reorganize, add scaffold folder

update readmes

clean up tf provider

add readme and initial templates

add initial pass at readmes

more readme updates

update various quickstarts

finish cleaning up 101s

more updates

lots fo template updates

add remaining

more updates
This commit is contained in:
Joey Lorich 2019-10-15 13:03:36 -06:00 committed by Joey Lorich
parent fa82feccc7
commit 415e3caa97
89 changed files with 7503 additions and 1140 deletions

580
.gitignore vendored
View File

@ -1,288 +1,292 @@
## Ignore Visual Studio temporary files, build results, and
## files generated by popular Visual Studio add-ons.
##
## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
# User-specific files
*.suo
*.user
*.userosscache
*.sln.docstates
# User-specific files (MonoDevelop/Xamarin Studio)
*.userprefs
# Build results
[Dd]ebug/
[Dd]ebugPublic/
[Rr]elease/
[Rr]eleases/
x64/
x86/
bld/
[Bb]in/
[Oo]bj/
[Ll]og/
# Visual Studio 2015 cache/options directory
.vs/
# Uncomment if you have tasks that create the project's static files in wwwroot
#wwwroot/
# MSTest test Results
[Tt]est[Rr]esult*/
[Bb]uild[Ll]og.*
# NUNIT
*.VisualState.xml
TestResult.xml
# Build Results of an ATL Project
[Dd]ebugPS/
[Rr]eleasePS/
dlldata.c
# .NET Core
project.lock.json
project.fragment.lock.json
artifacts/
**/Properties/launchSettings.json
*_i.c
*_p.c
*_i.h
*.ilk
*.meta
*.obj
*.pch
*.pdb
*.pgc
*.pgd
*.rsp
*.sbr
*.tlb
*.tli
*.tlh
*.tmp
*.tmp_proj
*.log
*.vspscc
*.vssscc
.builds
*.pidb
*.svclog
*.scc
# Chutzpah Test files
_Chutzpah*
# Visual C++ cache files
ipch/
*.aps
*.ncb
*.opendb
*.opensdf
*.sdf
*.cachefile
*.VC.db
*.VC.VC.opendb
# Visual Studio profiler
*.psess
*.vsp
*.vspx
*.sap
# TFS 2012 Local Workspace
$tf/
# Guidance Automation Toolkit
*.gpState
# ReSharper is a .NET coding add-in
_ReSharper*/
*.[Rr]e[Ss]harper
*.DotSettings.user
# JustCode is a .NET coding add-in
.JustCode
# TeamCity is a build add-in
_TeamCity*
# DotCover is a Code Coverage Tool
*.dotCover
# Visual Studio code coverage results
*.coverage
*.coveragexml
# NCrunch
_NCrunch_*
.*crunch*.local.xml
nCrunchTemp_*
# MightyMoose
*.mm.*
AutoTest.Net/
# Web workbench (sass)
.sass-cache/
# Installshield output folder
[Ee]xpress/
# DocProject is a documentation generator add-in
DocProject/buildhelp/
DocProject/Help/*.HxT
DocProject/Help/*.HxC
DocProject/Help/*.hhc
DocProject/Help/*.hhk
DocProject/Help/*.hhp
DocProject/Help/Html2
DocProject/Help/html
# Click-Once directory
publish/
# Publish Web Output
*.[Pp]ublish.xml
*.azurePubxml
# TODO: Comment the next line if you want to checkin your web deploy settings
# but database connection strings (with potential passwords) will be unencrypted
*.pubxml
*.publishproj
# Microsoft Azure Web App publish settings. Comment the next line if you want to
# checkin your Azure Web App publish settings, but sensitive information contained
# in these scripts will be unencrypted
PublishScripts/
# NuGet Packages
*.nupkg
# The packages folder can be ignored because of Package Restore
**/packages/*
# except build/, which is used as an MSBuild target.
!**/packages/build/
# Uncomment if necessary however generally it will be regenerated when needed
#!**/packages/repositories.config
# NuGet v3's project.json files produces more ignorable files
*.nuget.props
*.nuget.targets
# Microsoft Azure Build Output
csx/
*.build.csdef
# Microsoft Azure Emulator
ecf/
rcf/
# Windows Store app package directories and files
AppPackages/
BundleArtifacts/
Package.StoreAssociation.xml
_pkginfo.txt
# Visual Studio cache files
# files ending in .cache can be ignored
*.[Cc]ache
# but keep track of directories ending in .cache
!*.[Cc]ache/
# Others
ClientBin/
~$*
*~
*.dbmdl
*.dbproj.schemaview
*.jfm
*.pfx
*.publishsettings
orleans.codegen.cs
# Since there are multiple workflows, uncomment next line to ignore bower_components
# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
#bower_components/
# RIA/Silverlight projects
Generated_Code/
# Backup & report files from converting an old project file
# to a newer Visual Studio version. Backup files are not needed,
# because we have git ;-)
_UpgradeReport_Files/
Backup*/
UpgradeLog*.XML
UpgradeLog*.htm
# SQL Server files
*.mdf
*.ldf
*.ndf
# Business Intelligence projects
*.rdl.data
*.bim.layout
*.bim_*.settings
# Microsoft Fakes
FakesAssemblies/
# GhostDoc plugin setting file
*.GhostDoc.xml
# Node.js Tools for Visual Studio
.ntvs_analysis.dat
node_modules/
# Typescript v1 declaration files
typings/
# Visual Studio 6 build log
*.plg
# Visual Studio 6 workspace options file
*.opt
# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
*.vbw
# Visual Studio LightSwitch build output
**/*.HTMLClient/GeneratedArtifacts
**/*.DesktopClient/GeneratedArtifacts
**/*.DesktopClient/ModelManifest.xml
**/*.Server/GeneratedArtifacts
**/*.Server/ModelManifest.xml
_Pvt_Extensions
# Paket dependency manager
.paket/paket.exe
paket-files/
# FAKE - F# Make
.fake/
# JetBrains Rider
.idea/
*.sln.iml
# CodeRush
.cr/
# Python Tools for Visual Studio (PTVS)
__pycache__/
*.pyc
# Cake - Uncomment if you are using it
# tools/**
# !tools/packages.config
# Telerik's JustMock configuration file
*.jmconfig
# BizTalk build output
*.btp.cs
*.btm.cs
*.odx.cs
*.xsd.cs
## Ignore terraform provider and state files
*.terraform
*.tfstate
## Ignore Visual Studio temporary files, build results, and
## files generated by popular Visual Studio add-ons.
##
## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
# User-specific files
*.suo
*.user
*.userosscache
*.sln.docstates
# User-specific files (MonoDevelop/Xamarin Studio)
*.userprefs
# Build results
[Dd]ebug/
[Dd]ebugPublic/
[Rr]elease/
[Rr]eleases/
x64/
x86/
bld/
[Bb]in/
[Oo]bj/
[Ll]og/
# Visual Studio 2015 cache/options directory
.vs/
# Uncomment if you have tasks that create the project's static files in wwwroot
#wwwroot/
# MSTest test Results
[Tt]est[Rr]esult*/
[Bb]uild[Ll]og.*
# NUNIT
*.VisualState.xml
TestResult.xml
# Build Results of an ATL Project
[Dd]ebugPS/
[Rr]eleasePS/
dlldata.c
# .NET Core
project.lock.json
project.fragment.lock.json
artifacts/
**/Properties/launchSettings.json
*_i.c
*_p.c
*_i.h
*.ilk
*.meta
*.obj
*.pch
*.pdb
*.pgc
*.pgd
*.rsp
*.sbr
*.tlb
*.tli
*.tlh
*.tmp
*.tmp_proj
*.log
*.vspscc
*.vssscc
.builds
*.pidb
*.svclog
*.scc
# Chutzpah Test files
_Chutzpah*
# Visual C++ cache files
ipch/
*.aps
*.ncb
*.opendb
*.opensdf
*.sdf
*.cachefile
*.VC.db
*.VC.VC.opendb
# Visual Studio profiler
*.psess
*.vsp
*.vspx
*.sap
# TFS 2012 Local Workspace
$tf/
# Guidance Automation Toolkit
*.gpState
# ReSharper is a .NET coding add-in
_ReSharper*/
*.[Rr]e[Ss]harper
*.DotSettings.user
# JustCode is a .NET coding add-in
.JustCode
# TeamCity is a build add-in
_TeamCity*
# DotCover is a Code Coverage Tool
*.dotCover
# Visual Studio code coverage results
*.coverage
*.coveragexml
# NCrunch
_NCrunch_*
.*crunch*.local.xml
nCrunchTemp_*
# MightyMoose
*.mm.*
AutoTest.Net/
# Web workbench (sass)
.sass-cache/
# Installshield output folder
[Ee]xpress/
# DocProject is a documentation generator add-in
DocProject/buildhelp/
DocProject/Help/*.HxT
DocProject/Help/*.HxC
DocProject/Help/*.hhc
DocProject/Help/*.hhk
DocProject/Help/*.hhp
DocProject/Help/Html2
DocProject/Help/html
# Click-Once directory
publish/
# Publish Web Output
*.[Pp]ublish.xml
*.azurePubxml
# TODO: Comment the next line if you want to checkin your web deploy settings
# but database connection strings (with potential passwords) will be unencrypted
*.pubxml
*.publishproj
# Microsoft Azure Web App publish settings. Comment the next line if you want to
# checkin your Azure Web App publish settings, but sensitive information contained
# in these scripts will be unencrypted
PublishScripts/
# NuGet Packages
*.nupkg
# The packages folder can be ignored because of Package Restore
**/packages/*
# except build/, which is used as an MSBuild target.
!**/packages/build/
# Uncomment if necessary however generally it will be regenerated when needed
#!**/packages/repositories.config
# NuGet v3's project.json files produces more ignorable files
*.nuget.props
*.nuget.targets
# Microsoft Azure Build Output
csx/
*.build.csdef
# Microsoft Azure Emulator
ecf/
rcf/
# Windows Store app package directories and files
AppPackages/
BundleArtifacts/
Package.StoreAssociation.xml
_pkginfo.txt
# Visual Studio cache files
# files ending in .cache can be ignored
*.[Cc]ache
# but keep track of directories ending in .cache
!*.[Cc]ache/
# Others
ClientBin/
~$*
*~
*.dbmdl
*.dbproj.schemaview
*.jfm
*.pfx
*.publishsettings
orleans.codegen.cs
# Since there are multiple workflows, uncomment next line to ignore bower_components
# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
#bower_components/
# RIA/Silverlight projects
Generated_Code/
# Backup & report files from converting an old project file
# to a newer Visual Studio version. Backup files are not needed,
# because we have git ;-)
_UpgradeReport_Files/
Backup*/
UpgradeLog*.XML
UpgradeLog*.htm
# SQL Server files
*.mdf
*.ldf
*.ndf
# Business Intelligence projects
*.rdl.data
*.bim.layout
*.bim_*.settings
# Microsoft Fakes
FakesAssemblies/
# GhostDoc plugin setting file
*.GhostDoc.xml
# Node.js Tools for Visual Studio
.ntvs_analysis.dat
node_modules/
# Typescript v1 declaration files
typings/
# Visual Studio 6 build log
*.plg
# Visual Studio 6 workspace options file
*.opt
# Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
*.vbw
# Visual Studio LightSwitch build output
**/*.HTMLClient/GeneratedArtifacts
**/*.DesktopClient/GeneratedArtifacts
**/*.DesktopClient/ModelManifest.xml
**/*.Server/GeneratedArtifacts
**/*.Server/ModelManifest.xml
_Pvt_Extensions
# Paket dependency manager
.paket/paket.exe
paket-files/
# FAKE - F# Make
.fake/
# JetBrains Rider
.idea/
*.sln.iml
# CodeRush
.cr/
# Python Tools for Visual Studio (PTVS)
__pycache__/
*.pyc
# Cake - Uncomment if you are using it
# tools/**
# !tools/packages.config
# Telerik's JustMock configuration file
*.jmconfig
# BizTalk build output
*.btp.cs
*.btm.cs
*.odx.cs
*.xsd.cs

208
.gitmodules vendored
View File

@ -1,104 +1,104 @@
[submodule "provider/terraform-provider-azurerm"]
path = provider/terraform-provider-azurerm
url = git@github.com:terraform-providers/terraform-provider-azurerm.git
branch = master
[submodule "module/terraform-azurerm-compute"]
path = module/terraform-azurerm-compute
url = git@github.com:Azure/terraform-azurerm-compute.git
branch = master
[submodule "module/terraform-azurerm-network"]
path = module/terraform-azurerm-network
url = git@github.com:Azure/terraform-azurerm-network.git
branch = master
[submodule "module/terraform-azurerm-database"]
path = module/terraform-azurerm-database
url = git@github.com:Azure/terraform-azurerm-database.git
branch = master
[submodule "module/terraform-azurerm-loadbalancer"]
path = module/terraform-azurerm-loadbalancer
url = git@github.com:Azure/terraform-azurerm-loadbalancer.git
branch = master
[submodule "module/terraform-azurerm-computegroup"]
path = module/terraform-azurerm-computegroup
url = git@github.com:Azure/terraform-azurerm-computegroup.git
branch = master
[submodule "module/terraform-azurerm-network-security-group"]
path = module/terraform-azurerm-network-security-group
url = git@github.com:Azure/terraform-azurerm-network-security-group.git
branch = master
[submodule "module/terraform-azurerm-manageddisk"]
path = module/terraform-azurerm-manageddisk
url = git@github.com:Azure/terraform-azurerm-manageddisk.git
branch = master
[submodule "module/terraform-azurerm-vm"]
path = module/terraform-azurerm-vm
url = git@github.com:Azure/terraform-azurerm-vm.git
branch = master
[submodule "module/terraform-azurerm-vmss-cloudinit"]
path = module/terraform-azurerm-vmss-cloudinit
url = git@github.com:Azure/terraform-azurerm-vmss-cloudinit.git
branch = master
[submodule "module/terraform-azurerm-vnet"]
path = module/terraform-azurerm-vnet
url = git@github.com:Azure/terraform-azurerm-vnet.git
branch = master
[submodule "module/terraform-azurerm-encryptedmanageddisk"]
path = module/terraform-azurerm-encryptedmanageddisk
url = git@github.com:Azure/terraform-azurerm-encryptedmanageddisk.git
branch = master
[submodule "module/terraform-azurerm-diskencrypt"]
path = module/terraform-azurerm-diskencrypt
url = git@github.com:Azure/terraform-azurerm-diskencrypt.git
branch = master
[submodule "module/terraform-azurerm-postgresql"]
path = module/terraform-azurerm-postgresql
url = git@github.com:Azure/terraform-azurerm-postgresql.git
branch = master
[submodule "module/terraform-azurerm-storage-account"]
path = module/terraform-azurerm-storage-account
url = git@github.com:Azure/terraform-azurerm-storage-account.git
branch = master
[submodule "module/terraform-azurerm-routetable"]
path = module/terraform-azurerm-routetable
url = git@github.com:Azure/terraform-azurerm-routetable.git
branch = master
[submodule "module/terraform-azurerm-search-service"]
path = module/terraform-azurerm-search-service
url = git@github.com:Azure/terraform-azurerm-search-service.git
branch = master
[submodule "module/terraform-azurerm-vnetpeering"]
path = module/terraform-azurerm-vnetpeering
url = git@github.com:Azure/terraform-azurerm-vnetpeering.git
branch = master
[submodule "module/terraform-azurerm-aks"]
path = module/terraform-azurerm-aks
url = git@github.com:Azure/terraform-azurerm-aks.git
branch = master
[submodule "module/terraform-azurerm-consul"]
path = module/terraform-azurerm-consul
url = git@github.com:Azure/terraform-azurerm-consul.git
branch = master
[submodule "module/terraform-azurerm-aci"]
path = module/terraform-azurerm-aci
url = git@github.com:Azure/terraform-azurerm-aci.git
branch = master
[submodule "module/terraform-azurerm-disk-snapshot"]
path = module/terraform-azurerm-disk-snapshot
url = git@github.com:Azure/terraform-azurerm-disk-snapshot.git
branch = master
[submodule "module/terraform-azurerm-resource-group"]
path = module/terraform-azurerm-resource-group
url = git@github.com:Azure/terraform-azurerm-resource-group.git
branch = master
[submodule "module/terraform-azurerm-vm-extension-msi"]
path = module/terraform-azurerm-vm-extension-msi
url = git@github.com:Azure/terraform-azurerm-vm-extension-msi.git
branch = master
[submodule "module/terraform-azurerm-application-security-group"]
path = module/terraform-azurerm-application-security-group
url = git@github.com:Azure/terraform-azurerm-application-security-group.git
branch = master
[submodule "module/terraform-azurerm-module-test-jenkins"]
path = module/terraform-azurerm-module-test-jenkins
url = git@github.com:Azure/terraform-azurerm-module-test-jenkins.git
branch = master
[submodule "provider/terraform-provider-azurerm"]
path = provider/terraform-provider-azurerm
url = git@github.com:terraform-providers/terraform-provider-azurerm.git
branch = master
[submodule "module/terraform-azurerm-compute"]
path = module/terraform-azurerm-compute
url = git@github.com:Azure/terraform-azurerm-compute.git
branch = master
[submodule "module/terraform-azurerm-network"]
path = module/terraform-azurerm-network
url = git@github.com:Azure/terraform-azurerm-network.git
branch = master
[submodule "module/terraform-azurerm-database"]
path = module/terraform-azurerm-database
url = git@github.com:Azure/terraform-azurerm-database.git
branch = master
[submodule "module/terraform-azurerm-loadbalancer"]
path = module/terraform-azurerm-loadbalancer
url = git@github.com:Azure/terraform-azurerm-loadbalancer.git
branch = master
[submodule "module/terraform-azurerm-computegroup"]
path = module/terraform-azurerm-computegroup
url = git@github.com:Azure/terraform-azurerm-computegroup.git
branch = master
[submodule "module/terraform-azurerm-network-security-group"]
path = module/terraform-azurerm-network-security-group
url = git@github.com:Azure/terraform-azurerm-network-security-group.git
branch = master
[submodule "module/terraform-azurerm-manageddisk"]
path = module/terraform-azurerm-manageddisk
url = git@github.com:Azure/terraform-azurerm-manageddisk.git
branch = master
[submodule "module/terraform-azurerm-vm"]
path = module/terraform-azurerm-vm
url = git@github.com:Azure/terraform-azurerm-vm.git
branch = master
[submodule "module/terraform-azurerm-vmss-cloudinit"]
path = module/terraform-azurerm-vmss-cloudinit
url = git@github.com:Azure/terraform-azurerm-vmss-cloudinit.git
branch = master
[submodule "module/terraform-azurerm-vnet"]
path = module/terraform-azurerm-vnet
url = git@github.com:Azure/terraform-azurerm-vnet.git
branch = master
[submodule "module/terraform-azurerm-encryptedmanageddisk"]
path = module/terraform-azurerm-encryptedmanageddisk
url = git@github.com:Azure/terraform-azurerm-encryptedmanageddisk.git
branch = master
[submodule "module/terraform-azurerm-diskencrypt"]
path = module/terraform-azurerm-diskencrypt
url = git@github.com:Azure/terraform-azurerm-diskencrypt.git
branch = master
[submodule "module/terraform-azurerm-postgresql"]
path = module/terraform-azurerm-postgresql
url = git@github.com:Azure/terraform-azurerm-postgresql.git
branch = master
[submodule "module/terraform-azurerm-storage-account"]
path = module/terraform-azurerm-storage-account
url = git@github.com:Azure/terraform-azurerm-storage-account.git
branch = master
[submodule "module/terraform-azurerm-routetable"]
path = module/terraform-azurerm-routetable
url = git@github.com:Azure/terraform-azurerm-routetable.git
branch = master
[submodule "module/terraform-azurerm-search-service"]
path = module/terraform-azurerm-search-service
url = git@github.com:Azure/terraform-azurerm-search-service.git
branch = master
[submodule "module/terraform-azurerm-vnetpeering"]
path = module/terraform-azurerm-vnetpeering
url = git@github.com:Azure/terraform-azurerm-vnetpeering.git
branch = master
[submodule "module/terraform-azurerm-aks"]
path = module/terraform-azurerm-aks
url = git@github.com:Azure/terraform-azurerm-aks.git
branch = master
[submodule "module/terraform-azurerm-consul"]
path = module/terraform-azurerm-consul
url = git@github.com:Azure/terraform-azurerm-consul.git
branch = master
[submodule "module/terraform-azurerm-aci"]
path = module/terraform-azurerm-aci
url = git@github.com:Azure/terraform-azurerm-aci.git
branch = master
[submodule "module/terraform-azurerm-disk-snapshot"]
path = module/terraform-azurerm-disk-snapshot
url = git@github.com:Azure/terraform-azurerm-disk-snapshot.git
branch = master
[submodule "module/terraform-azurerm-resource-group"]
path = module/terraform-azurerm-resource-group
url = git@github.com:Azure/terraform-azurerm-resource-group.git
branch = master
[submodule "module/terraform-azurerm-vm-extension-msi"]
path = module/terraform-azurerm-vm-extension-msi
url = git@github.com:Azure/terraform-azurerm-vm-extension-msi.git
branch = master
[submodule "module/terraform-azurerm-application-security-group"]
path = module/terraform-azurerm-application-security-group
url = git@github.com:Azure/terraform-azurerm-application-security-group.git
branch = master
[submodule "module/terraform-azurerm-module-test-jenkins"]
path = module/terraform-azurerm-module-test-jenkins
url = git@github.com:Azure/terraform-azurerm-module-test-jenkins.git
branch = master

42
LICENSE
View File

@ -1,21 +1,21 @@
MIT License
Copyright (c) Microsoft Corporation. All rights reserved.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
MIT License
Copyright (c) Microsoft Corporation. All rights reserved.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE

View File

@ -1,24 +1,24 @@
# Contributing
This project welcomes contributions and suggestions.
## Modules
Module summary
[Module contribution guide](./module/CONTRIBUTE.md)
## Providers
Provider summary
[Provider contribution guide](./provider/CONTRIBUTE.md)
# Contributing
This project welcomes contributions and suggestions. Most contributions require you to agree to a
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
the rights to use your contribution. For details, visit https://cla.microsoft.com.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide
a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions
provided by the bot. You will only need to do this once across all repos using our CLA.
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
# Contributing
This project welcomes contributions and suggestions.
## Modules
Module summary
[Module contribution guide](./module/CONTRIBUTE.md)
## Providers
Provider summary
[Provider contribution guide](./provider/CONTRIBUTE.md)
# Contributing
This project welcomes contributions and suggestions. Most contributions require you to agree to a
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
the rights to use your contribution. For details, visit https://cla.microsoft.com.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide
a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions
provided by the bot. You will only need to do this once across all repos using our CLA.
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.

