添加或删除子网委托Add or remove a subnet delegation

子网委派为服务提供了显式权限,以便能够在部署服务时使用唯一标识符在子网中创建服务专属资源。Subnet delegation gives explicit permissions to the service to create service-specific resources in the subnet using a unique identifier when deploying the service. 本文介绍如何添加或删除为 Azure 服务委托的子网。This article describes how to add or remove a delegated subnet for an Azure service.

Azure PowerShellAzure PowerShell

备注

本文已经过更新,以便使用 Azure Az PowerShell 模块。This article has been updated to use the Azure Az PowerShell module. 若要与 Azure 交互,建议使用的 PowerShell 模块是 Az PowerShell 模块。The Az PowerShell module is the recommended PowerShell module for interacting with Azure. 若要开始使用 Az PowerShell 模块,请参阅安装 Azure PowerShellTo get started with the Az PowerShell module, see Install Azure PowerShell. 若要了解如何迁移到 Az PowerShell 模块,请参阅 将 Azure PowerShell 从 AzureRM 迁移到 AzTo learn how to migrate to the Az PowerShell module, see Migrate Azure PowerShell from AzureRM to Az.

连接到 AzureConnect to Azure

Connect-AzAccount -Environment AzureChinaCloud

创建资源组Create a resource group

使用 New-AzResourceGroup 创建资源组。Create a resource group with New-AzResourceGroup. Azure 资源组是在其中部署和管理 Azure 资源的逻辑容器。An Azure resource group is a logical container into which Azure resources are deployed and managed.

以下示例在“chinaeast” 位置创建名为“myResourceGroup” 的资源组:The following example creates a resource group named myResourceGroup in the chinaeast location:

New-AzResourceGroup -Name myResourceGroup -Location chinaeast

创建虚拟网络Create virtual network

使用 New-AzVirtualNetworkmyResourceGroup 中创建名为 myVnet 的虚拟网络,并使用 New-AzVirtualNetworkSubnetConfig 创建名为 mySubnet 的子网。Create a virtual network named myVnet with a subnet named mySubnet using New-AzVirtualNetworkSubnetConfig in the myResourceGroup using New-AzVirtualNetwork. 虚拟网络的 IP 地址空间是 10.0.0.0/16The IP address space for the virtual network is 10.0.0.0/16. 虚拟网络中的子网是 10.0.0.0/24The subnet within the virtual network is 10.0.0.0/24.

  $subnet = New-AzVirtualNetworkSubnetConfig -Name mySubnet -AddressPrefix "10.0.0.0/24"

  New-AzVirtualNetwork -Name myVnet -ResourceGroupName myResourceGroup -Location chinaeast -AddressPrefix "10.0.0.0/16" -Subnet $subnet

权限Permissions

如果没有创建要委托给 Azure 服务的子网,则需要以下权限:Microsoft.Network/virtualNetworks/subnets/writeIf you didn't create the subnet you would like to delegate to an Azure service, you need the following permission: Microsoft.Network/virtualNetworks/subnets/write.

内置的网络参与者角色也包含必需的权限。The built-in Network Contributor role also contains the necessary permissions.

将子网委托给 Azure 服务Delegate a subnet to an Azure service

在此部分,我们将上一部分创建的子网委托给 Azure 服务。In this section, you delegate the subnet that you created in the preceding section to an Azure service.

请使用 Add-AzDelegation 通过名为 myDelegation 的委托(委托到 Azure 服务)对名为 mySubnet 的子网进行更新。Use Add-AzDelegation to update the subnet named mySubnet with a delegation named myDelegation to an Azure service. 在此示例中,Microsoft.DBforPostgreSQL/serversv2 用于示例委托:In this example Microsoft.DBforPostgreSQL/serversv2 is used for the example delegation:

  $vnet = Get-AzVirtualNetwork -Name "myVNet" -ResourceGroupName "myResourceGroup"
  $subnet = Get-AzVirtualNetworkSubnetConfig -Name "mySubnet" -VirtualNetwork $vnet
  $subnet = Add-AzDelegation -Name "myDelegation" -ServiceName "Microsoft.DBforPostgreSQL/serversv2" -Subnet $subnet
  Set-AzVirtualNetwork -VirtualNetwork $vnet

使用 Get-AzDelegation 验证委托:Use Get-AzDelegation to verify the delegation:

  $subnet = Get-AzVirtualNetwork -Name "myVnet" -ResourceGroupName "myResourceGroup" | Get-AzVirtualNetworkSubnetConfig -Name "mySubnet"
  Get-AzDelegation -Name "myDelegation" -Subnet $subnet

  ProvisioningState : Succeeded
  ServiceName       : Microsoft.DBforPostgreSQL/serversv2
  Actions           : {Microsoft.Network/virtualNetworks/subnets/join/action}
  Name              : myDelegation
  Etag              : W/"9cba4b0e-2ceb-444b-b553-454f8da07d8a"
  Id                : /subscriptions/3bf09329-ca61-4fee-88cb-7e30b9ee305b/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVnet/subnets/mySubnet/delegations/myDelegation

从 Azure 服务中删除子网委托Remove subnet delegation from an Azure service

使用 Remove-AzDelegation 从名为 mySubnet 的子网中删除委托:Use Remove-AzDelegation to remove the delegation from the subnet named mySubnet:

  $vnet = Get-AzVirtualNetwork -Name "myVnet" -ResourceGroupName "myResourceGroup"
  $subnet = Get-AzVirtualNetworkSubnetConfig -Name "mySubnet" -VirtualNetwork $vnet
  $subnet = Remove-AzDelegation -Name "myDelegation" -Subnet $subnet
  Set-AzVirtualNetwork -VirtualNetwork $vnet

使用 Get-AzDelegation 验证是否已删除委托:Use Get-AzDelegation to verify the delegation was removed:

  $subnet = Get-AzVirtualNetwork -Name "myVnet" -ResourceGroupName "myResourceGroup" | Get-AzVirtualNetworkSubnetConfig -Name "mySubnet"
  Get-AzDelegation -Name "myDelegation" -Subnet $subnet

  Get-AzDelegation: Sequence contains no matching element

后续步骤Next steps