添加或删除子网委托Add or remove a subnet delegation

子网委派为服务提供了显式权限,以便能够在部署服务时使用唯一标识符在子网中创建服务专属资源。Subnet delegation gives explicit permissions to the service to create service-specific resources in the subnet using a unique identifier when deploying the service. 本文介绍如何添加或删除为 Azure 服务委托的子网。This article describes how to add or remove a delegated subnet for an Azure service.

Azure PowerShellAzure PowerShell

备注

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

连接到 AzureConnect to Azure

  Connect-AzAccount -Environment AzureChinaCloud

创建资源组Create a resource group

使用 New-AzResourceGroup 创建资源组。Create a resource group with New-AzResourceGroup. Azure 资源组是在其中部署和管理 Azure 资源的逻辑容器。An Azure resource group is a logical container into which Azure resources are deployed and managed.

以下示例在“chinaeast”位置创建名为“myResourceGroup”的资源组:The following example creates a resource group named myResourceGroup in the chinaeast location:

  New-AzResourceGroup -Name myResourceGroup -Location chinaeast

创建虚拟网络Create virtual network

使用 New-AzVirtualNetworkmyResourceGroup 中创建名为 myVnet 的虚拟网络,该虚拟网络包含使用 New-AzVirtualNetworkSubnetConfig 配置的名为 mySubnet 的子网。Create a virtual network named myVnet with a subnet named mySubnet using New-AzVirtualNetworkSubnetConfig in the myResourceGroup using New-AzVirtualNetwork. 虚拟网络的 IP 地址空间是 10.0.0.0/16The IP address space for the virtual network is 10.0.0.0/16. 虚拟网络中的子网是 10.0.0.0/24The subnet within the virtual network is 10.0.0.0/24.

  $subnet = New-AzVirtualNetworkSubnetConfig -Name mySubnet -AddressPrefix "10.0.0.0/24"

  New-AzVirtualNetwork -Name myVnet -ResourceGroupName myResourceGroup -Location chinaeast -AddressPrefix "10.0.0.0/16" -Subnet $subnet

权限Permissions

如果没有创建要委托给 Azure 服务的子网,则需要以下权限:Microsoft.Network/virtualNetworks/subnets/writeIf you didn't create the subnet you would like to delegate to an Azure service, you need the following permission: Microsoft.Network/virtualNetworks/subnets/write.

内置的网络参与者角色也包含必需的权限。The built-in Network Contributor role also contains the necessary permissions.

将子网委托给 Azure 服务Delegate a subnet to an Azure service

在此部分,我们将上一部分创建的子网委托给 Azure 服务。In this section, you delegate the subnet that you created in the preceding section to an Azure service.

请使用 Add-AzDelegation 通过名为 myDelegation 的委托(委托到 Azure 服务)对名为 mySubnet 的子网进行更新。Use Add-AzDelegation to update the subnet named mySubnet with a delegation named myDelegation to an Azure service. 在此示例中,Microsoft.DBforPostgreSQL/serversv2 用于示例委托:In this example Microsoft.DBforPostgreSQL/serversv2 is used for the example delegation:

  $vnet = Get-AzVirtualNetwork -Name "myVNet" -ResourceGroupName "myResourceGroup"
  $subnet = Get-AzVirtualNetworkSubnetConfig -Name "mySubnet" -VirtualNetwork $vnet
  $subnet = Add-AzDelegation -Name "myDelegation" -ServiceName "Microsoft.DBforPostgreSQL/serversv2" -Subnet $subnet
  Set-AzVirtualNetwork -VirtualNetwork $vnet

使用 Get-AzDelegation 验证委托:Use Get-AzDelegation to verify the delegation:

  $subnet = Get-AzVirtualNetwork -Name "myVnet" -ResourceGroupName "myResourceGroup" | Get-AzVirtualNetworkSubnetConfig -Name "mySubnet"
  Get-AzDelegation -Name "myDelegation" -Subnet $subnet

  ProvisioningState : Succeeded
  ServiceName       : Microsoft.DBforPostgreSQL/serversv2
  Actions           : {Microsoft.Network/virtualNetworks/subnets/join/action}
  Name              : myDelegation
  Etag              : W/"9cba4b0e-2ceb-444b-b553-454f8da07d8a"
  Id                : /subscriptions/3bf09329-ca61-4fee-88cb-7e30b9ee305b/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVnet/subnets/mySubnet/delegations/myDelegation

从 Azure 服务中删除子网委托Remove subnet delegation from an Azure service

使用 Remove-AzDelegation 从名为 mySubnet 的子网中删除委托:Use Remove-AzDelegation to remove the delegation from the subnet named mySubnet:

  $vnet = Get-AzVirtualNetwork -Name "myVnet" -ResourceGroupName "myResourceGroup"
  $subnet = Get-AzVirtualNetworkSubnetConfig -Name "mySubnet" -VirtualNetwork $vnet
  $subnet = Remove-AzDelegation -Name "myDelegation" -Subnet $subnet
  Set-AzVirtualNetwork -VirtualNetwork $vnet

使用 Get-AzDelegation 验证是否已删除委托:Use Get-AzDelegation to verify the delegation was removed:

  $subnet = Get-AzVirtualNetwork -Name "myVnet" -ResourceGroupName "myResourceGroup" | Get-AzVirtualNetworkSubnetConfig -Name "mySubnet"
  Get-AzDelegation -Name "myDelegation" -Subnet $subnet

  Get-AzDelegation: Sequence contains no matching element

后续步骤Next steps