View File

@ -1,37 +1,37 @@
# Contribute to Terraform Modules Registry
This document describes the basic process of authoring and contributing re-usable, verifiable Terraform templates to Terraform Registry (https://registry.terraform.io). Terraform Registry serves as a centralized location to discover, learn and use Terraform artifacts to provision infrastructure into Azure, as well as into other cloud platforms.
## Basic Steps
Below are the basic steps to create and publish a verified Azure module into the Terraform Registry:
1. Following best practices for Terraform template authoring, create a template deploying infrastructure components into Azure.
2. Create a set of tests verifying correctness of Terraform template created in Step 1.
3. Set up a basic Azure DevOps pipeline for Continuous Integration and Deployment, including running the tests created in Step 2 above.
4. Using your GitHub credentials, sign into Terraform Registry and publish your module.
While Steps 2 and 3 are not a requirement for Terraform Registry, we strongly encourage all modules published as "Azure Verified" to include those steps.
### Step 1 - Creating Terraform template
While Terraform offers an easy-to-create, easy-to-understand template authoring language in the form HCL, creating components that could be re-usable is often a time-consuming art form. With Terraform Registry, you are forced to think about various customer scenarios a template could be deployed with, and the permutation of various use cases could be daunting. While it is impossible to anticipate all the scenarios, we recommend that you familiarize yourself with a [set of Terraform Best Practices] (https://www.terraform.io/docs/enterprise/guides/recommended-practices/index.html) published by HashiCorp. Then, think through the most common use cases your module would likely serve, and try to author it in such a way that it will accommodate a set of those scenarios (as opposed to being strongly coupled to a single use case).
We have [created and documented a tool](https://docs.microsoft.com/en-us/azure/terraform/terraform-vscode-module-generator) that builds basic scaffolding for an Azure module, including a sample test. You are also welcome to clone one of the [existing modules] (https://github.com/Azure/terraform-azurerm-postgresql), providing you a set of Terraform files that you can customize for your module.
### Step 2 - Create a set of tests
After experimenting with several approaches for testing Terraform modules, we have settled on using [Terratest](https://github.com/gruntwork-io/terratest). The benefits of Terratest are its ease of integration with CI/CD tooling, as well its similarity to native [Terraform acceptance testing](https://github.com/hashicorp/terraform/blob/master/.github/CONTRIBUTING.md#writing-an-acceptance-test) framework. You will, however, need to be familiar with Go to create tests using Terratest.
If you used [Module Generator](https://docs.microsoft.com/en-us/azure/terraform/terraform-vscode-module-generator) in Step 1, a default test using Terratest is created for you in the test folder. You will need to think through additional tests that you can create that verify correctness of your template.
### Step 3 - Integrate with Azure DevOps
As you introduce changes to the module, or approve pull requests, you'd like to be certain that new changes did not break the functionality the users have become dependent on. This is where CI/CD integration comes in. Integration with Azure DevOps is straightforward to setup - you will need to make sure you have an [azure-pipelines.yml](https://github.com/Azure/terraform-azurerm-postgresql/blob/master/azure-pipelines.yml) in your repo, as well as add the [test.sh](https://github.com/Azure/terraform-azurerm-postgresql/blob/master/test.sh) file to the root of the repo.
The pipelines file is very generic - it builds a docker container and then calls into test.sh for Terratest execution. The only thing you will change in that file is the imageName variable - this will be the docker image name that the pipeline will create. The test.sh file is generic and stays as is, calling all of the test methods that were authored in Step 2.
After your pipelines succeed, please send a request to Terraform on Azure distribution list to pull this pipeline into Terraform ADO environment.
### Step 4 - Publish Module to Terraform Registry
This is the easiest step of all. Simply sign into [Terraform Registry](https://registry.terraform.io) using your GitHub credentials, then click on Publish in the top right corner. Select the repo to publish, then click publish to complete the process.
After your module has been published, please send a request to Terraform on Azure distribution list to enusre we add an "Azure Verified" check box next to the module you've created.
# Contribute to Terraform Modules Registry
This document describes the basic process of authoring and contributing re-usable, verifiable Terraform templates to Terraform Registry (https://registry.terraform.io). Terraform Registry serves as a centralized location to discover, learn and use Terraform artifacts to provision infrastructure into Azure, as well as into other cloud platforms.
## Basic Steps
Below are the basic steps to create and publish a verified Azure module into the Terraform Registry:
1. Following best practices for Terraform template authoring, create a template deploying infrastructure components into Azure.
2. Create a set of tests verifying correctness of Terraform template created in Step 1.
3. Set up a basic Azure DevOps pipeline for Continuous Integration and Deployment, including running the tests created in Step 2 above.
4. Using your GitHub credentials, sign into Terraform Registry and publish your module.
While Steps 2 and 3 are not a requirement for Terraform Registry, we strongly encourage all modules published as "Azure Verified" to include those steps.
### Step 1 - Creating Terraform template
While Terraform offers an easy-to-create, easy-to-understand template authoring language in the form HCL, creating components that could be re-usable is often a time-consuming art form. With Terraform Registry, you are forced to think about various customer scenarios a template could be deployed with, and the permutation of various use cases could be daunting. While it is impossible to anticipate all the scenarios, we recommend that you familiarize yourself with a [set of Terraform Best Practices] (https://www.terraform.io/docs/enterprise/guides/recommended-practices/index.html) published by HashiCorp. Then, think through the most common use cases your module would likely serve, and try to author it in such a way that it will accommodate a set of those scenarios (as opposed to being strongly coupled to a single use case).
We have [created and documented a tool](https://docs.microsoft.com/en-us/azure/terraform/terraform-vscode-module-generator) that builds basic scaffolding for an Azure module, including a sample test. You are also welcome to clone one of the [existing modules] (https://github.com/Azure/terraform-azurerm-postgresql), providing you a set of Terraform files that you can customize for your module.
### Step 2 - Create a set of tests
After experimenting with several approaches for testing Terraform modules, we have settled on using [Terratest](https://github.com/gruntwork-io/terratest). The benefits of Terratest are its ease of integration with CI/CD tooling, as well its similarity to native [Terraform acceptance testing](https://github.com/hashicorp/terraform/blob/master/.github/CONTRIBUTING.md#writing-an-acceptance-test) framework. You will, however, need to be familiar with Go to create tests using Terratest.
If you used [Module Generator](https://docs.microsoft.com/en-us/azure/terraform/terraform-vscode-module-generator) in Step 1, a default test using Terratest is created for you in the test folder. You will need to think through additional tests that you can create that verify correctness of your template.
### Step 3 - Integrate with Azure DevOps
As you introduce changes to the module, or approve pull requests, you'd like to be certain that new changes did not break the functionality the users have become dependent on. This is where CI/CD integration comes in. Integration with Azure DevOps is straightforward to setup - you will need to make sure you have an [azure-pipelines.yml](https://github.com/Azure/terraform-azurerm-postgresql/blob/master/azure-pipelines.yml) in your repo, as well as add the [test.sh](https://github.com/Azure/terraform-azurerm-postgresql/blob/master/test.sh) file to the root of the repo.
The pipelines file is very generic - it builds a docker container and then calls into test.sh for Terratest execution. The only thing you will change in that file is the imageName variable - this will be the docker image name that the pipeline will create. The test.sh file is generic and stays as is, calling all of the test methods that were authored in Step 2.
After your pipelines succeed, please send a request to Terraform on Azure distribution list to pull this pipeline into Terraform ADO environment.
### Step 4 - Publish Module to Terraform Registry
This is the easiest step of all. Simply sign into [Terraform Registry](https://registry.terraform.io) using your GitHub credentials, then click on Publish in the top right corner. Select the repo to publish, then click publish to complete the process.
After your module has been published, please send a request to Terraform on Azure distribution list to enusre we add an "Azure Verified" check box next to the module you've created.

View File

@ -0,0 +1,13 @@
provider "azurerm" {
version = "=1.36.0"
}
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "westus"
}
locals {
storage_account_name = "${var.dns_prefix}${var.name}${substr(var.environment, 0, 2)}"
}

View File

@ -0,0 +1,147 @@
# Static website hosted on Azure Storage
This template deploys an [Azure Storage Account](https://www.terraform.io/docs/providers/azurerm/r/storage_account.html) with static website hosting enabled. As this feature is not natively supported throuhg the ARM SDK and hence Terraform, a local-provisioner step is used to enable it with the Azure CLI.
## Resources
| Terraform Resource Type | Description |
| - | - |
| `azurerm_resource_group` | The resource group all resources are deployed into |
| `azurerm_storage_account` | The storage account used to host the website |
## Variables
| Name | Description |
|-|-|
| `name` | Name of the deployment |
| `environment` | The depolyment environment name (used for postfixing resource names) |
| `dns_prefix` | A prefix for globally-unique dns-based resources |
| `location` | The Azure Region to deploy these resources in |
## Example
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus"
+ name = "demo-tfquickstart-dev-rg"
+ tags = (known after apply)
}
# azurerm_storage_account.default will be created
+ resource "azurerm_storage_account" "default" {
+ access_tier = (known after apply)
+ account_encryption_source = "Microsoft.Storage"
+ account_kind = "StorageV2"
+ account_replication_type = "LRS"
+ account_tier = "Standard"
+ account_type = (known after apply)
+ enable_advanced_threat_protection = false
+ enable_blob_encryption = true
+ enable_file_encryption = true
+ enable_https_traffic_only = true
+ id = (known after apply)
+ is_hns_enabled = false
+ location = "westus2"
+ name = "tfquickstartdemode"
+ primary_access_key = (sensitive value)
+ primary_blob_connection_string = (sensitive value)
+ primary_blob_endpoint = (known after apply)
+ primary_blob_host = (known after apply)
+ primary_connection_string = (sensitive value)
+ primary_dfs_endpoint = (known after apply)
+ primary_dfs_host = (known after apply)
+ primary_file_endpoint = (known after apply)
+ primary_file_host = (known after apply)
+ primary_location = (known after apply)
+ primary_queue_endpoint = (known after apply)
+ primary_queue_host = (known after apply)
+ primary_table_endpoint = (known after apply)
+ primary_table_host = (known after apply)
+ primary_web_endpoint = (known after apply)
+ primary_web_host = (known after apply)
+ resource_group_name = "demo-dev-rg"
+ secondary_access_key = (sensitive value)
+ secondary_blob_connection_string = (sensitive value)
+ secondary_blob_endpoint = (known after apply)
+ secondary_blob_host = (known after apply)
+ secondary_connection_string = (sensitive value)
+ secondary_dfs_endpoint = (known after apply)
+ secondary_dfs_host = (known after apply)
+ secondary_file_endpoint = (known after apply)
+ secondary_file_host = (known after apply)
+ secondary_location = (known after apply)
+ secondary_queue_endpoint = (known after apply)
+ secondary_queue_host = (known after apply)
+ secondary_table_endpoint = (known after apply)
+ secondary_table_host = (known after apply)
+ secondary_web_endpoint = (known after apply)
+ secondary_web_host = (known after apply)
+ tags = (known after apply)
+ identity {
+ principal_id = (known after apply)
+ tenant_id = (known after apply)
+ type = (known after apply)
}
+ network_rules {
+ bypass = (known after apply)
+ default_action = (known after apply)
+ ip_rules = (known after apply)
+ virtual_network_subnet_ids = (known after apply)
}
+ queue_properties {
+ cors_rule {
+ allowed_headers = (known after apply)
+ allowed_methods = (known after apply)
+ allowed_origins = (known after apply)
+ exposed_headers = (known after apply)
+ max_age_in_seconds = (known after apply)
}
+ hour_metrics {
+ enabled = (known after apply)
+ include_apis = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
}
+ logging {
+ delete = (known after apply)
+ read = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
+ write = (known after apply)
}
+ minute_metrics {
+ enabled = (known after apply)
+ include_apis = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
}
}
}
Plan: 2 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
```

View File

@ -0,0 +1,14 @@
resource "azurerm_storage_account" "default" {
name = local.storage_account_name
resource_group_name = azurerm_resource_group.default.name
location = "westus2"
account_kind = "StorageV2"
account_tier = "Standard"
account_replication_type = "LRS"
enable_https_traffic_only = true
provisioner "local-exec" {
command = "az storage blob service-properties update --account-name ${azurerm_storage_account.default.name} --static-website --index-document index.html --404-document 404.html"
}
}

View File

@ -0,0 +1,15 @@
variable "environment" {
default = "dev"
}
variable "name" {
default = "demo-tfquickstart"
}
variable "location" {
default = "West US 2"
}
variable "dns_prefix" {
default = "tfq"
}

View File

@ -0,0 +1,31 @@
resource "azurerm_app_service_plan" "default" {
name = "${var.name}-plan"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
kind = "Linux"
# Reserved must be set to true for Linux App Service Plans
reserved = true
sku {
tier = "${var.plan_tier}"
size = "${var.plan_sku}"
}
}
resource "azurerm_app_service" "default" {
name = "${var.dns_prefix}-${var.name}-${var.environment}-app"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
app_service_plan_id = "${azurerm_app_service_plan.default.id}"
site_config {
always_on = true
linux_fx_version = "DOCKER|nginxdemos/hello"
}
identity {
type = "SystemAssigned"
}
}

View File

@ -0,0 +1,8 @@
provider "azurerm" {
version = "=1.36.0"
}
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "${var.location}"
}

View File

@ -0,0 +1,207 @@
# Linux Web App for a containerized application
This template deploys an [Azure App Service](https://www.terraform.io/docs/providers/azurerm/r/app_service.html) running Linux configured for a containerized application.
## Resources
| Terraform Resource Type | Description |
| - | - |
| `azurerm_resource_group` | The resource group all resources are deployed into |
| `azurerm_app_service_plan` | The underlying plan that the web app will run on |
| `azurerm_app_service` | The Linux web app |
## Variables
| Name | Description |
|-|-|
| `name` | Name of the deployment |
| `environment` | The depolyment environment name (used for postfixing resource names) |
| `prefix` | A prefix for globally-unique dns-based resources |
| `location` | The Azure Region to deploy these resources in |
| `plan_tier` | The App Service Plan tier to deploy |
| `plan_sku` | The App Service Plan SKU to deploy|
## Example
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azurerm_app_service.default will be created
+ resource "azurerm_app_service" "default" {
+ app_service_plan_id = (known after apply)
+ app_settings = (known after apply)
+ client_affinity_enabled = (known after apply)
+ default_site_hostname = (known after apply)
+ enabled = true
+ https_only = false
+ id = (known after apply)
+ location = "westus2"
+ name = "tfq-demo-tfquickstart-dev-app"
+ outbound_ip_addresses = (known after apply)
+ possible_outbound_ip_addresses = (known after apply)
+ resource_group_name = "demo-tfquickstart-dev-rg"
+ site_credential = (known after apply)
+ source_control = (known after apply)
+ tags = (known after apply)
+ auth_settings {
+ additional_login_params = (known after apply)
+ allowed_external_redirect_urls = (known after apply)
+ default_provider = (known after apply)
+ enabled = (known after apply)
+ issuer = (known after apply)
+ runtime_version = (known after apply)
+ token_refresh_extension_hours = (known after apply)
+ token_store_enabled = (known after apply)
+ unauthenticated_client_action = (known after apply)
+ active_directory {
+ allowed_audiences = (known after apply)
+ client_id = (known after apply)
+ client_secret = (sensitive value)
}
+ facebook {
+ app_id = (known after apply)
+ app_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ google {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ microsoft {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ twitter {
+ consumer_key = (known after apply)
+ consumer_secret = (sensitive value)
}
}
+ connection_string {
+ name = (known after apply)
+ type = (known after apply)
+ value = (sensitive value)
}
+ identity {
+ identity_ids = (known after apply)
+ principal_id = (known after apply)
+ tenant_id = (known after apply)
+ type = (known after apply)
}
+ logs {
+ application_logs {
+ azure_blob_storage {
+ level = (known after apply)
+ retention_in_days = (known after apply)
+ sas_url = (sensitive value)
}
}
+ http_logs {
+ azure_blob_storage {
+ retention_in_days = (known after apply)
+ sas_url = (sensitive value)
}
+ file_system {
+ retention_in_days = (known after apply)
+ retention_in_mb = (known after apply)
}
}
}
+ site_config {
+ always_on = true
+ dotnet_framework_version = "v4.0"
+ ftps_state = (known after apply)
+ http2_enabled = false
+ ip_restriction = (known after apply)
+ linux_fx_version = "DOCKER|nginxdemos/hello"
+ local_mysql_enabled = (known after apply)
+ managed_pipeline_mode = (known after apply)
+ min_tls_version = (known after apply)
+ remote_debugging_enabled = false
+ remote_debugging_version = (known after apply)
+ scm_type = "None"
+ websockets_enabled = (known after apply)
+ windows_fx_version = (known after apply)
+ cors {
+ allowed_origins = (known after apply)
+ support_credentials = (known after apply)
}
}
+ storage_account {
+ access_key = (sensitive value)
+ account_name = (known after apply)
+ mount_path = (known after apply)
+ name = (known after apply)
+ share_name = (known after apply)
+ type = (known after apply)
}
}
# azurerm_app_service_plan.default will be created
+ resource "azurerm_app_service_plan" "default" {
+ app_service_environment_id = (known after apply)
+ id = (known after apply)
+ kind = "Linux"
+ location = "westus2"
+ maximum_elastic_worker_count = (known after apply)
+ maximum_number_of_workers = (known after apply)
+ name = "demo-tfquickstart-plan"
+ per_site_scaling = (known after apply)
+ reserved = true
+ resource_group_name = "demo-tfquickstart-dev-rg"
+ tags = (known after apply)
+ properties {
+ app_service_environment_id = (known after apply)
+ per_site_scaling = (known after apply)
+ reserved = (known after apply)
}
+ sku {
+ capacity = (known after apply)
+ size = "S1"
+ tier = "Standard"
}
}
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-dev-rg"
+ tags = (known after apply)
}
Plan: 3 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
```

View File

@ -0,0 +1,35 @@
variable "name" {
type = "string"
description = "Location of the azure resource group."
default = "demo-tfquickstart"
}
variable "environment" {
type = "string"
description = "Name of the deployment environment"
default = "dev"
}
variable "location" {
type = "string"
description = "Location to deploy the resoruce group"
default = "West US 2"
}
variable "dns_prefix" {
type = "string"
description = "A prefix for any dns based resources"
default = "tfq"
}
variable "plan_tier" {
type = "string"
description = "The tier of app service plan to create"
default = "Standard"
}
variable "plan_sku" {
type = "string"
description = "The sku of app service plan to create"
default = "S1"
}

View File

@ -0,0 +1,29 @@
resource "azurerm_app_service_plan" "default" {
name = "${var.name}-plan"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
kind = "Linux"
# Reserved must be set to true for Linux App Service Plans
reserved = true
sku {
tier = "${var.plan_tier}"
size = "${var.plan_sku}"
}
}
resource "azurerm_app_service" "default" {
name = "${var.dns_prefix}-${var.name}-${var.environment}-app"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
app_service_plan_id = "${azurerm_app_service_plan.default.id}"
site_config {
always_on = true
java_version = "1.8"
java_container = "tomcat"
java_container_version = "9.0"
}
}

View File

@ -0,0 +1,8 @@
provider "azurerm" {
version = "=1.36.0"
}
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "${var.location}"
}

