstanceCount": 5
												},
												"recurrence": null
											},
											"name": "workernode",
											"targetInstanceCount": 4,
											"hardwareProfile": {
												"vmSize": "Standard_E8_V3"
											},
											"osProfile": {
												"linuxOperatingSystemProfile": {
													"username": "[parameters('sshUserName')]",
													"password": "[parameters('sshPassword')]"
												},
												"windowsOperatingSystemProfile": null
											},
											"virtualNetworkProfile": null,
											"scriptActions": [],
											"dataDisksGroups": null
										},
										{
											"autoscale": null,
											"name": "zookeepernode",
											"minInstanceCount": 1,
											"targetInstanceCount": 3,
											"hardwareProfile": {
												"vmSize": "Standard_A2_V2"
											},
											"osProfile": {
												"linuxOperatingSystemProfile": {
													"username": "[parameters('sshUserName')]",
													"password": "[parameters('sshPassword')]"
												},
												"windowsOperatingSystemProfile": null
											},
											"virtualNetworkProfile": null,
											"scriptActions": [],
											"dataDisksGroups": null
										}
									]
								},
								"minSupportedTlsVersion": "[parameters('minTlsVersionNumber')]",
								"encryptionInTransitProperties": {
									"isEncryptionInTransitEnabled": "[parameters('isEncryptionInTransitEnabled')]"
								}
							},
							"identity": {
								"type": "UserAssigned",
								"userAssignedIdentities": {
									"/subscriptions/<subcriptionID>/resourcegroups/<resourceGroupName>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<MSIname>": {}
								}
							}
						}
					]
				}

参数

     				{
				  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
				  "contentVersion": "1.0.0.0",
				  "parameters": {
					"clusterName": {
					  "value": "<clustername>"
					},
					"location": {
					  "value": "<region_name>"
					},
					"clusterVersion": {
					  "value": "5.1"
					},
					"clusterWorkerNodeCount": {
					  "value": 4
					},
					"clusterKind": {
					  "value": "SPARK"
					},
					"sshUserName": {
					  "value": "sshuser"
					},
					"clusterRestAuthEntraUsers": {
					  "value": "[{\"displayName\":\"<Name>\",\"objectId\":\"00000000-0000-0000-0000-1ed7871c38e0\",\"upn\":\"user2@contoso.com\"},{\"displayName\":\"<Name>\",\"objectId\":\"00000000-0000-0000-000-b44d6570aa30\",\"upn\":\"user1@contoso.com\"}]"
					},
					"sshPassword": {
					  "value": null
					},
					"minTlsVersionNumber": {
					  "value": "1.2"
					},
					"isEncryptionInTransitEnabled": {
					  "value": true
					}
				  }
				}

属性值

自动缩放

AutoscaleCapacity

AutoscaleRecurrence

AutoscaleSchedule

AutoscaleTimeAndCapacity

ClusterCreatePropertiesOrClusterGetProperties

ClusterDefinition

ClusterIdentity

ComputeIsolationProperties

ComputeProfile

DataDisksGroups

DiskEncryptionProperties

EncryptionInTransitProperties

硬件配置文件

IP 配置

IPConfigurationProperties

IpTag

KafkaRestProperties

LinuxOperatingSystemProfile

Microsoft.HDInsight/clusters

NetworkProperties

OsProfile

PrivateLinkConfiguration

PrivateLinkConfigurationProperties

ResourceID

角色

ScriptAction

StorageAccount

StorageProfile

UserAssignedIdentity

VirtualNetworkProfile

通过使用 ARM 模板管理启用 Microsoft Entra ID 的 Azure HDInsight 群集，微软提供了一种一致、可重复且自动化的方法来部署和配置安全的大数据环境。 ARM 模板允许将所有群集设置（包括标识、网络、存储和安全性）定义为代码，确保部署可预测且符合组织标准。

此方法不仅简化了群集预配和管理，而且与 CI/CD 管道无缝集成，使你能够自信地缩放和管理 HDInsight 工作负载。