View File

@ -0,0 +1,210 @@
# Linux Web App for a Java/Tomcat application
This template deploys an [Azure App Service](https://www.terraform.io/docs/providers/azurerm/r/app_service.html) running Linux configured for a Java application hosted with Tomcat.
## Resources
| Terraform Resource Type | Description |
| - | - |
| `azurerm_resource_group` | The resource group all resources are deployed into |
| `azurerm_app_service_plan` | The underlying plan that the web app will run on |
| `azurerm_app_service` | The Linux web app |
## Variables
| Name | Description |
|-|-|
| `name` | Name of the deployment |
| `environment` | The depolyment environment name (used for postfixing resource names) |
| `dns_prefix` | A prefix for globally-unique dns-based resources |
| `location` | The Azure Region to deploy these resources in |
| `plan_tier` | The App Service Plan tier to deploy |
| `plan_sku` | The App Service Plan SKU to deploy|
## Example
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azurerm_app_service.default will be created
+ resource "azurerm_app_service" "default" {
+ app_service_plan_id = (known after apply)
+ app_settings = (known after apply)
+ client_affinity_enabled = (known after apply)
+ default_site_hostname = (known after apply)
+ enabled = true
+ https_only = false
+ id = (known after apply)
+ location = "westus2"
+ name = "tfq-demo-tfquickstart-dev-app"
+ outbound_ip_addresses = (known after apply)
+ possible_outbound_ip_addresses = (known after apply)
+ resource_group_name = "demo-tfquickstart-dev-rg"
+ site_credential = (known after apply)
+ source_control = (known after apply)
+ tags = (known after apply)
+ auth_settings {
+ additional_login_params = (known after apply)
+ allowed_external_redirect_urls = (known after apply)
+ default_provider = (known after apply)
+ enabled = (known after apply)
+ issuer = (known after apply)
+ runtime_version = (known after apply)
+ token_refresh_extension_hours = (known after apply)
+ token_store_enabled = (known after apply)
+ unauthenticated_client_action = (known after apply)
+ active_directory {
+ allowed_audiences = (known after apply)
+ client_id = (known after apply)
+ client_secret = (sensitive value)
}
+ facebook {
+ app_id = (known after apply)
+ app_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ google {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ microsoft {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ twitter {
+ consumer_key = (known after apply)
+ consumer_secret = (sensitive value)
}
}
+ connection_string {
+ name = (known after apply)
+ type = (known after apply)
+ value = (sensitive value)
}
+ identity {
+ identity_ids = (known after apply)
+ principal_id = (known after apply)
+ tenant_id = (known after apply)
+ type = (known after apply)
}
+ logs {
+ application_logs {
+ azure_blob_storage {
+ level = (known after apply)
+ retention_in_days = (known after apply)
+ sas_url = (sensitive value)
}
}
+ http_logs {
+ azure_blob_storage {
+ retention_in_days = (known after apply)
+ sas_url = (sensitive value)
}
+ file_system {
+ retention_in_days = (known after apply)
+ retention_in_mb = (known after apply)
}
}
}
+ site_config {
+ always_on = true
+ dotnet_framework_version = "v4.0"
+ ftps_state = (known after apply)
+ http2_enabled = false
+ ip_restriction = (known after apply)
+ java_container = "tomcat"
+ java_container_version = "9.0"
+ java_version = "1.8"
+ linux_fx_version = (known after apply)
+ local_mysql_enabled = (known after apply)
+ managed_pipeline_mode = (known after apply)
+ min_tls_version = (known after apply)
+ remote_debugging_enabled = false
+ remote_debugging_version = (known after apply)
+ scm_type = "None"
+ websockets_enabled = (known after apply)
+ windows_fx_version = (known after apply)
+ cors {
+ allowed_origins = (known after apply)
+ support_credentials = (known after apply)
}
}
+ storage_account {
+ access_key = (sensitive value)
+ account_name = (known after apply)
+ mount_path = (known after apply)
+ name = (known after apply)
+ share_name = (known after apply)
+ type = (known after apply)
}
}
# azurerm_app_service_plan.default will be created
+ resource "azurerm_app_service_plan" "default" {
+ app_service_environment_id = (known after apply)
+ id = (known after apply)
+ kind = "Linux"
+ location = "westus2"
+ maximum_elastic_worker_count = (known after apply)
+ maximum_number_of_workers = (known after apply)
+ name = "demo-tfquickstart-plan"
+ per_site_scaling = (known after apply)
+ reserved = true
+ resource_group_name = "demo-tfquickstart-dev-rg"
+ tags = (known after apply)
+ properties {
+ app_service_environment_id = (known after apply)
+ per_site_scaling = (known after apply)
+ reserved = (known after apply)
}
+ sku {
+ capacity = (known after apply)
+ size = "S1"
+ tier = "Standard"
}
}
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-dev-rg"
+ tags = (known after apply)
}
Plan: 3 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
```

View File

@ -0,0 +1,35 @@
variable "name" {
type = "string"
description = "Location of the azure resource group."
default = "demo-tfquickstart"
}
variable "environment" {
type = "string"
description = "Name of the deployment environment"
default = "dev"
}
variable "location" {
type = "string"
description = "Location to deploy the resoruce group"
default = "West US 2"
}
variable "dns_prefix" {
type = "string"
description = "A prefix for any dns based resources"
default = "tfq"
}
variable "plan_tier" {
type = "string"
description = "The tier of app service plan to create"
default = "Standard"
}
variable "plan_sku" {
type = "string"
description = "The sku of app service plan to create"
default = "S1"
}

View File

@ -0,0 +1,23 @@
resource "azurerm_app_service_plan" "default" {
name = "${var.name}-plan"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
kind = "Windows"
sku {
tier = "${var.plan_tier}"
size = "${var.plan_sku}"
}
}
resource "azurerm_app_service" "default" {
name = "${var.dns_prefix}-${var.name}-aspnet-${var.environment}-app"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
app_service_plan_id = "${azurerm_app_service_plan.default.id}"
site_config {
always_on = true
dotnet_framework_version = "v4.0"
}
}

View File

@ -0,0 +1,8 @@
provider "azurerm" {
version = "=1.36.0"
}
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "${var.location}"
}

View File

@ -0,0 +1,199 @@
# Windows Web App for a .NET Application
This template deploys an [Azure App Service](https://www.terraform.io/docs/providers/azurerm/r/app_service.html) running Windows configured for a .NET Framework 4.6.2 application.
## Variables
| Name | Description |
|-|-|
| name | Name of the deployment |
| environment | The depolyment environment name (used for postfixing resource names) |
| dns_prefix | A prefix for globally-unique dns-based resources |
| location | The Azure Region to deploy these resources in |
| plan_tier | The App Service Plan tier to deploy |
| plan_sku | The App Service Plan SKU to deploy|
## Usage
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azurerm_app_service.default will be created
+ resource "azurerm_app_service" "default" {
+ app_service_plan_id = (known after apply)
+ app_settings = (known after apply)
+ client_affinity_enabled = (known after apply)
+ default_site_hostname = (known after apply)
+ enabled = true
+ https_only = false
+ id = (known after apply)
+ location = "westus2"
+ name = "tfq-demo-tfquickstart-aspnet-dev-app"
+ outbound_ip_addresses = (known after apply)
+ possible_outbound_ip_addresses = (known after apply)
+ resource_group_name = "demo-tfquickstart-dev-rg"
+ site_credential = (known after apply)
+ source_control = (known after apply)
+ tags = (known after apply)
+ auth_settings {
+ additional_login_params = (known after apply)
+ allowed_external_redirect_urls = (known after apply)
+ default_provider = (known after apply)
+ enabled = (known after apply)
+ issuer = (known after apply)
+ runtime_version = (known after apply)
+ token_refresh_extension_hours = (known after apply)
+ token_store_enabled = (known after apply)
+ unauthenticated_client_action = (known after apply)
+ active_directory {
+ allowed_audiences = (known after apply)
+ client_id = (known after apply)
+ client_secret = (sensitive value)
}
+ facebook {
+ app_id = (known after apply)
+ app_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ google {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ microsoft {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ twitter {
+ consumer_key = (known after apply)
+ consumer_secret = (sensitive value)
}
}
+ connection_string {
+ name = (known after apply)
+ type = (known after apply)
+ value = (sensitive value)
}
+ identity {
+ identity_ids = (known after apply)
+ principal_id = (known after apply)
+ tenant_id = (known after apply)
+ type = (known after apply)
}
+ logs {
+ application_logs {
+ azure_blob_storage {
+ level = (known after apply)
+ retention_in_days = (known after apply)
+ sas_url = (sensitive value)
}
}
+ http_logs {
+ azure_blob_storage {
+ retention_in_days = (known after apply)
+ sas_url = (sensitive value)
}
+ file_system {
+ retention_in_days = (known after apply)
+ retention_in_mb = (known after apply)
}
}
}
+ site_config {
+ always_on = true
+ dotnet_framework_version = "v4.0"
+ ftps_state = (known after apply)
+ http2_enabled = false
+ ip_restriction = (known after apply)
+ linux_fx_version = (known after apply)
+ local_mysql_enabled = (known after apply)
+ managed_pipeline_mode = (known after apply)
+ min_tls_version = (known after apply)
+ remote_debugging_enabled = false
+ remote_debugging_version = (known after apply)
+ scm_type = "None"
+ websockets_enabled = (known after apply)
+ windows_fx_version = (known after apply)
+ cors {
+ allowed_origins = (known after apply)
+ support_credentials = (known after apply)
}
}
+ storage_account {
+ access_key = (sensitive value)
+ account_name = (known after apply)
+ mount_path = (known after apply)
+ name = (known after apply)
+ share_name = (known after apply)
+ type = (known after apply)
}
}
# azurerm_app_service_plan.default will be created
+ resource "azurerm_app_service_plan" "default" {
+ app_service_environment_id = (known after apply)
+ id = (known after apply)
+ kind = "Windows"
+ location = "westus2"
+ maximum_elastic_worker_count = (known after apply)
+ maximum_number_of_workers = (known after apply)
+ name = "demo-tfquickstart-plan"
+ per_site_scaling = (known after apply)
+ reserved = (known after apply)
+ resource_group_name = "demo-tfquickstart-dev-rg"
+ tags = (known after apply)
+ properties {
+ app_service_environment_id = (known after apply)
+ per_site_scaling = (known after apply)
+ reserved = (known after apply)
}
+ sku {
+ capacity = (known after apply)
+ size = "S1"
+ tier = "Standard"
}
}
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-dev-rg"
+ tags = (known after apply)
}
Plan: 3 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
``

View File

@ -0,0 +1,35 @@
variable "name" {
type = "string"
description = "Location of the azure resource group."
default = "demo-tfquickstart"
}
variable "environment" {
type = "string"
description = "Name of the deployment environment"
default = "dev"
}
variable "location" {
type = "string"
description = "Location to deploy the resoruce group"
default = "West US 2"
}
variable "dns_prefix" {
type = "string"
description = "A prefix for any dns based resources"
default = "tfq"
}
variable "plan_tier" {
type = "string"
description = "The tier of app service plan to create"
default = "Standard"
}
variable "plan_sku" {
type = "string"
description = "The sku of app service plan to create"
default = "S1"
}

View File

@ -0,0 +1,10 @@
locals {
acr_name = "${replace(var.dns_prefix, "-", "")}${replace(var.name, "-", "")}acr"
}
resource "azurerm_container_registry" "default" {
name = "${local.acr_name}"
resource_group_name = "${azurerm_resource_group.default.name}"
location = "${azurerm_resource_group.default.location}"
sku = "Standard"
admin_enabled = false
}

View File

@ -0,0 +1,24 @@
resource "azurerm_kubernetes_cluster" "default" {
name = "${var.name}-aks"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
dns_prefix = "${var.dns_prefix}-${var.name}-aks-${var.environment}"
depends_on = ["azurerm_role_assignment.aks_network", "azurerm_role_assignment.aks_acr"]
agent_pool_profile {
name = "default"
count = "${var.node_count}"
vm_size = "${var.node_type}"
os_type = "Linux"
os_disk_size_gb = 30
}
service_principal {
client_id = "${azuread_application.default.application_id}"
client_secret = "${azuread_service_principal_password.default.value}"
}
role_based_access_control {
enabled = true
}
}

View File

@ -0,0 +1,30 @@
resource "azuread_application" "default" {
name = "${var.name}-${var.environment}"
}
resource "azuread_service_principal" "default" {
application_id = "${azuread_application.default.application_id}"
}
resource "random_string" "password" {
length = 32
special = true
}
resource "azuread_service_principal_password" "default" {
service_principal_id = "${azuread_service_principal.default.id}"
value = "${random_string.password.result}"
end_date = "2099-01-01T01:00:00Z"
}
resource "azurerm_role_assignment" "aks_network" {
scope = "${data.azurerm_subscription.current.id}/resourceGroups/${azurerm_resource_group.default.name}"
role_definition_name = "Network Contributor"
principal_id = "${azuread_service_principal.default.id}"
}
resource "azurerm_role_assignment" "aks_acr" {
scope = "${data.azurerm_subscription.current.id}/resourceGroups/${azurerm_resource_group.default.name}/providers/Microsoft.ContainerRegistry/registries/${azurerm_container_registry.default.name}"
role_definition_name = "Reader"
principal_id = "${azuread_service_principal.default.id}"
}

View File

@ -0,0 +1,18 @@
# The Azure Active Resource Manager Terraform provider
provider "azurerm" {
version = "=1.36.0"
}
# The Azure Active Directory Terraform provider
provider "azuread" {
version = "=0.6.0"
}
# Reference to the current subscription. Used when creating role assignments
data "azurerm_subscription" "current" {}
# The main resource group for this deployment
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "${var.location}"
}

View File

@ -0,0 +1,226 @@
# AKC + ACR with Managed Identity
This template deploys an Azure Kubernetes Service cluster with a user-assigned Identity along with an Azure Container Registry. The identity of the AKS cluster has an assigned reader role to the ACR instance so AKS can pull containers without needing to have a Docker username and password configured.
## Variables
| Name | Description |
|-|-|
| name | Name of the deployment |
| environment | The depolyment environment name (used for postfixing resource names) |
| location | The Azure Region to deploy these resources in |
| vm_sku | The SKU of the VMs to deploy for AKS |
| dns_prefix | A DNS Prefix to use in the AKS Cluster |
## Example
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
data.azurerm_subscription.current: Refreshing state...
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azuread_application.default will be created
+ resource "azuread_application" "default" {
+ application_id = (known after apply)
+ homepage = (known after apply)
+ id = (known after apply)
+ identifier_uris = (known after apply)
+ name = "demo-tfquickstart-dev"
+ object_id = (known after apply)
+ public_client = (known after apply)
+ reply_urls = (known after apply)
+ type = "webapp/api"
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal.default will be created
+ resource "azuread_service_principal" "default" {
+ application_id = (known after apply)
+ display_name = (known after apply)
+ id = (known after apply)
+ object_id = (known after apply)
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal_password.default will be created
+ resource "azuread_service_principal_password" "default" {
+ end_date = "2099-01-01T01:00:00Z"
+ id = (known after apply)
+ key_id = (known after apply)
+ service_principal_id = (known after apply)
+ start_date = (known after apply)
+ value = (sensitive value)
}
# azurerm_container_registry.default will be created
+ resource "azurerm_container_registry" "default" {
+ admin_enabled = false
+ admin_password = (sensitive value)
+ admin_username = (known after apply)
+ id = (known after apply)
+ location = "westus2"
+ login_server = (known after apply)
+ name = "tfqdemotfquickstartacr"
+ network_rule_set = (known after apply)
+ resource_group_name = "demo-tfquickstart-dev-rg"
+ sku = "Standard"
+ tags = (known after apply)
}
# azurerm_kubernetes_cluster.default will be created
+ resource "azurerm_kubernetes_cluster" "default" {
+ dns_prefix = "tfq-demo-tfquickstart-aks-dev"
+ enable_pod_security_policy = (known after apply)
+ fqdn = (known after apply)
+ id = (known after apply)
+ kube_admin_config = (known after apply)
+ kube_admin_config_raw = (sensitive value)
+ kube_config = (known after apply)
+ kube_config_raw = (sensitive value)
+ kubernetes_version = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-aks"
+ node_resource_group = (known after apply)
+ resource_group_name = "demo-tfquickstart-dev-rg"
+ tags = (known after apply)
+ addon_profile {
+ aci_connector_linux {
+ enabled = (known after apply)
+ subnet_name = (known after apply)
}
+ azure_policy {
+ enabled = (known after apply)
}
+ http_application_routing {
+ enabled = (known after apply)
+ http_application_routing_zone_name = (known after apply)
}
+ kube_dashboard {
+ enabled = (known after apply)
}
+ oms_agent {
+ enabled = (known after apply)
+ log_analytics_workspace_id = (known after apply)
}
}
+ agent_pool_profile {
+ count = 3
+ dns_prefix = (known after apply)
+ fqdn = (known after apply)
+ max_pods = (known after apply)
+ name = "default"
+ os_disk_size_gb = 30
+ os_type = "Linux"
+ type = "AvailabilitySet"
+ vm_size = "Standard_D1_v2"
}
+ network_profile {
+ dns_service_ip = (known after apply)
+ docker_bridge_cidr = (known after apply)
+ load_balancer_sku = (known after apply)
+ network_plugin = (known after apply)
+ network_policy = (known after apply)
+ pod_cidr = (known after apply)
+ service_cidr = (known after apply)
}
+ role_based_access_control {
+ enabled = true
}
+ service_principal {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
}
}
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-dev-rg"
+ tags = (known after apply)
}
# azurerm_role_assignment.aks_acr will be created
+ resource "azurerm_role_assignment" "aks_acr" {
+ id = (known after apply)
+ name = (known after apply)
+ principal_id = (known after apply)
+ principal_type = (known after apply)
+ role_definition_id = (known after apply)
+ role_definition_name = "Reader"
+ scope = "/subscriptions/b0e04a4a-a321-4b66-b8fd-13715262ba3c/resourceGroups/demo-tfquickstart-dev-rg/providers/Microsoft.ContainerRegistry/registries/tfqdemotfquickstartacr"
+ skip_service_principal_aad_check = (known after apply)
}
# azurerm_role_assignment.aks_network will be created
+ resource "azurerm_role_assignment" "aks_network" {
+ id = (known after apply)
+ name = (known after apply)
+ principal_id = (known after apply)
+ principal_type = (known after apply)
+ role_definition_id = (known after apply)
+ role_definition_name = "Network Contributor"
+ scope = "/subscriptions/b0e04a4a-a321-4b66-b8fd-13715262ba3c/resourceGroups/demo-tfquickstart-dev-rg"
+ skip_service_principal_aad_check = (known after apply)
}
# random_string.password will be created
+ resource "random_string" "password" {
+ id = (known after apply)
+ length = 32
+ lower = true
+ min_lower = 0
+ min_numeric = 0
+ min_special = 0
+ min_upper = 0
+ number = true
+ result = (known after apply)
+ special = true
+ upper = true
}
Plan: 9 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
```

View File

@ -0,0 +1,40 @@
// Naming
variable "name" {
type = "string"
description = "Location of the azure resource group."
default = "demo-tfquickstart"
}
variable "environment" {
type = "string"
description = "Name of the deployment environment"
default = "dev"
}
// Resource information
variable "location" {
type = "string"
description = "Location of the azure resource group."
default = "WestUS2"
}
// Node type information
variable "node_count" {
type = "string"
description = "The number of K8S nodes to provision."
default = 3
}
variable "node_type" {
type = "string"
description = "The size of each node."
default = "Standard_D1_v2"
}
variable "dns_prefix" {
type = "string"
description = "DNS Prefix"
default = "tfq"
}

View File

@ -0,0 +1,31 @@
# AKS with a GPU Nodepool
Sometimes we need multiple node types with AKS. This template deploys an Azure Kubernetes Service cluster with a basic VM pool as well as a node pool of VMs that have GPUs attached.
## Variables
| Name | Description |
|-|-|
| name | Name of the deployment |
| environment | The depolyment environment name (used for postfixing resource names) |
| location | The Azure Region to deploy these resources in |
| vm_sku | The SKU of the VMs to deploy for AKS |
| vm_gpu_sku | The SKU of VMs to deploy for the AKS GPU Nodepool"
| prefix | A DNS Prefix to use in the AKS Cluster |
## Usage
```bash
terraform plan \
-var 'name=demo-dotnet' \
-var 'environment=staging' \
-var 'location=West US 2'
-var 'prefix=tfquickstard' \
-var 'vm_sku=ds1v2' \
-out demo.tfplan
terraform apply demo.tfplan
```
\* Example shown with [Bash](https://www.gnu.org/software/bash/). For [Powershell](https://docs.microsoft.com/en-us/powershell/) replace backslashes with backticks.

View File

@ -0,0 +1,24 @@
resource "azurerm_kubernetes_cluster" "default" {
name = "${var.name}-aks"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
dns_prefix = "${var.dns_prefix}-${var.name}-aks-${var.environment}"
depends_on = ["azurerm_role_assignment.default"]
agent_pool_profile {
name = "default"
count = "${var.node_count}"
vm_size = "${var.node_type}"
os_type = "Linux"
os_disk_size_gb = 30
}
service_principal {
client_id = "${azuread_application.default.application_id}"
client_secret = "${azuread_service_principal_password.default.value}"
}
role_based_access_control {
enabled = true
}
}

View File

@ -0,0 +1,24 @@
resource "azuread_application" "default" {
name = "${var.name}-${var.environment}"
}
resource "azuread_service_principal" "default" {
application_id = "${azuread_application.default.application_id}"
}
resource "random_string" "password" {
length = 32
special = true
}
resource "azuread_service_principal_password" "default" {
service_principal_id = "${azuread_service_principal.default.id}"
value = "${random_string.password.result}"
end_date = "2099-01-01T01:00:00Z"
}
resource "azurerm_role_assignment" "default" {
scope = "${data.azurerm_subscription.current.id}/resourceGroups/${azurerm_resource_group.default.name}"
role_definition_name = "Network Contributor"
principal_id = "${azuread_service_principal.default.id}"
}

View File

@ -0,0 +1,20 @@
# Define the helm provider to use the AKS cluster
provider "helm" {
kubernetes {
host = "${azurerm_kubernetes_cluster.default.kube_config.0.host}"
client_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_certificate)}"
client_key = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_key)}"
cluster_ca_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.cluster_ca_certificate)}"
}
service_account = "tiller"
}
# Install a sample ghost blog
resource "helm_release" "ghost" {
name = "ghost-blog"
chart = "bitnami/ghost"
depends_on = ["kubernetes_cluster_role_binding.tiller"]
}

View File

@ -0,0 +1,35 @@
# Define Kubernetes provider to use the AKS cluster
provider "kubernetes" {
host = "${azurerm_kubernetes_cluster.default.kube_config.0.host}"
client_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_certificate)}"
client_key = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_key)}"
cluster_ca_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.cluster_ca_certificate)}"
}
# Create a service account for the Helm Tiller
resource "kubernetes_service_account" "tiller" {
metadata {
name = "tiller"
namespace = "kube-system"
}
}
# Grant cluster-admin rights to the Tiller Service Account
resource "kubernetes_cluster_role_binding" "tiller" {
metadata {
name = "${kubernetes_service_account.tiller.metadata.0.name}"
}
role_ref {
api_group = "rbac.authorization.k8s.io"
kind = "ClusterRole"
name = "cluster-admin"
}
subject {
kind = "ServiceAccount"
name = "${kubernetes_service_account.tiller.metadata.0.name}"
namespace = "kube-system"
}
}

View File

@ -0,0 +1,18 @@
# The Azure Active Resource Manager Terraform provider
provider "azurerm" {
version = "=1.36.1"
}
# The Azure Active Directory Terraform provider
provider "azuread" {
version = "=0.6.0"
}
# Reference to the current subscription. Used when creating role assignments
data "azurerm_subscription" "current" {}
# The main resource group for this deployment
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "${var.location}"
}

View File

@ -0,0 +1,244 @@
# AKS with Helm
This template deploys an Azure Kubernetes Service cluster then leverages the Kubernetes provider to configure Helm (v2) to manage deployed packages. Once stood up a basic blog demo is deployed.
## Variables
| Name | Description |
|-|-|
| name | Name of the deployment |
| environment | The depolyment environment name (used for postfixing resource names) |
| prefix | A prefix for globally-unique dns-based resources |
| location | The Azure Region to deploy these resources in |
| node_type | The type of node to deploy on (e.g. d1v2) |
| node_count | The number of nodes to deploy |
| dns_prefix | A unique dns prefix |
## Sample
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
data.azurerm_subscription.current: Refreshing state...
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azuread_application.default will be created
+ resource "azuread_application" "default" {
+ application_id = (known after apply)
+ homepage = (known after apply)
+ id = (known after apply)
+ identifier_uris = (known after apply)
+ name = "quickstart-aks-dev"
+ object_id = (known after apply)
+ public_client = (known after apply)
+ reply_urls = (known after apply)
+ type = "webapp/api"
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal.default will be created
+ resource "azuread_service_principal" "default" {
+ application_id = (known after apply)
+ display_name = (known after apply)
+ id = (known after apply)
+ object_id = (known after apply)
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal_password.default will be created
+ resource "azuread_service_principal_password" "default" {
+ end_date = "2099-01-01T01:00:00Z"
+ id = (known after apply)
+ key_id = (known after apply)
+ service_principal_id = (known after apply)
+ start_date = (known after apply)
+ value = (sensitive value)
}
# azurerm_kubernetes_cluster.default will be created
+ resource "azurerm_kubernetes_cluster" "default" {
+ dns_prefix = "tfquickstart-quickstart-aks-aks-dev"
+ enable_pod_security_policy = (known after apply)
+ fqdn = (known after apply)
+ id = (known after apply)
+ kube_admin_config = (known after apply)
+ kube_admin_config_raw = (sensitive value)
+ kube_config = (known after apply)
+ kube_config_raw = (sensitive value)
+ kubernetes_version = (known after apply)
+ location = "westus2"
+ name = "quickstart-aks-aks"
+ node_resource_group = (known after apply)
+ resource_group_name = "quickstart-aks-dev-rg"
+ tags = (known after apply)
+ addon_profile {
+ aci_connector_linux {
+ enabled = (known after apply)
+ subnet_name = (known after apply)
}
+ azure_policy {
+ enabled = (known after apply)
}
+ http_application_routing {
+ enabled = (known after apply)
+ http_application_routing_zone_name = (known after apply)
}
+ kube_dashboard {
+ enabled = (known after apply)
}
+ oms_agent {
+ enabled = (known after apply)
+ log_analytics_workspace_id = (known after apply)
}
}
+ agent_pool_profile {
+ count = 3
+ dns_prefix = (known after apply)
+ fqdn = (known after apply)
+ max_pods = (known after apply)
+ name = "default"
+ os_disk_size_gb = 30
+ os_type = "Linux"
+ type = "AvailabilitySet"
+ vm_size = "Standard_D1_v2"
}
+ network_profile {
+ dns_service_ip = (known after apply)
+ docker_bridge_cidr = (known after apply)
+ load_balancer_sku = (known after apply)
+ network_plugin = (known after apply)
+ network_policy = (known after apply)
+ pod_cidr = (known after apply)
+ service_cidr = (known after apply)
}
+ role_based_access_control {
+ enabled = true
}
+ service_principal {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
}
}
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "quickstart-aks-dev-rg"
+ tags = (known after apply)
}
# azurerm_role_assignment.default will be created
+ resource "azurerm_role_assignment" "default" {
+ id = (known after apply)
+ name = (known after apply)
+ principal_id = (known after apply)
+ principal_type = (known after apply)
+ role_definition_id = (known after apply)
+ role_definition_name = "Network Contributor"
+ scope = "/subscriptions/b0e04a4a-a321-4b66-b8fd-13715262ba3c/resourceGroups/quickstart-aks-dev-rg"
+ skip_service_principal_aad_check = (known after apply)
}
# kubernetes_cluster_role_binding.tiller will be created
+ resource "kubernetes_cluster_role_binding" "tiller" {
+ id = (known after apply)
+ metadata {
+ generation = (known after apply)
+ name = "tiller"
+ resource_version = (known after apply)
+ self_link = (known after apply)
+ uid = (known after apply)
}
+ role_ref {
+ api_group = "rbac.authorization.k8s.io"
+ kind = "ClusterRole"
+ name = "cluster-admin"
}
+ subject {
+ api_group = (known after apply)
+ kind = "ServiceAccount"
+ name = "tiller"
+ namespace = "kube-system"
}
}
# kubernetes_service_account.tiller will be created
+ resource "kubernetes_service_account" "tiller" {
+ default_secret_name = (known after apply)
+ id = (known after apply)
+ metadata {
+ generation = (known after apply)
+ name = "tiller"
+ namespace = "kube-system"
+ resource_version = (known after apply)
+ self_link = (known after apply)
+ uid = (known after apply)
}
}
# random_string.password will be created
+ resource "random_string" "password" {
+ id = (known after apply)
+ length = 32
+ lower = true
+ min_lower = 0
+ min_numeric = 0
+ min_special = 0
+ min_upper = 0
+ number = true
+ result = (known after apply)
+ special = true
+ upper = true
}
Plan: 9 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
```
\* Example shown with [Bash](https://www.gnu.org/software/bash/). For [Powershell](https://docs.microsoft.com/en-us/powershell/) replace backslashes with backticks.

View File

@ -0,0 +1,40 @@
// Naming
variable "name" {
type = "string"
description = "Location of the azure resource group."
default = "quickstart-aks"
}
variable "environment" {
type = "string"
description = "Name of the deployment environment"
default = "dev"
}
// Resource information
variable "location" {
type = "string"
description = "Location of the azure resource group."
default = "WestUS2"
}
// Node type information
variable "node_count" {
type = "string"
description = "The number of K8S nodes to provision."
default = 3
}
variable "node_type" {
type = "string"
description = "The size of each node."
default = "Standard_D1_v2"
}
variable "dns_prefix" {
type = "string"
description = "DNS Prefix"
default = "tfquickstart"
}

View File

@ -0,0 +1,27 @@
resource "azurerm_kubernetes_cluster" "default" {
name = "${var.name}-aks"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
dns_prefix = "${var.dns_prefix}-${var.name}-aks-${var.environment}"
depends_on = ["azurerm_role_assignment.default"]
agent_pool_profile {
name = "default"
count = "${var.node_count}"
vm_size = "${var.node_type}"
os_type = "Linux"
os_disk_size_gb = 30
}
service_principal {
client_id = "${azuread_application.default.application_id}"
client_secret = "${azuread_service_principal_password.default.value}"
}
addon_profile {
oms_agent {
enabled = true
log_analytics_workspace_id = "${azurerm_log_analytics_workspace.default.id}"
}
}
}

View File

@ -0,0 +1,20 @@
resource "azurerm_log_analytics_workspace" "default" {
name = "${var.name}-${var.environment}-law"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
sku = "PerGB2018"
retention_in_days = 30
}
resource "azurerm_log_analytics_solution" "default" {
solution_name = "ContainerInsights"
location = "${azurerm_log_analytics_workspace.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
workspace_resource_id = "${azurerm_log_analytics_workspace.default.id}"
workspace_name = "${azurerm_log_analytics_workspace.default.name}"
plan {
publisher = "Microsoft"
product = "OMSGallery/ContainerInsights"
}
}

View File

@ -0,0 +1,24 @@
resource "azuread_application" "default" {
name = "${var.name}-${var.environment}"
}
resource "azuread_service_principal" "default" {
application_id = "${azuread_application.default.application_id}"
}
resource "random_string" "password" {
length = 32
special = true
}
resource "azuread_service_principal_password" "default" {
service_principal_id = "${azuread_service_principal.default.id}"
value = "${random_string.password.result}"
end_date = "2099-01-01T01:00:00Z"
}
resource "azurerm_role_assignment" "default" {
scope = "${data.azurerm_subscription.current.id}/resourceGroups/${azurerm_resource_group.default.name}"
role_definition_name = "Network Contributor"
principal_id = "${azuread_service_principal.default.id}"
}

View File

@ -0,0 +1,18 @@
# The Azure Active Resource Manager Terraform provider
provider "azurerm" {
version = "=1.36.1"
}
# The Azure Active Directory Terraform provider
provider "azuread" {
version = "=0.6.0"
}
# Reference to the current subscription. Used when creating role assignments
data "azurerm_subscription" "current" {}
# The main resource group for this deployment
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "${var.location}"
}

View File

@ -0,0 +1,238 @@
# Azure Kubernetes Service
This template deploys an [Azure Kubernetes Service](https://www.terraform.io/docs/providers/azurerm/r/kubernetes_cluster.html) instance which sends system and container logs to Azure Log Analytics, which can be visualized with the Container Monitoring solution.
## Resources
| Terraform Resource Type | Description |
| - | - |
| `azurerm_resource_group` | The resource group all resources are deployed into |
| `azurerm_kubernetes_cluster` |The Azure Kubernetes Serice cluster |
| `azurerm_log_analytics_workspace` | A workspace to write cluster logs to |
| `azurerm_log_analytics_solution` | Enables the container monitoring solution for Log ANalytics|
| `azuread_application` |The application Identity the AKS cluster will use |
| `random_string` | A random string which will be saved and used with the service principal |
| `azuread_service_principal` |The service principal the AKS cluster will use |
| `azuread_service_principal_password` | The password for the Service principal |
## Variables
| Name | Description |
|-|-|
| name | Name of the deployment |
| environment | The depolyment environment name (used for postfixing resource names) |
| prefix | A prefix for globally-unique dns-based resources |
| location | The Azure Region to deploy these resources in |
| node_type | The type of node to deploy on (e.g. d1v2) |
| node_count | The number of nodes to deploy |
| dns_prefix | A unique dns prefix |
## Example
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
data.azurerm_subscription.current: Refreshing state...
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azuread_application.default will be created
+ resource "azuread_application" "default" {
+ application_id = (known after apply)
+ homepage = (known after apply)
+ id = (known after apply)
+ identifier_uris = (known after apply)
+ name = "quickstart-aks-dev"
+ object_id = (known after apply)
+ public_client = (known after apply)
+ reply_urls = (known after apply)
+ type = "webapp/api"
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal.default will be created
+ resource "azuread_service_principal" "default" {
+ application_id = (known after apply)
+ display_name = (known after apply)
+ id = (known after apply)
+ object_id = (known after apply)
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal_password.default will be created
+ resource "azuread_service_principal_password" "default" {
+ end_date = "2099-01-01T01:00:00Z"
+ id = (known after apply)
+ key_id = (known after apply)
+ service_principal_id = (known after apply)
+ start_date = (known after apply)
+ value = (sensitive value)
}
# azurerm_kubernetes_cluster.default will be created
+ resource "azurerm_kubernetes_cluster" "default" {
+ dns_prefix = "tfquickstart-quickstart-aks-aks-dev"
+ enable_pod_security_policy = (known after apply)
+ fqdn = (known after apply)
+ id = (known after apply)
+ kube_admin_config = (known after apply)
+ kube_admin_config_raw = (sensitive value)
+ kube_config = (known after apply)
+ kube_config_raw = (sensitive value)
+ kubernetes_version = (known after apply)
+ location = "westus2"
+ name = "quickstart-aks-aks"
+ node_resource_group = (known after apply)
+ resource_group_name = "quickstart-aks-dev-rg"
+ tags = (known after apply)
+ addon_profile {
+ oms_agent {
+ enabled = true
+ log_analytics_workspace_id = (known after apply)
}
}
+ agent_pool_profile {
+ count = 3
+ dns_prefix = (known after apply)
+ fqdn = (known after apply)
+ max_pods = (known after apply)
+ name = "default"
+ os_disk_size_gb = 30
+ os_type = "Linux"
+ type = "AvailabilitySet"
+ vm_size = "Standard_D1_v2"
}
+ network_profile {
+ dns_service_ip = (known after apply)
+ docker_bridge_cidr = (known after apply)
+ load_balancer_sku = (known after apply)
+ network_plugin = (known after apply)
+ network_policy = (known after apply)
+ pod_cidr = (known after apply)
+ service_cidr = (known after apply)
}
+ role_based_access_control {
+ enabled = (known after apply)
+ azure_active_directory {
+ client_app_id = (known after apply)
+ server_app_id = (known after apply)
+ server_app_secret = (sensitive value)
+ tenant_id = (known after apply)
}
}
+ service_principal {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
}
}
# azurerm_log_analytics_solution.default will be created
+ resource "azurerm_log_analytics_solution" "default" {
+ id = (known after apply)
+ location = "westus2"
+ resource_group_name = "quickstart-aks-dev-rg"
+ solution_name = "ContainerInsights"
+ workspace_name = "quickstart-aks-dev-law"
+ workspace_resource_id = (known after apply)
+ plan {
+ name = (known after apply)
+ product = "OMSGallery/ContainerInsights"
+ publisher = "Microsoft"
}
}
# azurerm_log_analytics_workspace.default will be created
+ resource "azurerm_log_analytics_workspace" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "quickstart-aks-dev-law"
+ portal_url = (known after apply)
+ primary_shared_key = (sensitive value)
+ resource_group_name = "quickstart-aks-dev-rg"
+ retention_in_days = 30
+ secondary_shared_key = (sensitive value)
+ sku = "PerGB2018"
+ tags = (known after apply)
+ workspace_id = (known after apply)
}
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "quickstart-aks-dev-rg"
+ tags = (known after apply)
}
# azurerm_role_assignment.default will be created
+ resource "azurerm_role_assignment" "default" {
+ id = (known after apply)
+ name = (known after apply)
+ principal_id = (known after apply)
+ principal_type = (known after apply)
+ role_definition_id = (known after apply)
+ role_definition_name = "Network Contributor"
+ scope = "/subscriptions/b0e04a4a-a321-4b66-b8fd-13715262ba3c/resourceGroups/quickstart-aks-dev-rg"
+ skip_service_principal_aad_check = (known after apply)
}
# random_string.password will be created
+ resource "random_string" "password" {
+ id = (known after apply)
+ length = 32
+ lower = true
+ min_lower = 0
+ min_numeric = 0
+ min_special = 0
+ min_upper = 0
+ number = true
+ result = (known after apply)
+ special = true
+ upper = true
}
Plan: 9 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
```

View File

@ -0,0 +1,40 @@
// Naming
variable "name" {
type = "string"
description = "Location of the azure resource group."
default = "quickstart-aks"
}
variable "environment" {
type = "string"
description = "Name of the deployment environment"
default = "dev"
}
// Resource information
variable "location" {
type = "string"
description = "Location of the azure resource group."
default = "WestUS2"
}
// Node type information
variable "node_count" {
type = "string"
description = "The number of K8S nodes to provision."
default = 3
}
variable "node_type" {
type = "string"
description = "The size of each node."
default = "Standard_D1_v2"
}
variable "dns_prefix" {
type = "string"
description = "DNS Prefix"
default = "tfquickstart"
}

View File

@ -0,0 +1,24 @@
resource "azurerm_kubernetes_cluster" "default" {
name = "${var.name}-aks"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
dns_prefix = "${var.dns_prefix}-${var.name}-aks-${var.environment}"
depends_on = ["azurerm_role_assignment.default"]
agent_pool_profile {
name = "default"
count = "${var.node_count}"
vm_size = "${var.node_type}"
os_type = "Linux"
os_disk_size_gb = 30
}
service_principal {
client_id = "${azuread_application.default.application_id}"
client_secret = "${azuread_service_principal_password.default.value}"
}
role_based_access_control {
enabled = true
}
}

View File

@ -0,0 +1,24 @@
resource "azuread_application" "default" {
name = "${var.name}-${var.environment}"
}
resource "azuread_service_principal" "default" {
application_id = "${azuread_application.default.application_id}"
}
resource "random_string" "password" {
length = 32
special = true
}
resource "azuread_service_principal_password" "default" {
service_principal_id = "${azuread_service_principal.default.id}"
value = "${random_string.password.result}"
end_date = "2099-01-01T01:00:00Z"
}
resource "azurerm_role_assignment" "default" {
scope = "${data.azurerm_subscription.current.id}/resourceGroups/${azurerm_resource_group.default.name}"
role_definition_name = "Network Contributor"
principal_id = "${azuread_service_principal.default.id}"
}

View File

@ -0,0 +1,28 @@
# Define Kubernetes provider to use the AKS cluster
provider "kubernetes" {
host = "${azurerm_kubernetes_cluster.default.kube_config.0.host}"
client_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_certificate)}"
client_key = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_key)}"
cluster_ca_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.cluster_ca_certificate)}"
}
# Grant cluster-admin rights to the kubernetes-dashboard account.
# THIS IS NOT RECOMMENDED IN PRODUTION
resource "kubernetes_cluster_role_binding" "dashboard" {
metadata {
name = "kubernetes-dashboard"
}
role_ref {
api_group = "rbac.authorization.k8s.io"
kind = "ClusterRole"
name = "cluster-admin"
}
subject {
kind = "ServiceAccount"
name = "kubernetes-dashboard"
namespace = "kube-system"
}
}

View File

@ -0,0 +1,18 @@
# The Azure Active Resource Manager Terraform provider
provider "azurerm" {
version = "=1.36.1"
}
# The Azure Active Directory Terraform provider
provider "azuread" {
version = "=0.6.0"
}
# Reference to the current subscription. Used when creating role assignments
data "azurerm_subscription" "current" {}
# The main resource group for this deployment
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "${var.location}"
}

View File

@ -0,0 +1,230 @@
# Azure Kubernetes Service
This template deploys an [Azure Kubernetes Service](https://www.terraform.io/docs/providers/azurerm/r/kubernetes_cluster.html) instance with Role Based Access Control (RBAC) enabled. With this, by default the robust Kubernetes dashboard has no rights to view or make changes to the cluster. In this template we leverage the Kubernetes provider to provision a role binding for the Dashboard accoutn to give it `cluster-admin` rights - something we shoudl not do in production but can be very useful in development.
## Resources
| Terraform Resource Type | Description |
| - | - |
| `azurerm_resource_group` | The resource group all resources are deployed into |
| `azurerm_kubernetes_cluster` |The Azure Kubernetes Serice cluster |
| `azuread_application` |The application Identity the AKS cluster will use |
| `random_string` | A random string which will be saved and used with the service principal |
| `azuread_service_principal` |The service principal the AKS cluster will use |
| `azuread_service_principal_password` | The password for the Service principal |
## Variables
| Name | Description |
|-|-|
| name | Name of the deployment |
| environment | The depolyment environment name (used for postfixing resource names) |
| prefix | A prefix for globally-unique dns-based resources |
| location | The Azure Region to deploy these resources in |
| node_type | The type of node to deploy on (e.g. d1v2) |
| node_count | The number of nodes to deploy |
| dns_prefix | A unique dns prefix |
## Example
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
data.azurerm_subscription.current: Refreshing state...
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azuread_application.default will be created
+ resource "azuread_application" "default" {
+ application_id = (known after apply)
+ homepage = (known after apply)
+ id = (known after apply)
+ identifier_uris = (known after apply)
+ name = "quickstart-aks-dev"
+ object_id = (known after apply)
+ public_client = (known after apply)
+ reply_urls = (known after apply)
+ type = "webapp/api"
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal.default will be created
+ resource "azuread_service_principal" "default" {
+ application_id = (known after apply)
+ display_name = (known after apply)
+ id = (known after apply)
+ object_id = (known after apply)
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal_password.default will be created
+ resource "azuread_service_principal_password" "default" {
+ end_date = "2099-01-01T01:00:00Z"
+ id = (known after apply)
+ key_id = (known after apply)
+ service_principal_id = (known after apply)
+ start_date = (known after apply)
+ value = (sensitive value)
}
# azurerm_kubernetes_cluster.default will be created
+ resource "azurerm_kubernetes_cluster" "default" {
+ dns_prefix = "tfquickstart-quickstart-aks-aks-dev"
+ enable_pod_security_policy = (known after apply)
+ fqdn = (known after apply)
+ id = (known after apply)
+ kube_admin_config = (known after apply)
+ kube_admin_config_raw = (sensitive value)
+ kube_config = (known after apply)
+ kube_config_raw = (sensitive value)
+ kubernetes_version = (known after apply)
+ location = "westus2"
+ name = "quickstart-aks-aks"
+ node_resource_group = (known after apply)
+ resource_group_name = "quickstart-aks-dev-rg"
+ tags = (known after apply)
+ addon_profile {
+ oms_agent {
+ enabled = true
+ log_analytics_workspace_id = (known after apply)
}
}
+ agent_pool_profile {
+ count = 3
+ dns_prefix = (known after apply)
+ fqdn = (known after apply)
+ max_pods = (known after apply)
+ name = "default"
+ os_disk_size_gb = 30
+ os_type = "Linux"
+ type = "AvailabilitySet"
+ vm_size = "Standard_D1_v2"
}
+ network_profile {
+ dns_service_ip = (known after apply)
+ docker_bridge_cidr = (known after apply)
+ load_balancer_sku = (known after apply)
+ network_plugin = (known after apply)
+ network_policy = (known after apply)
+ pod_cidr = (known after apply)
+ service_cidr = (known after apply)
}
+ role_based_access_control {
+ enabled = true
}
+ service_principal {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
}
}
# azurerm_log_analytics_solution.default will be created
+ resource "azurerm_log_analytics_solution" "default" {
+ id = (known after apply)
+ location = "westus2"
+ resource_group_name = "quickstart-aks-dev-rg"
+ solution_name = "ContainerInsights"
+ workspace_name = "quickstart-aks-dev-law"
+ workspace_resource_id = (known after apply)
+ plan {
+ name = (known after apply)
+ product = "OMSGallery/ContainerInsights"
+ publisher = "Microsoft"
}
}
# azurerm_log_analytics_workspace.default will be created
+ resource "azurerm_log_analytics_workspace" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "quickstart-aks-dev-law"
+ portal_url = (known after apply)
+ primary_shared_key = (sensitive value)
+ resource_group_name = "quickstart-aks-dev-rg"
+ retention_in_days = 30
+ secondary_shared_key = (sensitive value)
+ sku = "PerGB2018"
+ tags = (known after apply)
+ workspace_id = (known after apply)
}
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "quickstart-aks-dev-rg"
+ tags = (known after apply)
}
# azurerm_role_assignment.default will be created
+ resource "azurerm_role_assignment" "default" {
+ id = (known after apply)
+ name = (known after apply)
+ principal_id = (known after apply)
+ principal_type = (known after apply)
+ role_definition_id = (known after apply)
+ role_definition_name = "Network Contributor"
+ scope = "/subscriptions/b0e04a4a-a321-4b66-b8fd-13715262ba3c/resourceGroups/quickstart-aks-dev-rg"
+ skip_service_principal_aad_check = (known after apply)
}
# random_string.password will be created
+ resource "random_string" "password" {
+ id = (known after apply)
+ length = 32
+ lower = true
+ min_lower = 0
+ min_numeric = 0
+ min_special = 0
+ min_upper = 0
+ number = true
+ result = (known after apply)
+ special = true
+ upper = true
}
Plan: 9 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
```

View File

@ -0,0 +1,40 @@
// Naming
variable "name" {
type = "string"
description = "Location of the azure resource group."
default = "quickstart-aks"
}
variable "environment" {
type = "string"
description = "Name of the deployment environment"
default = "dev"
}
// Resource information
variable "location" {
type = "string"
description = "Location of the azure resource group."
default = "WestUS2"
}
// Node type information
variable "node_count" {
type = "string"
description = "The number of K8S nodes to provision."
default = 3
}
variable "node_type" {
type = "string"
description = "The size of each node."
default = "Standard_D1_v2"
}
variable "dns_prefix" {
type = "string"
description = "DNS Prefix"
default = "tfquickstart"
}

View File

@ -0,0 +1,18 @@
# Azure Pipelines Multi-Stage CI/CD
This template deploys a basic Azure Web App leveraging CI/CD through Azure Pipelines to a single environment
## Variables
| Name | Description |
|-|-|
| name | Name of the deployment |
| environment | The depolyment environment name (used for postfixing resource names) |
| location | The Azure Region to deploy these resources in |
| plan_sku | The SKU of the App Service Plan to host the webapp |
| prefix | A DNS Prefix to use in the AKS Cluster |
## Usage
Set up a Pipeline in Azure Pipelines pointing to azure-pipelines.yml.

View File

@ -0,0 +1,36 @@
# CDN + static website hosted on Azure Storage
This template deploys a static website hosted on an [Azure Storage Account](https://www.terraform.io/docs/providers/azurerm/r/storage_account.html) fronted by a CDN configured to support SSL.
## Resources
| Terraform Resource Type | Description |
| - | - |
| `azurerm_resource_group` | The resource group all resources are deployed into |
| `azurerm_storage_account` | The storage account used to host the website |
## Variables
| Name | Description |
|-|-|
| `name` | Name of the deployment |
| `environment` | The depolyment environment name (used for postfixing resource names) |
| `prefix` | A prefix for globally-unique dns-based resources |
| `location` | The Azure Region to deploy these resources in |
## Usage
```bash
terraform plan \
-var 'name=demo-docker' \
-var 'environment=staging' \
-var 'location=West US 2'
-var 'prefix=tfquickstard' \
-out demo.tfplan
terraform apply demo.tfplan
```
\* Example shown with [Bash](https://www.gnu.org/software/bash/). For [Powershell](https://docs.microsoft.com/en-us/powershell/) replace backslashes with backticks.

View File

@ -0,0 +1,36 @@
# Scalable Virtual Machine behind a Web Application Firewall
This template deploys a Virtual Machine Scale Set fronted by an Azure Application Gateway that has the Web Application Firewall (WAF) enabled.
## Resources
| Terraform Resource Type | Description |
| - | - |
| `azurerm_resource_group` | The resource group all resources are deployed into |
| `azurerm_virtual_machine_scale_set` | The storage account used to host the website |
| `azurerm_application_gateway` | The storage account used to host the website |
## Variables
| Name | Description |
|-|-|
| `name` | Name of the deployment |
| `environment` | The depolyment environment name (used for postfixing resource names) |
| `prefix` | A prefix for globally-unique dns-based resources |
| `location` | The Azure Region to deploy these resources in |
## Usage
```bash
terraform plan \
-var 'name=demo-docker' \
-var 'environment=staging' \
-var 'location=West US 2'
-var 'prefix=tfquickstard' \
-out demo.tfplan
terraform apply demo.tfplan
```
\* Example shown with [Bash](https://www.gnu.org/software/bash/). For [Powershell](https://docs.microsoft.com/en-us/powershell/) replace backslashes with backticks.

View File

@ -0,0 +1,11 @@
locals {
acr_name = "${replace(var.dns_prefix, "-", "")}${replace(var.name, "-", "")}acr"
}
resource "azurerm_container_registry" "default" {
name = "${local.acr_name}"
resource_group_name = "${azurerm_resource_group.default.name}"
location = "${azurerm_resource_group.default.location}"
sku = "Standard"
admin_enabled = false
}

View File

@ -0,0 +1,27 @@
resource "azurerm_app_service_plan" "default" {
name = "${var.name}-plan"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
kind = "Linux"
# Reserved must be set to true for Linux App Service Plans
reserved = true
sku {
tier = "${var.plan_tier}"
size = "${var.plan_sku}"
}
}
resource "azurerm_app_service" "default" {
name = "${var.dns_prefix}-${var.name}-${var.environment}-app"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
app_service_plan_id = "${azurerm_app_service_plan.default.id}"
site_config {
always_on = true
linux_fx_version = "DOCKER|nginxdemos/hello"
}
}

View File

@ -0,0 +1,5 @@
resource "azurerm_role_assignment" "acr" {
scope = "${data.azurerm_subscription.current.id}/resourceGroups/${azurerm_resource_group.default.name}/providers/Microsoft.Web/serverFarms/${azurerm_app_service.default.name}"
role_definition_name = "Reader"
principal_id = "${azurerm_app_service.default.identity[0].principal_id}"
}

View File

@ -0,0 +1,11 @@
provider "azurerm" {
version = "=1.36.1"
}
# Reference to the current subscription. Used when creating role assignments
data "azurerm_subscription" "current" {}
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "${var.location}"
}

View File

@ -0,0 +1,237 @@
# Containerized Web App with an Azure Container Registry
This template deploys an [Azure App Service](https://www.terraform.io/docs/providers/azurerm/r/app_service.html) with a system-assigned identity running Linux configured for a containerized application. This template also deploys an Azure Container Registry and grants read access to the Web App.
## Resources
| Terraform Resource Type | Description |
| - | - |
| `azurerm_resource_group` | The resource group all resources are deployed into |
| `azurerm_app_service_plan` | The underlying plan that the web app will run on |
| `azurerm_app_service` | The Linux web app |
| `azurerm_container_registry` | The Azure Container Registry instance |
| `azurerm_role_assignment` | The role assignment between the container registry and the app service |
## Variables
| Name | Description |
|-|-|
| `name` | Name of the deployment |
| `environment` | The depolyment environment name (used for postfixing resource names) |
| `dns_prefix` | A prefix for globally-unique dns-based resources |
| `location` | The Azure Region to deploy these resources in |
| `plan_tier` | The App Service Plan tier to deploy |
| `plan_sku` | The App Service Plan SKU to deploy|
## Example
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
data.azurerm_subscription.current: Refreshing state...
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azurerm_app_service.default will be created
+ resource "azurerm_app_service" "default" {
+ app_service_plan_id = (known after apply)
+ app_settings = (known after apply)
+ client_affinity_enabled = (known after apply)
+ default_site_hostname = (known after apply)
+ enabled = true
+ https_only = false
+ id = (known after apply)
+ location = "westus2"
+ name = "tfq-demo-tfquickstart-dev-app"
+ outbound_ip_addresses = (known after apply)
+ possible_outbound_ip_addresses = (known after apply)
+ resource_group_name = "demo-tfquickstart-dev-rg"
+ site_credential = (known after apply)
+ source_control = (known after apply)
+ tags = (known after apply)
+ auth_settings {
+ additional_login_params = (known after apply)
+ allowed_external_redirect_urls = (known after apply)
+ default_provider = (known after apply)
+ enabled = (known after apply)
+ issuer = (known after apply)
+ runtime_version = (known after apply)
+ token_refresh_extension_hours = (known after apply)
+ token_store_enabled = (known after apply)
+ unauthenticated_client_action = (known after apply)
+ active_directory {
+ allowed_audiences = (known after apply)
+ client_id = (known after apply)
+ client_secret = (sensitive value)
}
+ facebook {
+ app_id = (known after apply)
+ app_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ google {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ microsoft {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
+ oauth_scopes = (known after apply)
}
+ twitter {
+ consumer_key = (known after apply)
+ consumer_secret = (sensitive value)
}
}
+ connection_string {
+ name = (known after apply)
+ type = (known after apply)
+ value = (sensitive value)
}
+ identity {
+ identity_ids = (known after apply)
+ principal_id = (known after apply)
+ tenant_id = (known after apply)
+ type = (known after apply)
}
+ logs {
+ application_logs {
+ azure_blob_storage {
+ level = (known after apply)
+ retention_in_days = (known after apply)
+ sas_url = (sensitive value)
}
}
+ http_logs {
+ azure_blob_storage {
+ retention_in_days = (known after apply)
+ sas_url = (sensitive value)
}
+ file_system {
+ retention_in_days = (known after apply)
+ retention_in_mb = (known after apply)
}
}
}
+ site_config {
+ always_on = true
+ dotnet_framework_version = "v4.0"
+ ftps_state = (known after apply)
+ http2_enabled = false
+ ip_restriction = (known after apply)
+ linux_fx_version = "DOCKER|nginxdemos/hello"
+ local_mysql_enabled = (known after apply)
+ managed_pipeline_mode = (known after apply)
+ min_tls_version = (known after apply)
+ remote_debugging_enabled = false
+ remote_debugging_version = (known after apply)
+ scm_type = "None"
+ websockets_enabled = (known after apply)
+ windows_fx_version = (known after apply)
+ cors {
+ allowed_origins = (known after apply)
+ support_credentials = (known after apply)
}
}
+ storage_account {
+ access_key = (sensitive value)
+ account_name = (known after apply)
+ mount_path = (known after apply)
+ name = (known after apply)
+ share_name = (known after apply)
+ type = (known after apply)
}
}
# azurerm_app_service_plan.default will be created
+ resource "azurerm_app_service_plan" "default" {
+ app_service_environment_id = (known after apply)
+ id = (known after apply)
+ kind = "Linux"
+ location = "westus2"
+ maximum_elastic_worker_count = (known after apply)
+ maximum_number_of_workers = (known after apply)
+ name = "demo-tfquickstart-plan"
+ per_site_scaling = (known after apply)
+ reserved = true
+ resource_group_name = "demo-tfquickstart-dev-rg"
+ tags = (known after apply)
+ properties {
+ app_service_environment_id = (known after apply)
+ per_site_scaling = (known after apply)
+ reserved = (known after apply)
}
+ sku {
+ capacity = (known after apply)
+ size = "S1"
+ tier = "Standard"
}
}
# azurerm_container_registry.default will be created
+ resource "azurerm_container_registry" "default" {
+ admin_enabled = false
+ admin_password = (sensitive value)
+ admin_username = (known after apply)
+ id = (known after apply)
+ location = "westus2"
+ login_server = (known after apply)
+ name = "tfqdemotfquickstartacr"
+ network_rule_set = (known after apply)
+ resource_group_name = "demo-tfquickstart-dev-rg"
+ sku = "Standard"
+ tags = (known after apply)
}
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-dev-rg"
+ tags = (known after apply)
}
# azurerm_role_assignment.acr will be created
+ resource "azurerm_role_assignment" "acr" {
+ id = (known after apply)
+ name = (known after apply)
+ principal_id = (known after apply)
+ principal_type = (known after apply)
+ role_definition_id = (known after apply)
+ role_definition_name = "Reader"
+ scope = "/subscriptions/b0e04a4a-a321-4b66-b8fd-13715262ba3c/resourceGroups/demo-tfquickstart-dev-rg/providers/Microsoft.Web/serverFarms/tfq-demo-tfquickstart-dev-app"
+ skip_service_principal_aad_check = (known after apply)
}
Plan: 5 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
```

View File

@ -0,0 +1,35 @@
variable "name" {
type = "string"
description = "Location of the azure resource group."
default = "demo-tfquickstart"
}
variable "environment" {
type = "string"
description = "Name of the deployment environment"
default = "dev"
}
variable "location" {
type = "string"
description = "Location to deploy the resoruce group"
default = "West US 2"
}
variable "dns_prefix" {
type = "string"
description = "A prefix for any dns based resources"
default = "tfq"
}
variable "plan_tier" {
type = "string"
description = "The tier of app service plan to create"
default = "Standard"
}
variable "plan_sku" {
type = "string"
description = "The sku of app service plan to create"
default = "S1"
}

View File

@ -1,5 +1,5 @@
resource "azurerm_resource_group" "webAppMySqlRg" {
name = "${var.rg}"
location = "${var.loc}"
tags = "${var.tags}"
}
resource "azurerm_resource_group" "webAppMySqlRg" {
name = "${var.rg}"
location = "${var.loc}"
tags = "${var.tags}"
}

View File

@ -1,29 +1,29 @@
resource "azurerm_mysql_server" "webAppBackend" {
name = "${var.siteName}pgserver"
location = "${azurerm_resource_group.webAppMySqlRg.location}"
resource_group_name = "${azurerm_resource_group.webAppMySqlRg.name}"
tags = "${azurerm_resource_group.webAppMySqlRg.tags}"
administrator_login = "${var.administratorLogin}"
administrator_login_password = "${var.administratorLoginPassword}"
version = "${var.mysqlVersion}"
ssl_enforcement = "Disabled"
sku {
name = "${var.databaseSkuName}"
capacity = "${var.databaseDTU}"
tier = "${var.databaseSkuTier}"
family = "${var.databaseSkuFamily}"
}
storage_profile {
storage_mb = "${var.databaseSkuSizeMB}"
}
}
resource "azurerm_mysql_database" "webAppBackend" {
name = "${var.siteName}database"
resource_group_name = "${azurerm_resource_group.webAppMySqlRg.name}"
server_name = "${azurerm_mysql_server.webAppBackend.name}"
charset = "utf8"
collation = "utf8_unicode_ci"
resource "azurerm_mysql_server" "webAppBackend" {
name = "${var.siteName}pgserver"
location = "${azurerm_resource_group.webAppMySqlRg.location}"
resource_group_name = "${azurerm_resource_group.webAppMySqlRg.name}"
tags = "${azurerm_resource_group.webAppMySqlRg.tags}"
administrator_login = "${var.administratorLogin}"
administrator_login_password = "${var.administratorLoginPassword}"
version = "${var.mysqlVersion}"
ssl_enforcement = "Disabled"
sku {
name = "${var.databaseSkuName}"
capacity = "${var.databaseDTU}"
tier = "${var.databaseSkuTier}"
family = "${var.databaseSkuFamily}"
}
storage_profile {
storage_mb = "${var.databaseSkuSizeMB}"
}
}
resource "azurerm_mysql_database" "webAppBackend" {
name = "${var.siteName}database"
resource_group_name = "${azurerm_resource_group.webAppMySqlRg.name}"
server_name = "${azurerm_mysql_server.webAppBackend.name}"
charset = "utf8"
collation = "utf8_unicode_ci"
}

View File

@ -1,15 +1,15 @@
output "webAppUrl" {
value = "${azurerm_app_service.webAppFrontend.default_site_hostname}"
}
output "databaseName" {
value = "${azurerm_mysql_database.webAppBackend.name}"
}
output "databaseServerName" {
value = "${azurerm_mysql_server.webAppBackend.fqdn}"
}
output "appServicePlanName" {
value = "${azurerm_app_service_plan.webAppFrontend.name}"
}
output "webAppUrl" {
value = "${azurerm_app_service.webAppFrontend.default_site_hostname}"
}
output "databaseName" {
value = "${azurerm_mysql_database.webAppBackend.name}"
}
output "databaseServerName" {
value = "${azurerm_mysql_server.webAppBackend.fqdn}"
}
output "appServicePlanName" {
value = "${azurerm_app_service_plan.webAppFrontend.name}"
}

View File

@ -1,3 +1,3 @@
provider "azurerm" {
version = "~>1.17"
provider "azurerm" {
version = "~>1.17"
}

View File

@ -1,12 +1,12 @@
rg = "mcg623webAppMysql"
loc = "eastus2"
tags = {
type = "sample"
services = "MySql, WebApp, Azure database"
}
administratorLogin = "markg"
siteName = "mcgecd69mysql"
servicePlanTier = "Standard"
rg = "mcg623webAppMysql"
loc = "eastus2"
tags = {
type = "sample"
services = "MySql, WebApp, Azure database"
}
administratorLogin = "markg"
siteName = "mcgecd69mysql"
servicePlanTier = "Standard"
servicePlanSize = "S1"

View File

@ -1,65 +1,65 @@
variable "rg" {
description = "Azure resource group for all resources."
}
variable "siteName" {
description = "Name of azure web app"
}
variable "tags" {
description = "Azure Tags for all resources."
default = {}
}
variable "administratorLogin" {
description = "Database administrator login name"
}
variable "administratorLoginPassword" {
description = "Database administrator password"
}
variable "databaseDTU" {
description = "Azure database for MySQL pricing tier"
default = 2
}
variable "databaseSkuName" {
description = "Azure database for MySQL sku name"
default = "GP_Gen4_2"
}
variable "databaseSkuFamily" {
description = "Azure database for MySQL sku family"
default = "Gen4"
}
variable "databaseSkuSizeMB" {
description = "Azure database for MySQL Sku Size"
default = 5120
}
variable "databaseSkuTier" {
description = "Azure database for MySQL pricing tier"
default = "GeneralPurpose"
}
variable "mysqlVersion" {
description = "MySQL version"
default = "5.6"
}
variable "loc" {
description = "Location for all resources."
default = "eastus2"
}
variable "servicePlanTier" {
description = "Azure managed application service plan pricing tier"
}
variable "servicePlanSize" {
description = "Azure managed application service plan instance size"
}
variable "rg" {
description = "Azure resource group for all resources."
}
variable "siteName" {
description = "Name of azure web app"
}
variable "tags" {
description = "Azure Tags for all resources."
default = {}
}
variable "administratorLogin" {
description = "Database administrator login name"
}
variable "administratorLoginPassword" {
description = "Database administrator password"
}
variable "databaseDTU" {
description = "Azure database for MySQL pricing tier"
default = 2
}
variable "databaseSkuName" {
description = "Azure database for MySQL sku name"
default = "GP_Gen4_2"
}
variable "databaseSkuFamily" {
description = "Azure database for MySQL sku family"
default = "Gen4"
}
variable "databaseSkuSizeMB" {
description = "Azure database for MySQL Sku Size"
default = 5120
}
variable "databaseSkuTier" {
description = "Azure database for MySQL pricing tier"
default = "GeneralPurpose"
}
variable "mysqlVersion" {
description = "MySQL version"
default = "5.6"
}
variable "loc" {
description = "Location for all resources."
default = "eastus2"
}
variable "servicePlanTier" {
description = "Azure managed application service plan pricing tier"
}
variable "servicePlanSize" {
description = "Azure managed application service plan instance size"
}

View File

@ -1,25 +1,25 @@
resource "azurerm_app_service_plan" "webAppFrontend" {
name = "${var.siteName}serviceplan"
resource_group_name = "${azurerm_resource_group.webAppMySqlRg.name}"
location = "${azurerm_resource_group.webAppMySqlRg.location}"
tags = "${azurerm_resource_group.webAppMySqlRg.tags}"
sku {
tier = "${var.servicePlanTier}"
size = "${var.servicePlanSize}"
}
}
resource "azurerm_app_service" "webAppFrontend" {
name = "${var.siteName}"
location = "${azurerm_resource_group.webAppMySqlRg.location}"
resource_group_name = "${azurerm_resource_group.webAppMySqlRg.name}"
tags = "${azurerm_resource_group.webAppMySqlRg.tags}"
app_service_plan_id = "${azurerm_app_service_plan.webAppFrontend.id}"
connection_string {
name = "DefaultConnect"
type = "MySql"
value = "Database=${azurerm_mysql_database.webAppBackend.name};Data Source=${azurerm_mysql_server.webAppBackend.fqdn};User Id=${var.administratorLogin}@${azurerm_mysql_server.webAppBackend.name};Password=${var.administratorLoginPassword}"
}
resource "azurerm_app_service_plan" "webAppFrontend" {
name = "${var.siteName}serviceplan"
resource_group_name = "${azurerm_resource_group.webAppMySqlRg.name}"
location = "${azurerm_resource_group.webAppMySqlRg.location}"
tags = "${azurerm_resource_group.webAppMySqlRg.tags}"
sku {
tier = "${var.servicePlanTier}"
size = "${var.servicePlanSize}"
}
}
resource "azurerm_app_service" "webAppFrontend" {
name = "${var.siteName}"
location = "${azurerm_resource_group.webAppMySqlRg.location}"
resource_group_name = "${azurerm_resource_group.webAppMySqlRg.name}"
tags = "${azurerm_resource_group.webAppMySqlRg.tags}"
app_service_plan_id = "${azurerm_app_service_plan.webAppFrontend.id}"
connection_string {
name = "DefaultConnect"
type = "MySql"
value = "Database=${azurerm_mysql_database.webAppBackend.name};Data Source=${azurerm_mysql_server.webAppBackend.fqdn};User Id=${var.administratorLogin}@${azurerm_mysql_server.webAppBackend.name};Password=${var.administratorLoginPassword}"
}
}

View File

@ -0,0 +1,36 @@
# Windows Web App for a .NET Application in a VNET
This template deploys an [Azure App Service](https://www.terraform.io/docs/providers/azurerm/r/app_service.html) running Windows configured for a .NET Framework 4.6.2 application. This app service is attached to a private Virtual Network.
## Variables
| Name | Description |
|-|-|
| name | Name of the deployment |
| environment | The depolyment environment name (used for postfixing resource names) |
| prefix | A prefix for globally-unique dns-based resources |
| location | The Azure Region to deploy these resources in |
| plan_tier | The App Service Plan tier to deploy |
| plan_sku | The App Service Plan SKU to deploy|
| vnet_address_range | The address range of the Virtual Network to create |
| subnet_address_space | The address spcae of VNet to reserve for non App Service deployments |
| subnet_appsvc_space | The address space in the VNet to reserve for App Service deployments|
## Usage
```bash
terraform plan \
-var 'name=demo-dotnet' \
-var 'environment=staging' \
-var 'location=West US 2'
-var 'prefix=tfquickstard' \
-var 'plan_tier=standard' \
-var 'plan_sku=s1' \
-out demo.tfplan
terraform apply demo.tfplan
```
\* Example shown with [Bash](https://www.gnu.org/software/bash/). For [Powershell](https://docs.microsoft.com/en-us/powershell/) replace backslashes with backticks.

View File

@ -0,0 +1,40 @@
# Enterprise Azure Kubernetes Service
This template deploys an Azure Kubernetes Service cluster configured for common enterprise usage. The AKS Cluster is deployed inside a private network, with all ingress fronted by an Azure Application Gateway with a Web Application Firewall enabled. an Azure Container Reigstery instance is also deployed, and Managed Identity is leveraged to enable read access to the ACR instance from AKS.
## Resources
| Terraform Resource Type | Description |
| - | - |
| `azurerm_resource_group` | The resource group all resources are deployed into |
| `azurerm_app_service_plan` | The underlying plan that the web app will run on |
| `azurerm_app_service` | The Linux web app |
## Variables
| Name | Description |
|-|-|
| `name` | Name of the deployment |
| `environment` | The depolyment environment name (used for postfixing resource names) |
| `prefix` | A prefix for globally-unique dns-based resources |
| `location` | The Azure Region to deploy these resources in |
| `plan_tier` | The App Service Plan tier to deploy |
| `plan_sku` | The App Service Plan SKU to deploy|
## Usage
```bash
terraform plan \
-var 'name=demo-docker' \
-var 'environment=staging' \
-var 'location=West US 2'
-var 'prefix=tfquickstard' \
-var 'plan_tier=standard' \
-var 'plan_sku=s1' \
-out demo.tfplan
terraform apply demo.tfplan
```
\* Example shown with [Bash](https://www.gnu.org/software/bash/). For [Powershell](https://docs.microsoft.com/en-us/powershell/) replace backslashes with backticks.

View File

@ -0,0 +1,31 @@
# Azure Kubernetes Service with Windows
Sometimes we need multiple node types with AKS. This template deploys an Azure Kubernetes Service cluster with a basic VM pool as well as a node pool of VMs that have GPUs attached.
## Variables
| Name | Description |
|-|-|
| name | Name of the deployment |
| environment | The depolyment environment name (used for postfixing resource names) |
| location | The Azure Region to deploy these resources in |
| vm_sku | The SKU of the VMs to deploy for AKS |
| vm_gpu_sku | The SKU of VMs to deploy for the AKS GPU Nodepool"
| prefix | A DNS Prefix to use in the AKS Cluster |
## Usage
```bash
terraform plan \
-var 'name=demo-dotnet' \
-var 'environment=staging' \
-var 'location=West US 2'
-var 'prefix=tfquickstard' \
-var 'vm_sku=ds1v2' \
-out demo.tfplan
terraform apply demo.tfplan
```
\* Example shown with [Bash](https://www.gnu.org/software/bash/). For [Powershell](https://docs.microsoft.com/en-us/powershell/) replace backslashes with backticks.

View File

@ -0,0 +1,33 @@
# Hub and Spoke networking with 3 VMs
This template deploys three Virtual Networks peered in a Hub and Spoke topology (one hub and two spokes). A Linux Virtual Machine is deploy to each network with SSH enabled so connectivity between each network can be verified after deployment.
## Variables
| Name | Description |
|-|-|
| name | Name of the deployment |
| environment | The depolyment environment name (used for postfixing resource names) |
| location | The Azure Region to deploy these resources in |
| vm_sku | The App Service Plan SKU to deploy|
| vnet_hub_name | The address range of the Virtual Network to create |
| vnet_spoke1_name | The address spcae of VNet to reserve for non App Service deployments |
| vnet_spoke2_name | The address space in the VNet to reserve for App Service deployments|
## Usage
```bash
terraform plan \
-var 'name=demo-dotnet' \
-var 'environment=staging' \
-var 'location=West US 2'
-var 'prefix=tfquickstard' \
-var 'vm_sku=ds1v2' \
-out demo.tfplan
terraform apply demo.tfplan
```
\* Example shown with [Bash](https://www.gnu.org/software/bash/). For [Powershell](https://docs.microsoft.com/en-us/powershell/) replace backslashes with backticks.

View File

@ -0,0 +1,58 @@
resource "azurerm_api_management" "default" {
name = "${var.dns_prefix}-${var.name}-${var.environment}-apim"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
publisher_name = "${var.api_publisher_name}"
publisher_email = "${var.api_publisher_email}"
sku {
name = "Developer"
capacity = 1
}
# Ignore certificate changes in the future
lifecycle {
ignore_changes = [
"certificate"
]
}
# certificate {
# encoded_certificate = "${base64encode(tls_private_key.client.private_key_pem)}"
# certificate_password = ""
# store_name = "Root"
# }
}
resource "azurerm_api_management_api" "default" {
name = "demo"
resource_group_name = "${azurerm_resource_group.default.name}"
api_management_name = "${azurerm_api_management.default.name}"
revision = "1"
display_name = "Demo API"
path = ""
protocols = ["https"]
}
resource "azurerm_api_management_backend" "sf" {
name = "service-fabric-backend"
resource_group_name = "${azurerm_resource_group.default.name}"
api_management_name = "${azurerm_api_management.default.name}"
protocol = "http"
url = "fabric:/fake/service"
resource_id = "${azurerm_service_fabric_cluster.default.management_endpoint}"
service_fabric_cluster {
client_certificate_thumbprint = "${azurerm_key_vault_certificate.client.thumbprint}"
server_certificate_thumbprints = ["${azurerm_key_vault_certificate.cluster.thumbprint}"]
management_endpoints = ["${azurerm_service_fabric_cluster.default.management_endpoint}"]
max_partition_resolution_retries = 3
}
}
resource "azurerm_application_insights" "default" {
name = "${var.name}-${var.environment}-ai"
location = "West US 2"
resource_group_name = "${azurerm_resource_group.default.name}"
application_type = "web"
}

View File

@ -0,0 +1,72 @@
# Service Fabric Cluster
resource "azuread_application" "cluster" {
name = "${var.name}-cluster-${var.environment}"
}
resource "azuread_service_principal" "cluster" {
application_id = "${azuread_application.cluster.application_id}"
}
resource "random_string" "cluster_password" {
length = 32
special = true
}
resource "azuread_service_principal_password" "cluster" {
service_principal_id = "${azuread_service_principal.cluster.id}"
value = "${random_string.cluster_password.result}"
end_date = "2099-01-01T01:00:00Z"
}
# Service Fabric Client
resource "azuread_application" "client" {
name = "${var.name}-client-${var.environment}"
reply_urls = ["https://${azurerm_public_ip.sf.fqdn}:19080/Explorer/index.html"]
app_role {
allowed_member_types = [
"User",
]
description = "Admins can manage roles and perform all task actions"
display_name = "Admin"
is_enabled = true
value = "Admin"
}
app_role {
allowed_member_types = [
"User",
]
description = "ReadOnly roles have limited query access"
display_name = "ReadOnly"
is_enabled = true
value = "User"
}
required_resource_access {
resource_app_id = "00000003-0000-0000-c000-000000000000" # Microsoft Graph API
# DELEGATED PERMISSIONS: "Sign in and read user profile":
resource_access {
id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
type = "Scope"
}
}
}
resource "azuread_service_principal" "client" {
application_id = "${azuread_application.client.application_id}"
}
resource "random_string" "client_password" {
length = 32
special = true
}
resource "azuread_service_principal_password" "client" {
service_principal_id = "${azuread_service_principal.client.id}"
value = "${random_string.client_password.result}"
end_date = "2099-01-01T01:00:00Z"
}

View File

@ -0,0 +1,168 @@
resource "azurerm_key_vault" "cluster" {
name = "${var.dns_prefix}-${substr(var.name,0,12)}-${var.environment_short}-kv"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
tenant_id = "${data.azurerm_client_config.current.tenant_id}"
enabled_for_deployment = true
enabled_for_disk_encryption = true
enabled_for_template_deployment = true
sku_name = "standard"
access_policy {
tenant_id = "${data.azurerm_subscription.current.tenant_id}"
object_id = "${var.client_object_id}"
certificate_permissions = [
"create",
"delete",
"deleteissuers",
"get",
"getissuers",
"import",
"list",
"listissuers",
"managecontacts",
"manageissuers",
"setissuers",
"update",
]
key_permissions = [
"backup",
"create",
"decrypt",
"delete",
"encrypt",
"get",
"import",
"list",
"purge",
"recover",
"restore",
"sign",
"unwrapKey",
"update",
"verify",
"wrapKey",
]
secret_permissions = [
"backup",
"delete",
"get",
"list",
"purge",
"recover",
"restore",
"set",
]
}
}
resource "azurerm_key_vault_certificate" "cluster" {
name = "service-fabric-cluster"
key_vault_id = "${azurerm_key_vault.cluster.id}"
certificate_policy {
issuer_parameters {
name = "Self"
}
key_properties {
exportable = true
key_size = 2048
key_type = "RSA"
reuse_key = true
}
lifetime_action {
action {
action_type = "AutoRenew"
}
trigger {
days_before_expiry = 30
}
}
secret_properties {
content_type = "application/x-pkcs12"
}
x509_certificate_properties {
# Server Authentication = 1.3.6.1.5.5.7.3.1
# Client Authentication = 1.3.6.1.5.5.7.3.2
extended_key_usage = ["1.3.6.1.5.5.7.3.1"]
key_usage = [
"cRLSign",
"dataEncipherment",
"digitalSignature",
"keyAgreement",
"keyCertSign",
"keyEncipherment",
]
subject_alternative_names {
dns_names = ["sfdemosandbox.denvermtc.net"]
}
subject = "CN=mtcdenver"
validity_in_months = 12
}
}
}
resource "azurerm_key_vault_certificate" "client" {
name = "service-fabric-client"
key_vault_id = "${azurerm_key_vault.cluster.id}"
certificate_policy {
issuer_parameters {
name = "Self"
}
key_properties {
exportable = true
key_size = 2048
key_type = "RSA"
reuse_key = true
}
lifetime_action {
action {
action_type = "AutoRenew"
}
trigger {
days_before_expiry = 30
}
}
secret_properties {
content_type = "application/x-pkcs12"
}
x509_certificate_properties {
# Server Authentication = 1.3.6.1.5.5.7.3.1
# Client Authentication = 1.3.6.1.5.5.7.3.2
extended_key_usage = ["1.3.6.1.5.5.7.3.1"]
key_usage = [
"cRLSign",
"dataEncipherment",
"digitalSignature",
"keyAgreement",
"keyCertSign",
"keyEncipherment",
]
subject_alternative_names {
dns_names = ["sfdemosandbox.denvermtc.net"]
}
subject = "CN=mtcdenver"
validity_in_months = 12
}
}
}

View File

@ -0,0 +1,12 @@
data "azurerm_subscription" "current" {}
data "azurerm_client_config" "current" {}
provider "azurerm" {
version = "=1.36.1"
}
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "${var.location}"
}

View File

@ -0,0 +1,100 @@
locals {
feip_config_name = "${var.name}-lb-fe-ipconfig"
}
resource "azurerm_virtual_network" "default" {
name = "${var.name}-vnet"
address_space = ["10.0.0.0/16"]
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
}
resource "azurerm_subnet" "default" {
name = "${var.name}-default-subnet"
resource_group_name = "${azurerm_resource_group.default.name}"
virtual_network_name = "${azurerm_virtual_network.default.name}"
address_prefix = "10.0.0.0/24"
}
resource "azurerm_subnet" "sf" {
name = "${var.name}-sf-subnet"
resource_group_name = "${azurerm_resource_group.default.name}"
virtual_network_name = "${azurerm_virtual_network.default.name}"
address_prefix = "10.0.1.0/24"
}
resource "azurerm_public_ip" "sf" {
name = "${var.name}-pip"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
allocation_method = "Dynamic"
domain_name_label = "${var.dns_prefix}-${var.name}-${var.environment_short}-sf"
}
resource "azurerm_lb" "sf" {
name = "${var.name}-lb"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
frontend_ip_configuration {
name = "${local.feip_config_name}"
public_ip_address_id = "${azurerm_public_ip.sf.id}"
}
}
resource "azurerm_lb_nat_pool" "sf" {
name = "${var.name}-nat-pool"
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
count = "1"
protocol = "Tcp"
frontend_port_start = 3389
frontend_port_end = 4500
backend_port = 3389
frontend_ip_configuration_name = "${local.feip_config_name}"
}
resource "azurerm_lb_backend_address_pool" "sf" {
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
name = "ServiceFabricAddressPool"
}
# Probes
resource "azurerm_lb_probe" "fabric_gateway" {
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
name = "${var.name}-probe-19000"
port = 19000
}
resource "azurerm_lb_probe" "http" {
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
name = "${var.name}-probe-19080"
port = 19080
}
resource "azurerm_lb_rule" "http" {
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
backend_address_pool_id = "${azurerm_lb_backend_address_pool.sf.id}"
probe_id = "${azurerm_lb_probe.http.id}"
name = "http"
protocol = "Tcp"
frontend_port = 19080
backend_port = 19080
frontend_ip_configuration_name = "${local.feip_config_name}"
}
resource "azurerm_lb_rule" "fabric_gateway" {
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
backend_address_pool_id = "${azurerm_lb_backend_address_pool.sf.id}"
probe_id = "${azurerm_lb_probe.fabric_gateway.id}"
name = "fabric_gateway"
protocol = "Tcp"
frontend_port = 19000
backend_port = 19000
frontend_ip_configuration_name = "${local.feip_config_name}"
}

View File

@ -0,0 +1,995 @@
# Service Fabric with APIM.
This template deploys a fully operational Service Fabric cluster running on Windows Virtual Machines in a private Virtual Network. Azure API Management is deployed as a front end gateway with internal Service Fabric services as the backend.
## Resources
| Terraform Resource Type | Description |
| - | - |
| `azurerm_resource_group` | The resource group all resources are deployed into |
| `azuread_application` | The Service Fabric cluster application |
| `azuread_service_principal` | A Service Principal for the Service Fabric Client |
| `azuread_service_principal` | A Service principal for the Service Fabric Cluster |
| `azurerm_key_vault` | |
| `azurerm_key_vault_certificate` | The Cluster Management Certificate |
| `azurerm_key_vault_certificate` | The Client App Certificate |
| `azurerm_lb` | A load balancer that sits in from of the VMs |
| `azurerm_public_ip` | A public IP for the cluster |
| `azurerm_service_fabric_cluster` | The Service Fabric cluster |
| `azurerm_storage_account` | A storage Account for the cluster |
| `azurerm_storage_account` | A Storage Account for the cluster VMs |
| `azurerm_virtual_network` | A Virtual Network for the cluster Nodes |
| `azurerm_subnet` | A Subnet for the cluster nodes |
| `azurerm_subnet` | A Default subnet for other endpoints that may talk with the cluster | `azurerm_subnet` | A subnet for APIM endpoints |
| `azurerm_virtual_machine_scale_set` | The actual cluster nodes |
| `random_string` | The client certificate password |
| `random_string` | The cluster certificate passwords |
| `azurerm_api_management` | The APIM instnace |
| `azurerm_application_insights` | Application Insights for APIM |
## Variables
| Name | Description |
|-|-|
| `name` | Name of the deployment |
| `environment` | The depolyment environment name (used for postfixing resource names) |
| `environment_short` | A 3 or 4 letter string to represent the environment |
| `dns_prefix` | A prefix for globally-unique dns-based resources |
| `cluster_size` | How many nodes to deploy |
| `admin_username` | The Administrator username for the nodes |
| `admin_password` | The Administrator password for the nodes |
| `client_object_id` | A pre-created Client for SF from AAD |
| `api_publisher_name` | The listed APIM publisher name |
| `api_publisher_email` | he listed APIM publisher email |
## Notes
- On first run you will have to add yourself to the access policy for keyvault as terraform has no way to know what your client ID is to create the policy dynamically unless you're running as a service principal (which I don't have currently configured to look for). Just go to KeyVault, add an access policy for yourself, and run terraform apply again.
- NOTE: Vnet support in terraform for APIm does not yet exist - this script creates the network but you must manually join it to the vnet after
- Cert references between KeyVault and APIM are not automatic since the format is different. Download client cert from keyvault and do the following to add a password to the key so you can import from the APIM portal:
```
openssl pkcs12 -in mycert.pfx -out temp.pem
openssl pkcs12 -export -out mycert2.pfx -in temp.pem
## Example
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
data.azurerm_client_config.current: Refreshing state...
data.azurerm_subscription.current: Refreshing state...
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azuread_application.client will be created
+ resource "azuread_application" "client" {
+ application_id = (known after apply)
+ homepage = (known after apply)
+ id = (known after apply)
+ identifier_uris = (known after apply)
+ name = "demo-tfquickstart-client-sandbox"
+ object_id = (known after apply)
+ public_client = (known after apply)
+ reply_urls = (known after apply)
+ type = "webapp/api"
+ app_role {
+ allowed_member_types = [
+ "User",
]
+ description = "Admins can manage roles and perform all task actions"
+ display_name = "Admin"
+ id = (known after apply)
+ is_enabled = true
+ value = "Admin"
}
+ app_role {
+ allowed_member_types = [
+ "User",
]
+ description = "ReadOnly roles have limited query access"
+ display_name = "ReadOnly"
+ id = (known after apply)
+ is_enabled = true
+ value = "User"
}
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
+ required_resource_access {
+ resource_app_id = "00000003-0000-0000-c000-000000000000"
+ resource_access {
+ id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
+ type = "Scope"
}
}
}
# azuread_application.cluster will be created
+ resource "azuread_application" "cluster" {
+ application_id = (known after apply)
+ homepage = (known after apply)
+ id = (known after apply)
+ identifier_uris = (known after apply)
+ name = "demo-tfquickstart-cluster-sandbox"
+ object_id = (known after apply)
+ public_client = (known after apply)
+ reply_urls = (known after apply)
+ type = "webapp/api"
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal.client will be created
+ resource "azuread_service_principal" "client" {
+ application_id = (known after apply)
+ display_name = (known after apply)
+ id = (known after apply)
+ object_id = (known after apply)
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal.cluster will be created
+ resource "azuread_service_principal" "cluster" {
+ application_id = (known after apply)
+ display_name = (known after apply)
+ id = (known after apply)
+ object_id = (known after apply)
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal_password.client will be created
+ resource "azuread_service_principal_password" "client" {
+ end_date = "2099-01-01T01:00:00Z"
+ id = (known after apply)
+ key_id = (known after apply)
+ service_principal_id = (known after apply)
+ start_date = (known after apply)
+ value = (sensitive value)
}
# azuread_service_principal_password.cluster will be created
+ resource "azuread_service_principal_password" "cluster" {
+ end_date = "2099-01-01T01:00:00Z"
+ id = (known after apply)
+ key_id = (known after apply)
+ service_principal_id = (known after apply)
+ start_date = (known after apply)
+ value = (sensitive value)
}
# azurerm_key_vault.cluster will be created
+ resource "azurerm_key_vault" "cluster" {
+ access_policy = [
+ {
+ application_id = null
+ certificate_permissions = [
+ "create",
+ "delete",
+ "deleteissuers",
+ "get",
+ "getissuers",
+ "import",
+ "list",
+ "listissuers",
+ "managecontacts",
+ "manageissuers",
+ "setissuers",
+ "update",
]
+ key_permissions = [
+ "backup",
+ "create",
+ "decrypt",
+ "delete",
+ "encrypt",
+ "get",
+ "import",
+ "list",
+ "purge",
+ "recover",
+ "restore",
+ "sign",
+ "unwrapKey",
+ "update",
+ "verify",
+ "wrapKey",
]
+ object_id = "0938d8bc-3351-4bcc-ddb5-113c2218ff0d"
+ secret_permissions = [
+ "backup",
+ "delete",
+ "get",
+ "list",
+ "purge",
+ "recover",
+ "restore",
+ "set",
]
+ storage_permissions = null
+ tenant_id = "72f988bf-86f1-41af-91ab-2d7cd011db47"
},
]
+ enabled_for_deployment = true
+ enabled_for_disk_encryption = true
+ enabled_for_template_deployment = true
+ id = (known after apply)
+ location = "westus2"
+ name = "tfq-demo-tfquick-sbx-kv"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ sku_name = "standard"
+ tags = (known after apply)
+ tenant_id = "72f988bf-86f1-41af-91ab-2d7cd011db47"
+ vault_uri = (known after apply)
+ sku {
+ name = (known after apply)
}
}
# azurerm_key_vault_certificate.client will be created
+ resource "azurerm_key_vault_certificate" "client" {
+ certificate_data = (known after apply)
+ id = (known after apply)
+ key_vault_id = (known after apply)
+ name = "service-fabric-client"
+ secret_id = (known after apply)
+ tags = (known after apply)
+ thumbprint = (known after apply)
+ vault_uri = (known after apply)
+ version = (known after apply)
+ certificate_policy {
+ issuer_parameters {
+ name = "Self"
}
+ key_properties {
+ exportable = true
+ key_size = 2048
+ key_type = "RSA"
+ reuse_key = true
}
+ lifetime_action {
+ action {
+ action_type = "AutoRenew"
}
+ trigger {
+ days_before_expiry = 30
}
}
+ secret_properties {
+ content_type = "application/x-pkcs12"
}
+ x509_certificate_properties {
+ extended_key_usage = [
+ "1.3.6.1.5.5.7.3.1",
]
+ key_usage = [
+ "cRLSign",
+ "dataEncipherment",
+ "digitalSignature",
+ "keyAgreement",
+ "keyCertSign",
+ "keyEncipherment",
]
+ subject = "CN=mtcdenver"
+ validity_in_months = 12
+ subject_alternative_names {
+ dns_names = [
+ "sfdemosandbox.denvermtc.net",
]
}
}
}
}
# azurerm_key_vault_certificate.cluster will be created
+ resource "azurerm_key_vault_certificate" "cluster" {
+ certificate_data = (known after apply)
+ id = (known after apply)
+ key_vault_id = (known after apply)
+ name = "service-fabric-cluster"
+ secret_id = (known after apply)
+ tags = (known after apply)
+ thumbprint = (known after apply)
+ vault_uri = (known after apply)
+ version = (known after apply)
+ certificate_policy {
+ issuer_parameters {
+ name = "Self"
}
+ key_properties {
+ exportable = true
+ key_size = 2048
+ key_type = "RSA"
+ reuse_key = true
}
+ lifetime_action {
+ action {
+ action_type = "AutoRenew"
}
+ trigger {
+ days_before_expiry = 30
}
}
+ secret_properties {
+ content_type = "application/x-pkcs12"
}
+ x509_certificate_properties {
+ extended_key_usage = [
+ "1.3.6.1.5.5.7.3.1",
]
+ key_usage = [
+ "cRLSign",
+ "dataEncipherment",
+ "digitalSignature",
+ "keyAgreement",
+ "keyCertSign",
+ "keyEncipherment",
]
+ subject = "CN=mtcdenver"
+ validity_in_months = 12
+ subject_alternative_names {
+ dns_names = [
+ "sfdemosandbox.denvermtc.net",
]
}
}
}
}
# azurerm_lb.sf will be created
+ resource "azurerm_lb" "sf" {
+ id = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-lb"
+ private_ip_address = (known after apply)
+ private_ip_addresses = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ sku = "Basic"
+ tags = (known after apply)
+ frontend_ip_configuration {
+ inbound_nat_rules = (known after apply)
+ load_balancer_rules = (known after apply)
+ name = "demo-tfquickstart-lb-fe-ipconfig"
+ outbound_rules = (known after apply)
+ private_ip_address = (known after apply)
+ private_ip_address_allocation = (known after apply)
+ public_ip_address_id = (known after apply)
+ public_ip_prefix_id = (known after apply)
+ subnet_id = (known after apply)
}
}
# azurerm_lb_backend_address_pool.sf will be created
+ resource "azurerm_lb_backend_address_pool" "sf" {
+ backend_ip_configurations = (known after apply)
+ id = (known after apply)
+ load_balancing_rules = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "ServiceFabricAddressPool"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_lb_nat_pool.sf[0] will be created
+ resource "azurerm_lb_nat_pool" "sf" {
+ backend_port = 3389
+ frontend_ip_configuration_id = (known after apply)
+ frontend_ip_configuration_name = "demo-tfquickstart-lb-fe-ipconfig"
+ frontend_port_end = 4500
+ frontend_port_start = 3389
+ id = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "demo-tfquickstart-nat-pool"
+ protocol = "tcp"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_lb_probe.fabric_gateway will be created
+ resource "azurerm_lb_probe" "fabric_gateway" {
+ id = (known after apply)
+ interval_in_seconds = 15
+ load_balancer_rules = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "demo-tfquickstart-probe-19000"
+ number_of_probes = 2
+ port = 19000
+ protocol = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_lb_probe.http will be created
+ resource "azurerm_lb_probe" "http" {
+ id = (known after apply)
+ interval_in_seconds = 15
+ load_balancer_rules = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "demo-tfquickstart-probe-19080"
+ number_of_probes = 2
+ port = 19080
+ protocol = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_lb_rule.fabric_gateway will be created
+ resource "azurerm_lb_rule" "fabric_gateway" {
+ backend_address_pool_id = (known after apply)
+ backend_port = 19000
+ disable_outbound_snat = false
+ enable_floating_ip = false
+ frontend_ip_configuration_id = (known after apply)
+ frontend_ip_configuration_name = "demo-tfquickstart-lb-fe-ipconfig"
+ frontend_port = 19000
+ id = (known after apply)
+ idle_timeout_in_minutes = (known after apply)
+ load_distribution = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "fabric_gateway"
+ probe_id = (known after apply)
+ protocol = "tcp"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_lb_rule.http will be created
+ resource "azurerm_lb_rule" "http" {
+ backend_address_pool_id = (known after apply)
+ backend_port = 19080
+ disable_outbound_snat = false
+ enable_floating_ip = false
+ frontend_ip_configuration_id = (known after apply)
+ frontend_ip_configuration_name = "demo-tfquickstart-lb-fe-ipconfig"
+ frontend_port = 19080
+ id = (known after apply)
+ idle_timeout_in_minutes = (known after apply)
+ load_distribution = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "http"
+ probe_id = (known after apply)
+ protocol = "tcp"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_public_ip.sf will be created
+ resource "azurerm_public_ip" "sf" {
+ allocation_method = "Dynamic"
+ domain_name_label = "tfq-demo-tfquickstart-sbx-sf"
+ fqdn = (known after apply)
+ id = (known after apply)
+ idle_timeout_in_minutes = 4
+ ip_address = (known after apply)
+ ip_version = "IPv4"
+ location = "westus2"
+ name = "demo-tfquickstart-pip"
+ public_ip_address_allocation = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ sku = "Basic"
+ tags = (known after apply)
}
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-sandbox-rg"
+ tags = (known after apply)
}
# azurerm_service_fabric_cluster.default will be created
+ resource "azurerm_service_fabric_cluster" "default" {
+ add_on_features = [
+ "DnsService",
]
+ cluster_code_version = (known after apply)
+ cluster_endpoint = (known after apply)
+ id = (known after apply)
+ location = "westus2"
+ management_endpoint = (known after apply)
+ name = "demo-tfquickstart-sf"
+ reliability_level = "Bronze"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ tags = (known after apply)
+ upgrade_mode = "Automatic"
+ vm_image = "Windows"
+ azure_active_directory {
+ client_application_id = (known after apply)
+ cluster_application_id = (known after apply)
+ tenant_id = "72f988bf-86f1-41af-91ab-2d7cd011db47"
}
+ certificate {
+ thumbprint = (known after apply)
+ thumbprint_secondary = (known after apply)
+ x509_store_name = "My"
}
+ client_certificate_thumbprint {
+ is_admin = true
+ thumbprint = (known after apply)
}
+ diagnostics_config {
+ blob_endpoint = (known after apply)
+ protected_account_key_name = "StorageAccountKey1"
+ queue_endpoint = (known after apply)
+ storage_account_name = "tfqdemotfquickstartsfsbx"
+ table_endpoint = (known after apply)
}
+ fabric_settings {
+ name = "Security"
+ parameters = {
+ "ClusterProtectionLevel" = "EncryptAndSign"
}
}
+ fabric_settings {
+ name = "ClusterManager"
+ parameters = {
+ "EnableDefaultServicesUpgrade" = "True"
}
}
+ node_type {
+ client_endpoint_port = 19000
+ durability_level = "Bronze"
+ http_endpoint_port = 19080
+ instance_count = 3
+ is_primary = true
+ name = "default"
+ application_ports {
+ end_port = 30000
+ start_port = 20000
}
+ ephemeral_ports {
+ end_port = 65534
+ start_port = 49152
}
}
}
# azurerm_storage_account.sf will be created
+ resource "azurerm_storage_account" "sf" {
+ access_tier = (known after apply)
+ account_encryption_source = "Microsoft.Storage"
+ account_kind = "Storage"
+ account_replication_type = "LRS"
+ account_tier = "Standard"
+ account_type = (known after apply)
+ enable_advanced_threat_protection = false
+ enable_blob_encryption = true
+ enable_file_encryption = true
+ id = (known after apply)
+ is_hns_enabled = false
+ location = "westus2"
+ name = "tfqdemotfquickstartsfsbx"
+ primary_access_key = (sensitive value)
+ primary_blob_connection_string = (sensitive value)
+ primary_blob_endpoint = (known after apply)
+ primary_blob_host = (known after apply)
+ primary_connection_string = (sensitive value)
+ primary_dfs_endpoint = (known after apply)
+ primary_dfs_host = (known after apply)
+ primary_file_endpoint = (known after apply)
+ primary_file_host = (known after apply)
+ primary_location = (known after apply)
+ primary_queue_endpoint = (known after apply)
+ primary_queue_host = (known after apply)
+ primary_table_endpoint = (known after apply)
+ primary_table_host = (known after apply)
+ primary_web_endpoint = (known after apply)
+ primary_web_host = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ secondary_access_key = (sensitive value)
+ secondary_blob_connection_string = (sensitive value)
+ secondary_blob_endpoint = (known after apply)
+ secondary_blob_host = (known after apply)
+ secondary_connection_string = (sensitive value)
+ secondary_dfs_endpoint = (known after apply)
+ secondary_dfs_host = (known after apply)
+ secondary_file_endpoint = (known after apply)
+ secondary_file_host = (known after apply)
+ secondary_location = (known after apply)
+ secondary_queue_endpoint = (known after apply)
+ secondary_queue_host = (known after apply)
+ secondary_table_endpoint = (known after apply)
+ secondary_table_host = (known after apply)
+ secondary_web_endpoint = (known after apply)
+ secondary_web_host = (known after apply)
+ tags = (known after apply)
+ identity {
+ principal_id = (known after apply)
+ tenant_id = (known after apply)
+ type = (known after apply)
}
+ network_rules {
+ bypass = (known after apply)
+ default_action = (known after apply)
+ ip_rules = (known after apply)
+ virtual_network_subnet_ids = (known after apply)
}
+ queue_properties {
+ cors_rule {
+ allowed_headers = (known after apply)
+ allowed_methods = (known after apply)
+ allowed_origins = (known after apply)
+ exposed_headers = (known after apply)
+ max_age_in_seconds = (known after apply)
}
+ hour_metrics {
+ enabled = (known after apply)
+ include_apis = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
}
+ logging {
+ delete = (known after apply)
+ read = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
+ write = (known after apply)
}
+ minute_metrics {
+ enabled = (known after apply)
+ include_apis = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
}
}
}
# azurerm_storage_account.vmss will be created
+ resource "azurerm_storage_account" "vmss" {
+ access_tier = (known after apply)
+ account_encryption_source = "Microsoft.Storage"
+ account_kind = "Storage"
+ account_replication_type = "LRS"
+ account_tier = "Standard"
+ account_type = (known after apply)
+ enable_advanced_threat_protection = false
+ enable_blob_encryption = true
+ enable_file_encryption = true
+ id = (known after apply)
+ is_hns_enabled = false
+ location = "westus2"
+ name = "tfqdemotfquicksvmsssbx"
+ primary_access_key = (sensitive value)
+ primary_blob_connection_string = (sensitive value)
+ primary_blob_endpoint = (known after apply)
+ primary_blob_host = (known after apply)
+ primary_connection_string = (sensitive value)
+ primary_dfs_endpoint = (known after apply)
+ primary_dfs_host = (known after apply)
+ primary_file_endpoint = (known after apply)
+ primary_file_host = (known after apply)
+ primary_location = (known after apply)
+ primary_queue_endpoint = (known after apply)
+ primary_queue_host = (known after apply)
+ primary_table_endpoint = (known after apply)
+ primary_table_host = (known after apply)
+ primary_web_endpoint = (known after apply)
+ primary_web_host = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ secondary_access_key = (sensitive value)
+ secondary_blob_connection_string = (sensitive value)
+ secondary_blob_endpoint = (known after apply)
+ secondary_blob_host = (known after apply)
+ secondary_connection_string = (sensitive value)
+ secondary_dfs_endpoint = (known after apply)
+ secondary_dfs_host = (known after apply)
+ secondary_file_endpoint = (known after apply)
+ secondary_file_host = (known after apply)
+ secondary_location = (known after apply)
+ secondary_queue_endpoint = (known after apply)
+ secondary_queue_host = (known after apply)
+ secondary_table_endpoint = (known after apply)
+ secondary_table_host = (known after apply)
+ secondary_web_endpoint = (known after apply)
+ secondary_web_host = (known after apply)
+ tags = (known after apply)
+ identity {
+ principal_id = (known after apply)
+ tenant_id = (known after apply)
+ type = (known after apply)
}
+ network_rules {
+ bypass = (known after apply)
+ default_action = (known after apply)
+ ip_rules = (known after apply)
+ virtual_network_subnet_ids = (known after apply)
}
+ queue_properties {
+ cors_rule {
+ allowed_headers = (known after apply)
+ allowed_methods = (known after apply)
+ allowed_origins = (known after apply)
+ exposed_headers = (known after apply)
+ max_age_in_seconds = (known after apply)
}
+ hour_metrics {
+ enabled = (known after apply)
+ include_apis = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
}
+ logging {
+ delete = (known after apply)
+ read = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
+ write = (known after apply)
}
+ minute_metrics {
+ enabled = (known after apply)
+ include_apis = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
}
}
}
# azurerm_subnet.apim will be created
+ resource "azurerm_subnet" "apim" {
+ address_prefix = "10.0.2.0/24"
+ id = (known after apply)
+ ip_configurations = (known after apply)
+ name = "demo-tfquickstart-apim-subnet"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ virtual_network_name = "demo-tfquickstart-vnet"
}
# azurerm_subnet.default will be created
+ resource "azurerm_subnet" "default" {
+ address_prefix = "10.0.0.0/24"
+ id = (known after apply)
+ ip_configurations = (known after apply)
+ name = "demo-tfquickstart-default-subnet"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ virtual_network_name = "demo-tfquickstart-vnet"
}
# azurerm_subnet.sf will be created
+ resource "azurerm_subnet" "sf" {
+ address_prefix = "10.0.1.0/24"
+ id = (known after apply)
+ ip_configurations = (known after apply)
+ name = "demo-tfquickstart-sf-subnet"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ virtual_network_name = "demo-tfquickstart-vnet"
}
# azurerm_virtual_machine_scale_set.default will be created
+ resource "azurerm_virtual_machine_scale_set" "default" {
+ automatic_os_upgrade = false
+ id = (known after apply)
+ license_type = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-vmss"
+ overprovision = false
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ single_placement_group = true
+ tags = (known after apply)
+ upgrade_policy_mode = "Automatic"
+ boot_diagnostics {
+ enabled = true
+ storage_uri = (known after apply)
}
+ extension {
+ name = "ServiceFabricNodeVmExt_vmDefault"
+ protected_settings = (sensitive value)
+ provision_after_extensions = []
+ publisher = "Microsoft.Azure.ServiceFabric"
+ settings = (known after apply)
+ type = "ServiceFabricNode"
+ type_handler_version = "1.0"
}
+ identity {
+ identity_ids = (known after apply)
+ principal_id = (known after apply)
+ type = (known after apply)
}
+ network_profile {
+ ip_forwarding = false
+ name = "NetworkProfile"
+ primary = true
+ ip_configuration {
+ application_gateway_backend_address_pool_ids = []
+ application_security_group_ids = []
+ load_balancer_backend_address_pool_ids = (known after apply)
+ load_balancer_inbound_nat_rules_ids = (known after apply)
+ name = "IPConfiguration"
+ primary = true
+ subnet_id = (known after apply)
}
}
+ os_profile {
+ admin_password = (sensitive value)
+ admin_username = "tfquickstart"
+ computer_name_prefix = "sfvm"
}
+ os_profile_linux_config {
+ disable_password_authentication = (known after apply)
+ ssh_keys {
+ key_data = (known after apply)
+ path = (known after apply)
}
}
+ os_profile_secrets {
+ source_vault_id = (known after apply)
+ vault_certificates {
+ certificate_store = "My"
+ certificate_url = (known after apply)
}
}
+ os_profile_windows_config {
+ enable_automatic_upgrades = true
+ provision_vm_agent = true
}
+ sku {
+ capacity = 3
+ name = "Standard_D1_v2"
+ tier = "Standard"
}
+ storage_profile_data_disk {
+ caching = "ReadWrite"
+ create_option = "Empty"
+ disk_size_gb = 10
+ lun = 0
+ managed_disk_type = (known after apply)
}
+ storage_profile_image_reference {
+ offer = "WindowsServer"
+ publisher = "MicrosoftWindowsServer"
+ sku = "2019-Datacenter-with-Containers"
+ version = "latest"
}
+ storage_profile_os_disk {
+ caching = "ReadWrite"
+ create_option = "FromImage"
+ managed_disk_type = "Standard_LRS"
+ vhd_containers = []
}
}
# azurerm_virtual_network.default will be created
+ resource "azurerm_virtual_network" "default" {
+ address_space = [
+ "10.0.0.0/16",
]
+ id = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-vnet"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ tags = (known after apply)
+ subnet {
+ address_prefix = (known after apply)
+ id = (known after apply)
+ name = (known after apply)
+ security_group = (known after apply)
}
}
# random_string.client_password will be created
+ resource "random_string" "client_password" {
+ id = (known after apply)
+ length = 32
+ lower = true
+ min_lower = 0
+ min_numeric = 0
+ min_special = 0
+ min_upper = 0
+ number = true
+ result = (known after apply)
+ special = true
+ upper = true
}
# random_string.cluster_password will be created
+ resource "random_string" "cluster_password" {
+ id = (known after apply)
+ length = 32
+ lower = true
+ min_lower = 0
+ min_numeric = 0
+ min_special = 0
+ min_upper = 0
+ number = true
+ result = (known after apply)
+ special = true
+ upper = true
}
Plan: 28 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
```

View File

@ -0,0 +1,78 @@
resource "azurerm_storage_account" "sf" {
name = "${var.dns_prefix}${substr(replace(var.name, "-", ""), 0, 16)}sf${var.environment_short}"
resource_group_name = "${azurerm_resource_group.default.name}"
location = "${azurerm_resource_group.default.location}"
account_tier = "Standard"
account_replication_type = "LRS"
}
resource "azurerm_service_fabric_cluster" "default" {
name = "${var.name}-sf"
resource_group_name = "${azurerm_resource_group.default.name}"
location = "${azurerm_resource_group.default.location}"
reliability_level = "Bronze"
vm_image = "Windows"
management_endpoint = "https://${azurerm_public_ip.sf.fqdn}:19080"
upgrade_mode = "Automatic"
add_on_features = ["DnsService"]
node_type {
name = "default"
instance_count = 3
is_primary = true
client_endpoint_port = 19000
http_endpoint_port = 19080
application_ports {
start_port = 20000
end_port = 30000
}
ephemeral_ports {
start_port = 49152 # possibly open client ports
end_port = 65534
}
}
azure_active_directory {
tenant_id = "${data.azurerm_subscription.current.tenant_id}"
cluster_application_id = "${azuread_application.client.application_id}"
client_application_id = "${azuread_application.cluster.application_id}"
}
fabric_settings {
name = "Security"
parameters = {
"ClusterProtectionLevel" = "EncryptAndSign"
}
}
fabric_settings {
name = "ClusterManager"
parameters = {
EnableDefaultServicesUpgrade = "True"
}
}
certificate {
thumbprint = "${azurerm_key_vault_certificate.cluster.thumbprint}"
thumbprint_secondary = "${azurerm_key_vault_certificate.cluster.thumbprint}"
x509_store_name = "My"
}
client_certificate_thumbprint {
thumbprint = "${azurerm_key_vault_certificate.client.thumbprint}"
is_admin = true
}
diagnostics_config {
storage_account_name = "${azurerm_storage_account.sf.name}"
protected_account_key_name = "StorageAccountKey1"
blob_endpoint = "${azurerm_storage_account.sf.primary_blob_endpoint}"
queue_endpoint = "${azurerm_storage_account.sf.primary_queue_endpoint}"
table_endpoint = "${azurerm_storage_account.sf.primary_table_endpoint}"
}
}

View File

@ -0,0 +1,55 @@
# ----------------------
# General Settings
# ----------------------
variable "name" {
default = "demo-tfquickstart"
}
variable "location" {
default = "West US 2"
}
variable "dns_prefix" {
default = "tfq"
}
variable "environment" {
default = "sandbox"
}
variable "environment_short" {
default = "sbx"
}
# ----------------------
# Service Fabric Cluster Settings
# ----------------------
variable "cluster_size" {
default = 3
}
variable "admin_username" {
default = "tfquickstart"
}
variable "admin_password" {
default = "password.1!"
}
# Your object_id in Azure Active Directory.
# Has to be manually provided when deploying with azure-cli auth.
# Used in creating KeyVault Access Policies
variable "client_object_id" {
default = "0938d8bc-3351-4bcc-ddb5-113c2218ff0d"
}
# ----------------------
# API Management
# ----------------------
variable "api_publisher_name" {
default = "Terraform Quickstarts"
}
variable "api_publisher_email" {
default = "tfquickstart@example.com"
}

View File

@ -0,0 +1,111 @@
resource "azurerm_storage_account" "vmss" {
name = "${var.dns_prefix}${substr(replace(var.name, "-", ""), 0, 12)}vmss${var.environment_short}"
resource_group_name = "${azurerm_resource_group.default.name}"
location = "${azurerm_resource_group.default.location}"
account_tier = "Standard"
account_replication_type = "LRS"
}
# Vm Scale Set
resource "azurerm_virtual_machine_scale_set" "default" {
name = "${var.name}-vmss"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
upgrade_policy_mode = "Automatic"
overprovision = false
sku {
name = "Standard_D1_v2"
tier = "Standard"
capacity = "${var.cluster_size}"
}
storage_profile_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2019-Datacenter-with-Containers"
version = "latest"
}
storage_profile_os_disk {
name = ""
caching = "ReadWrite"
create_option = "FromImage"
managed_disk_type = "Standard_LRS"
}
storage_profile_data_disk {
lun = 0
caching = "ReadWrite"
create_option = "Empty"
disk_size_gb = 10
}
os_profile {
computer_name_prefix = "sfvm"
admin_username = "${var.admin_username}"
admin_password = "${var.admin_password}"
}
os_profile_secrets {
source_vault_id = "${azurerm_key_vault.cluster.id}"
vault_certificates {
certificate_url = "${azurerm_key_vault.cluster.vault_uri}secrets/${azurerm_key_vault_certificate.cluster.name}/${azurerm_key_vault_certificate.cluster.version}"
certificate_store = "My"
}
}
# These default to on if not specified, causing terraform to always want to make changes
os_profile_windows_config {
enable_automatic_upgrades = true
provision_vm_agent = true
}
boot_diagnostics {
enabled = true
storage_uri = "${azurerm_storage_account.vmss.primary_blob_endpoint}"
}
network_profile {
name = "NetworkProfile"
primary = true
ip_configuration {
primary = true
name = "IPConfiguration"
subnet_id = "${azurerm_subnet.sf.id}"
load_balancer_backend_address_pool_ids = ["${azurerm_lb_backend_address_pool.sf.id}"]
load_balancer_inbound_nat_rules_ids = ["${azurerm_lb_nat_pool.sf[0].id}"]
}
}
extension {
name = "ServiceFabricNodeVmExt_vmDefault" # This extension connects vms to the cluster.
publisher = "Microsoft.Azure.ServiceFabric"
type = "ServiceFabricNode"
type_handler_version = "1.0"
settings = <<EOT
{
"certificate": {
"thumbprint": "${azurerm_key_vault_certificate.cluster.thumbprint}",
"x509StoreName": "My"
},
"clusterEndpoint": "${azurerm_service_fabric_cluster.default.cluster_endpoint}",
"nodeTypeRef": "default",
"dataPath": "D:\\SvcFab",
"enableParallelJobs": true,
"durabilityLevel": "Bronze",
"nicPrefixOverride": "10.0.1.0/24"
}
EOT
protected_settings = <<EOT
{
"StorageAccountKey1": "${azurerm_storage_account.sf.primary_access_key}"
}
EOT
}
}

View File

@ -0,0 +1,72 @@
# Service Fabric Cluster
resource "azuread_application" "cluster" {
name = "${var.name}-cluster-${var.environment}"
}
resource "azuread_service_principal" "cluster" {
application_id = "${azuread_application.cluster.application_id}"
}
resource "random_string" "cluster_password" {
length = 32
special = true
}
resource "azuread_service_principal_password" "cluster" {
service_principal_id = "${azuread_service_principal.cluster.id}"
value = "${random_string.cluster_password.result}"
end_date = "2099-01-01T01:00:00Z"
}
# Service Fabric Client
resource "azuread_application" "client" {
name = "${var.name}-client-${var.environment}"
reply_urls = ["https://${azurerm_public_ip.sf.fqdn}:19080/Explorer/index.html"]
app_role {
allowed_member_types = [
"User",
]
description = "Admins can manage roles and perform all task actions"
display_name = "Admin"
is_enabled = true
value = "Admin"
}
app_role {
allowed_member_types = [
"User",
]
description = "ReadOnly roles have limited query access"
display_name = "ReadOnly"
is_enabled = true
value = "User"
}
required_resource_access {
resource_app_id = "00000003-0000-0000-c000-000000000000" # Microsoft Graph API
# DELEGATED PERMISSIONS: "Sign in and read user profile":
resource_access {
id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
type = "Scope"
}
}
}
resource "azuread_service_principal" "client" {
application_id = "${azuread_application.client.application_id}"
}
resource "random_string" "client_password" {
length = 32
special = true
}
resource "azuread_service_principal_password" "client" {
service_principal_id = "${azuread_service_principal.client.id}"
value = "${random_string.client_password.result}"
end_date = "2099-01-01T01:00:00Z"
}

View File

@ -0,0 +1,168 @@
resource "azurerm_key_vault" "cluster" {
name = "${var.dns_prefix}-${substr(var.name,0,12)}-${var.environment_short}-kv"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
tenant_id = "${data.azurerm_client_config.current.tenant_id}"
enabled_for_deployment = true
enabled_for_disk_encryption = true
enabled_for_template_deployment = true
sku_name = "standard"
access_policy {
tenant_id = "${data.azurerm_subscription.current.tenant_id}"
object_id = "${var.client_object_id}"
certificate_permissions = [
"create",
"delete",
"deleteissuers",
"get",
"getissuers",
"import",
"list",
"listissuers",
"managecontacts",
"manageissuers",
"setissuers",
"update",
]
key_permissions = [
"backup",
"create",
"decrypt",
"delete",
"encrypt",
"get",
"import",
"list",
"purge",
"recover",
"restore",
"sign",
"unwrapKey",
"update",
"verify",
"wrapKey",
]
secret_permissions = [
"backup",
"delete",
"get",
"list",
"purge",
"recover",
"restore",
"set",
]
}
}
resource "azurerm_key_vault_certificate" "cluster" {
name = "service-fabric-cluster"
key_vault_id = "${azurerm_key_vault.cluster.id}"
certificate_policy {
issuer_parameters {
name = "Self"
}
key_properties {
exportable = true
key_size = 2048
key_type = "RSA"
reuse_key = true
}
lifetime_action {
action {
action_type = "AutoRenew"
}
trigger {
days_before_expiry = 30
}
}
secret_properties {
content_type = "application/x-pkcs12"
}
x509_certificate_properties {
# Server Authentication = 1.3.6.1.5.5.7.3.1
# Client Authentication = 1.3.6.1.5.5.7.3.2
extended_key_usage = ["1.3.6.1.5.5.7.3.1"]
key_usage = [
"cRLSign",
"dataEncipherment",
"digitalSignature",
"keyAgreement",
"keyCertSign",
"keyEncipherment",
]
subject_alternative_names {
dns_names = ["sfdemosandbox.denvermtc.net"]
}
subject = "CN=mtcdenver"
validity_in_months = 12
}
}
}
resource "azurerm_key_vault_certificate" "client" {
name = "service-fabric-client"
key_vault_id = "${azurerm_key_vault.cluster.id}"
certificate_policy {
issuer_parameters {
name = "Self"
}
key_properties {
exportable = true
key_size = 2048
key_type = "RSA"
reuse_key = true
}
lifetime_action {
action {
action_type = "AutoRenew"
}
trigger {
days_before_expiry = 30
}
}
secret_properties {
content_type = "application/x-pkcs12"
}
x509_certificate_properties {
# Server Authentication = 1.3.6.1.5.5.7.3.1
# Client Authentication = 1.3.6.1.5.5.7.3.2
extended_key_usage = ["1.3.6.1.5.5.7.3.1"]
key_usage = [
"cRLSign",
"dataEncipherment",
"digitalSignature",
"keyAgreement",
"keyCertSign",
"keyEncipherment",
]
subject_alternative_names {
dns_names = ["sfdemosandbox.denvermtc.net"]
}
subject = "CN=mtcdenver"
validity_in_months = 12
}
}
}

View File

@ -0,0 +1,12 @@
data "azurerm_subscription" "current" {}
data "azurerm_client_config" "current" {}
provider "azurerm" {
version = "=1.36.1"
}
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "${var.location}"
}

View File

@ -0,0 +1,100 @@
locals {
feip_config_name = "${var.name}-lb-fe-ipconfig"
}
resource "azurerm_virtual_network" "default" {
name = "${var.name}-vnet"
address_space = ["10.0.0.0/16"]
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
}
resource "azurerm_subnet" "default" {
name = "${var.name}-default-subnet"
resource_group_name = "${azurerm_resource_group.default.name}"
virtual_network_name = "${azurerm_virtual_network.default.name}"
address_prefix = "10.0.0.0/24"
}
resource "azurerm_subnet" "sf" {
name = "${var.name}-sf-subnet"
resource_group_name = "${azurerm_resource_group.default.name}"
virtual_network_name = "${azurerm_virtual_network.default.name}"
address_prefix = "10.0.1.0/24"
}
resource "azurerm_public_ip" "sf" {
name = "${var.name}-pip"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
allocation_method = "Dynamic"
domain_name_label = "${var.dns_prefix}-${var.name}-${var.environment_short}-sf"
}
resource "azurerm_lb" "sf" {
name = "${var.name}-lb"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
frontend_ip_configuration {
name = "${local.feip_config_name}"
public_ip_address_id = "${azurerm_public_ip.sf.id}"
}
}
resource "azurerm_lb_nat_pool" "sf" {
name = "${var.name}-nat-pool"
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
count = "1"
protocol = "Tcp"
frontend_port_start = 3389
frontend_port_end = 4500
backend_port = 3389
frontend_ip_configuration_name = "${local.feip_config_name}"
}
resource "azurerm_lb_backend_address_pool" "sf" {
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
name = "ServiceFabricAddressPool"
}
# Probes
resource "azurerm_lb_probe" "fabric_gateway" {
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
name = "${var.name}-probe-19000"
port = 19000
}
resource "azurerm_lb_probe" "http" {
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
name = "${var.name}-probe-19080"
port = 19080
}
resource "azurerm_lb_rule" "http" {
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
backend_address_pool_id = "${azurerm_lb_backend_address_pool.sf.id}"
probe_id = "${azurerm_lb_probe.http.id}"
name = "http"
protocol = "Tcp"
frontend_port = 19080
backend_port = 19080
frontend_ip_configuration_name = "${local.feip_config_name}"
}
resource "azurerm_lb_rule" "fabric_gateway" {
resource_group_name = "${azurerm_resource_group.default.name}"
loadbalancer_id = "${azurerm_lb.sf.id}"
backend_address_pool_id = "${azurerm_lb_backend_address_pool.sf.id}"
probe_id = "${azurerm_lb_probe.fabric_gateway.id}"
name = "fabric_gateway"
protocol = "Tcp"
frontend_port = 19000
backend_port = 19000
frontend_ip_configuration_name = "${local.feip_config_name}"
}

View File

@ -0,0 +1,992 @@
# Azure Service Fabric Cluster
This template deploys an configured Service Fabric Cluster. Service Fabric provides an application orchestration system on top of IaaS, and all necessary resources to run a cluster are configured within this template.
## Resources
| Terraform Resource Type | Description |
| - | - |
| `azurerm_resource_group` | The resource group all resources are deployed into |
| `azuread_application` | The Service Fabric cluster application |
| `azuread_service_principal` | A Service Principal for the Service Fabric Client |
| `azuread_service_principal` | A Service principal for the Service Fabric Cluster |
| `azurerm_key_vault` | |
| `azurerm_key_vault_certificate` | The Cluster Management Certificate |
| `azurerm_key_vault_certificate` | The Client App Certificate |
| `azurerm_lb` | A load balancer that sits in from of the VMs |
| `azurerm_public_ip` | A public IP for the cluster |
| `azurerm_service_fabric_cluster` | The Service Fabric cluster |
| `azurerm_storage_account` | A storage Account for the cluster |
| `azurerm_storage_account` | A Storage Account for the cluster VMs |
| `azurerm_virtual_network` | A Virtual Network for the cluster Nodes |
| `azurerm_subnet` | A Subnet for the cluster nodes |
| `azurerm_subnet` | A Default subnet for other endpoints that may talk with the cluster |
| `azurerm_virtual_machine_scale_set` | The actual cluster nodes |
| `random_string` | The client certificate password |
| `random_string` | The cluster certificate passwords |
## Variables
| Name | Description |
|-|-|
| `name` | Name of the deployment |
| `environment` | The depolyment environment name (used for postfixing resource names) |
| `environment_short` | A 3 or 4 letter string to represent the environment |
| `dns_prefix` | A prefix for globally-unique dns-based resources |
| `cluster_size` | How many nodes to deploy |
| `admin_username` | The Administrator username for the nodes |
| `admin_password` | The Administrator password for the nodes |
| `client_object_id` | A pre-created Client for SF from AAD |
## Notes
- On first run you will have to add yourself to the access policy for keyvault as terraform has no way to know what your client ID is to create the policy dynamically unless you're running as a service principal (which I don't have currently configured to look for). Just go to KeyVault, add an access policy for yourself, and run terraform apply again.
- NOTE: Vnet support in terraform for APIm does not yet exist - this script creates the network but you must manually join it to the vnet after
- Cert references between KeyVault and APIM are not automatic since the format is different. Download client cert from keyvault and do the following to add a password to the key so you can import from the APIM portal:
```
openssl pkcs12 -in mycert.pfx -out temp.pem
openssl pkcs12 -export -out mycert2.pfx -in temp.pem
## Example
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
data.azurerm_client_config.current: Refreshing state...
data.azurerm_subscription.current: Refreshing state...
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azuread_application.client will be created
+ resource "azuread_application" "client" {
+ application_id = (known after apply)
+ homepage = (known after apply)
+ id = (known after apply)
+ identifier_uris = (known after apply)
+ name = "demo-tfquickstart-client-sandbox"
+ object_id = (known after apply)
+ public_client = (known after apply)
+ reply_urls = (known after apply)
+ type = "webapp/api"
+ app_role {
+ allowed_member_types = [
+ "User",
]
+ description = "Admins can manage roles and perform all task actions"
+ display_name = "Admin"
+ id = (known after apply)
+ is_enabled = true
+ value = "Admin"
}
+ app_role {
+ allowed_member_types = [
+ "User",
]
+ description = "ReadOnly roles have limited query access"
+ display_name = "ReadOnly"
+ id = (known after apply)
+ is_enabled = true
+ value = "User"
}
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
+ required_resource_access {
+ resource_app_id = "00000003-0000-0000-c000-000000000000"
+ resource_access {
+ id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
+ type = "Scope"
}
}
}
# azuread_application.cluster will be created
+ resource "azuread_application" "cluster" {
+ application_id = (known after apply)
+ homepage = (known after apply)
+ id = (known after apply)
+ identifier_uris = (known after apply)
+ name = "demo-tfquickstart-cluster-sandbox"
+ object_id = (known after apply)
+ public_client = (known after apply)
+ reply_urls = (known after apply)
+ type = "webapp/api"
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal.client will be created
+ resource "azuread_service_principal" "client" {
+ application_id = (known after apply)
+ display_name = (known after apply)
+ id = (known after apply)
+ object_id = (known after apply)
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal.cluster will be created
+ resource "azuread_service_principal" "cluster" {
+ application_id = (known after apply)
+ display_name = (known after apply)
+ id = (known after apply)
+ object_id = (known after apply)
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal_password.client will be created
+ resource "azuread_service_principal_password" "client" {
+ end_date = "2099-01-01T01:00:00Z"
+ id = (known after apply)
+ key_id = (known after apply)
+ service_principal_id = (known after apply)
+ start_date = (known after apply)
+ value = (sensitive value)
}
# azuread_service_principal_password.cluster will be created
+ resource "azuread_service_principal_password" "cluster" {
+ end_date = "2099-01-01T01:00:00Z"
+ id = (known after apply)
+ key_id = (known after apply)
+ service_principal_id = (known after apply)
+ start_date = (known after apply)
+ value = (sensitive value)
}
# azurerm_key_vault.cluster will be created
+ resource "azurerm_key_vault" "cluster" {
+ access_policy = [
+ {
+ application_id = null
+ certificate_permissions = [
+ "create",
+ "delete",
+ "deleteissuers",
+ "get",
+ "getissuers",
+ "import",
+ "list",
+ "listissuers",
+ "managecontacts",
+ "manageissuers",
+ "setissuers",
+ "update",
]
+ key_permissions = [
+ "backup",
+ "create",
+ "decrypt",
+ "delete",
+ "encrypt",
+ "get",
+ "import",
+ "list",
+ "purge",
+ "recover",
+ "restore",
+ "sign",
+ "unwrapKey",
+ "update",
+ "verify",
+ "wrapKey",
]
+ object_id = "0938d8bc-3351-4bcc-ddb5-113c2218ff0d"
+ secret_permissions = [
+ "backup",
+ "delete",
+ "get",
+ "list",
+ "purge",
+ "recover",
+ "restore",
+ "set",
]
+ storage_permissions = null
+ tenant_id = "72f988bf-86f1-41af-91ab-2d7cd011db47"
},
]
+ enabled_for_deployment = true
+ enabled_for_disk_encryption = true
+ enabled_for_template_deployment = true
+ id = (known after apply)
+ location = "westus2"
+ name = "tfq-demo-tfquick-sbx-kv"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ sku_name = "standard"
+ tags = (known after apply)
+ tenant_id = "72f988bf-86f1-41af-91ab-2d7cd011db47"
+ vault_uri = (known after apply)
+ sku {
+ name = (known after apply)
}
}
# azurerm_key_vault_certificate.client will be created
+ resource "azurerm_key_vault_certificate" "client" {
+ certificate_data = (known after apply)
+ id = (known after apply)
+ key_vault_id = (known after apply)
+ name = "service-fabric-client"
+ secret_id = (known after apply)
+ tags = (known after apply)
+ thumbprint = (known after apply)
+ vault_uri = (known after apply)
+ version = (known after apply)
+ certificate_policy {
+ issuer_parameters {
+ name = "Self"
}
+ key_properties {
+ exportable = true
+ key_size = 2048
+ key_type = "RSA"
+ reuse_key = true
}
+ lifetime_action {
+ action {
+ action_type = "AutoRenew"
}
+ trigger {
+ days_before_expiry = 30
}
}
+ secret_properties {
+ content_type = "application/x-pkcs12"
}
+ x509_certificate_properties {
+ extended_key_usage = [
+ "1.3.6.1.5.5.7.3.1",
]
+ key_usage = [
+ "cRLSign",
+ "dataEncipherment",
+ "digitalSignature",
+ "keyAgreement",
+ "keyCertSign",
+ "keyEncipherment",
]
+ subject = "CN=mtcdenver"
+ validity_in_months = 12
+ subject_alternative_names {
+ dns_names = [
+ "sfdemosandbox.denvermtc.net",
]
}
}
}
}
# azurerm_key_vault_certificate.cluster will be created
+ resource "azurerm_key_vault_certificate" "cluster" {
+ certificate_data = (known after apply)
+ id = (known after apply)
+ key_vault_id = (known after apply)
+ name = "service-fabric-cluster"
+ secret_id = (known after apply)
+ tags = (known after apply)
+ thumbprint = (known after apply)
+ vault_uri = (known after apply)
+ version = (known after apply)
+ certificate_policy {
+ issuer_parameters {
+ name = "Self"
}
+ key_properties {
+ exportable = true
+ key_size = 2048
+ key_type = "RSA"
+ reuse_key = true
}
+ lifetime_action {
+ action {
+ action_type = "AutoRenew"
}
+ trigger {
+ days_before_expiry = 30
}
}
+ secret_properties {
+ content_type = "application/x-pkcs12"
}
+ x509_certificate_properties {
+ extended_key_usage = [
+ "1.3.6.1.5.5.7.3.1",
]
+ key_usage = [
+ "cRLSign",
+ "dataEncipherment",
+ "digitalSignature",
+ "keyAgreement",
+ "keyCertSign",
+ "keyEncipherment",
]
+ subject = "CN=mtcdenver"
+ validity_in_months = 12
+ subject_alternative_names {
+ dns_names = [
+ "sfdemosandbox.denvermtc.net",
]
}
}
}
}
# azurerm_lb.sf will be created
+ resource "azurerm_lb" "sf" {
+ id = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-lb"
+ private_ip_address = (known after apply)
+ private_ip_addresses = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ sku = "Basic"
+ tags = (known after apply)
+ frontend_ip_configuration {
+ inbound_nat_rules = (known after apply)
+ load_balancer_rules = (known after apply)
+ name = "demo-tfquickstart-lb-fe-ipconfig"
+ outbound_rules = (known after apply)
+ private_ip_address = (known after apply)
+ private_ip_address_allocation = (known after apply)
+ public_ip_address_id = (known after apply)
+ public_ip_prefix_id = (known after apply)
+ subnet_id = (known after apply)
}
}
# azurerm_lb_backend_address_pool.sf will be created
+ resource "azurerm_lb_backend_address_pool" "sf" {
+ backend_ip_configurations = (known after apply)
+ id = (known after apply)
+ load_balancing_rules = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "ServiceFabricAddressPool"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_lb_nat_pool.sf[0] will be created
+ resource "azurerm_lb_nat_pool" "sf" {
+ backend_port = 3389
+ frontend_ip_configuration_id = (known after apply)
+ frontend_ip_configuration_name = "demo-tfquickstart-lb-fe-ipconfig"
+ frontend_port_end = 4500
+ frontend_port_start = 3389
+ id = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "demo-tfquickstart-nat-pool"
+ protocol = "tcp"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_lb_probe.fabric_gateway will be created
+ resource "azurerm_lb_probe" "fabric_gateway" {
+ id = (known after apply)
+ interval_in_seconds = 15
+ load_balancer_rules = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "demo-tfquickstart-probe-19000"
+ number_of_probes = 2
+ port = 19000
+ protocol = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_lb_probe.http will be created
+ resource "azurerm_lb_probe" "http" {
+ id = (known after apply)
+ interval_in_seconds = 15
+ load_balancer_rules = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "demo-tfquickstart-probe-19080"
+ number_of_probes = 2
+ port = 19080
+ protocol = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_lb_rule.fabric_gateway will be created
+ resource "azurerm_lb_rule" "fabric_gateway" {
+ backend_address_pool_id = (known after apply)
+ backend_port = 19000
+ disable_outbound_snat = false
+ enable_floating_ip = false
+ frontend_ip_configuration_id = (known after apply)
+ frontend_ip_configuration_name = "demo-tfquickstart-lb-fe-ipconfig"
+ frontend_port = 19000
+ id = (known after apply)
+ idle_timeout_in_minutes = (known after apply)
+ load_distribution = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "fabric_gateway"
+ probe_id = (known after apply)
+ protocol = "tcp"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_lb_rule.http will be created
+ resource "azurerm_lb_rule" "http" {
+ backend_address_pool_id = (known after apply)
+ backend_port = 19080
+ disable_outbound_snat = false
+ enable_floating_ip = false
+ frontend_ip_configuration_id = (known after apply)
+ frontend_ip_configuration_name = "demo-tfquickstart-lb-fe-ipconfig"
+ frontend_port = 19080
+ id = (known after apply)
+ idle_timeout_in_minutes = (known after apply)
+ load_distribution = (known after apply)
+ loadbalancer_id = (known after apply)
+ name = "http"
+ probe_id = (known after apply)
+ protocol = "tcp"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
}
# azurerm_public_ip.sf will be created
+ resource "azurerm_public_ip" "sf" {
+ allocation_method = "Dynamic"
+ domain_name_label = "tfq-demo-tfquickstart-sbx-sf"
+ fqdn = (known after apply)
+ id = (known after apply)
+ idle_timeout_in_minutes = 4
+ ip_address = (known after apply)
+ ip_version = "IPv4"
+ location = "westus2"
+ name = "demo-tfquickstart-pip"
+ public_ip_address_allocation = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ sku = "Basic"
+ tags = (known after apply)
}
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-sandbox-rg"
+ tags = (known after apply)
}
# azurerm_service_fabric_cluster.default will be created
+ resource "azurerm_service_fabric_cluster" "default" {
+ add_on_features = [
+ "DnsService",
]
+ cluster_code_version = (known after apply)
+ cluster_endpoint = (known after apply)
+ id = (known after apply)
+ location = "westus2"
+ management_endpoint = (known after apply)
+ name = "demo-tfquickstart-sf"
+ reliability_level = "Bronze"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ tags = (known after apply)
+ upgrade_mode = "Automatic"
+ vm_image = "Windows"
+ azure_active_directory {
+ client_application_id = (known after apply)
+ cluster_application_id = (known after apply)
+ tenant_id = "72f988bf-86f1-41af-91ab-2d7cd011db47"
}
+ certificate {
+ thumbprint = (known after apply)
+ thumbprint_secondary = (known after apply)
+ x509_store_name = "My"
}
+ client_certificate_thumbprint {
+ is_admin = true
+ thumbprint = (known after apply)
}
+ diagnostics_config {
+ blob_endpoint = (known after apply)
+ protected_account_key_name = "StorageAccountKey1"
+ queue_endpoint = (known after apply)
+ storage_account_name = "tfqdemotfquickstartsfsbx"
+ table_endpoint = (known after apply)
}
+ fabric_settings {
+ name = "Security"
+ parameters = {
+ "ClusterProtectionLevel" = "EncryptAndSign"
}
}
+ fabric_settings {
+ name = "ClusterManager"
+ parameters = {
+ "EnableDefaultServicesUpgrade" = "True"
}
}
+ node_type {
+ client_endpoint_port = 19000
+ durability_level = "Bronze"
+ http_endpoint_port = 19080
+ instance_count = 3
+ is_primary = true
+ name = "default"
+ application_ports {
+ end_port = 30000
+ start_port = 20000
}
+ ephemeral_ports {
+ end_port = 65534
+ start_port = 49152
}
}
}
# azurerm_storage_account.sf will be created
+ resource "azurerm_storage_account" "sf" {
+ access_tier = (known after apply)
+ account_encryption_source = "Microsoft.Storage"
+ account_kind = "Storage"
+ account_replication_type = "LRS"
+ account_tier = "Standard"
+ account_type = (known after apply)
+ enable_advanced_threat_protection = false
+ enable_blob_encryption = true
+ enable_file_encryption = true
+ id = (known after apply)
+ is_hns_enabled = false
+ location = "westus2"
+ name = "tfqdemotfquickstartsfsbx"
+ primary_access_key = (sensitive value)
+ primary_blob_connection_string = (sensitive value)
+ primary_blob_endpoint = (known after apply)
+ primary_blob_host = (known after apply)
+ primary_connection_string = (sensitive value)
+ primary_dfs_endpoint = (known after apply)
+ primary_dfs_host = (known after apply)
+ primary_file_endpoint = (known after apply)
+ primary_file_host = (known after apply)
+ primary_location = (known after apply)
+ primary_queue_endpoint = (known after apply)
+ primary_queue_host = (known after apply)
+ primary_table_endpoint = (known after apply)
+ primary_table_host = (known after apply)
+ primary_web_endpoint = (known after apply)
+ primary_web_host = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ secondary_access_key = (sensitive value)
+ secondary_blob_connection_string = (sensitive value)
+ secondary_blob_endpoint = (known after apply)
+ secondary_blob_host = (known after apply)
+ secondary_connection_string = (sensitive value)
+ secondary_dfs_endpoint = (known after apply)
+ secondary_dfs_host = (known after apply)
+ secondary_file_endpoint = (known after apply)
+ secondary_file_host = (known after apply)
+ secondary_location = (known after apply)
+ secondary_queue_endpoint = (known after apply)
+ secondary_queue_host = (known after apply)
+ secondary_table_endpoint = (known after apply)
+ secondary_table_host = (known after apply)
+ secondary_web_endpoint = (known after apply)
+ secondary_web_host = (known after apply)
+ tags = (known after apply)
+ identity {
+ principal_id = (known after apply)
+ tenant_id = (known after apply)
+ type = (known after apply)
}
+ network_rules {
+ bypass = (known after apply)
+ default_action = (known after apply)
+ ip_rules = (known after apply)
+ virtual_network_subnet_ids = (known after apply)
}
+ queue_properties {
+ cors_rule {
+ allowed_headers = (known after apply)
+ allowed_methods = (known after apply)
+ allowed_origins = (known after apply)
+ exposed_headers = (known after apply)
+ max_age_in_seconds = (known after apply)
}
+ hour_metrics {
+ enabled = (known after apply)
+ include_apis = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
}
+ logging {
+ delete = (known after apply)
+ read = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
+ write = (known after apply)
}
+ minute_metrics {
+ enabled = (known after apply)
+ include_apis = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
}
}
}
# azurerm_storage_account.vmss will be created
+ resource "azurerm_storage_account" "vmss" {
+ access_tier = (known after apply)
+ account_encryption_source = "Microsoft.Storage"
+ account_kind = "Storage"
+ account_replication_type = "LRS"
+ account_tier = "Standard"
+ account_type = (known after apply)
+ enable_advanced_threat_protection = false
+ enable_blob_encryption = true
+ enable_file_encryption = true
+ id = (known after apply)
+ is_hns_enabled = false
+ location = "westus2"
+ name = "tfqdemotfquicksvmsssbx"
+ primary_access_key = (sensitive value)
+ primary_blob_connection_string = (sensitive value)
+ primary_blob_endpoint = (known after apply)
+ primary_blob_host = (known after apply)
+ primary_connection_string = (sensitive value)
+ primary_dfs_endpoint = (known after apply)
+ primary_dfs_host = (known after apply)
+ primary_file_endpoint = (known after apply)
+ primary_file_host = (known after apply)
+ primary_location = (known after apply)
+ primary_queue_endpoint = (known after apply)
+ primary_queue_host = (known after apply)
+ primary_table_endpoint = (known after apply)
+ primary_table_host = (known after apply)
+ primary_web_endpoint = (known after apply)
+ primary_web_host = (known after apply)
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ secondary_access_key = (sensitive value)
+ secondary_blob_connection_string = (sensitive value)
+ secondary_blob_endpoint = (known after apply)
+ secondary_blob_host = (known after apply)
+ secondary_connection_string = (sensitive value)
+ secondary_dfs_endpoint = (known after apply)
+ secondary_dfs_host = (known after apply)
+ secondary_file_endpoint = (known after apply)
+ secondary_file_host = (known after apply)
+ secondary_location = (known after apply)
+ secondary_queue_endpoint = (known after apply)
+ secondary_queue_host = (known after apply)
+ secondary_table_endpoint = (known after apply)
+ secondary_table_host = (known after apply)
+ secondary_web_endpoint = (known after apply)
+ secondary_web_host = (known after apply)
+ tags = (known after apply)
+ identity {
+ principal_id = (known after apply)
+ tenant_id = (known after apply)
+ type = (known after apply)
}
+ network_rules {
+ bypass = (known after apply)
+ default_action = (known after apply)
+ ip_rules = (known after apply)
+ virtual_network_subnet_ids = (known after apply)
}
+ queue_properties {
+ cors_rule {
+ allowed_headers = (known after apply)
+ allowed_methods = (known after apply)
+ allowed_origins = (known after apply)
+ exposed_headers = (known after apply)
+ max_age_in_seconds = (known after apply)
}
+ hour_metrics {
+ enabled = (known after apply)
+ include_apis = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
}
+ logging {
+ delete = (known after apply)
+ read = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
+ write = (known after apply)
}
+ minute_metrics {
+ enabled = (known after apply)
+ include_apis = (known after apply)
+ retention_policy_days = (known after apply)
+ version = (known after apply)
}
}
}
# azurerm_subnet.apim will be created
+ resource "azurerm_subnet" "apim" {
+ address_prefix = "10.0.2.0/24"
+ id = (known after apply)
+ ip_configurations = (known after apply)
+ name = "demo-tfquickstart-apim-subnet"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ virtual_network_name = "demo-tfquickstart-vnet"
}
# azurerm_subnet.default will be created
+ resource "azurerm_subnet" "default" {
+ address_prefix = "10.0.0.0/24"
+ id = (known after apply)
+ ip_configurations = (known after apply)
+ name = "demo-tfquickstart-default-subnet"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ virtual_network_name = "demo-tfquickstart-vnet"
}
# azurerm_subnet.sf will be created
+ resource "azurerm_subnet" "sf" {
+ address_prefix = "10.0.1.0/24"
+ id = (known after apply)
+ ip_configurations = (known after apply)
+ name = "demo-tfquickstart-sf-subnet"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ virtual_network_name = "demo-tfquickstart-vnet"
}
# azurerm_virtual_machine_scale_set.default will be created
+ resource "azurerm_virtual_machine_scale_set" "default" {
+ automatic_os_upgrade = false
+ id = (known after apply)
+ license_type = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-vmss"
+ overprovision = false
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ single_placement_group = true
+ tags = (known after apply)
+ upgrade_policy_mode = "Automatic"
+ boot_diagnostics {
+ enabled = true
+ storage_uri = (known after apply)
}
+ extension {
+ name = "ServiceFabricNodeVmExt_vmDefault"
+ protected_settings = (sensitive value)
+ provision_after_extensions = []
+ publisher = "Microsoft.Azure.ServiceFabric"
+ settings = (known after apply)
+ type = "ServiceFabricNode"
+ type_handler_version = "1.0"
}
+ identity {
+ identity_ids = (known after apply)
+ principal_id = (known after apply)
+ type = (known after apply)
}
+ network_profile {
+ ip_forwarding = false
+ name = "NetworkProfile"
+ primary = true
+ ip_configuration {
+ application_gateway_backend_address_pool_ids = []
+ application_security_group_ids = []
+ load_balancer_backend_address_pool_ids = (known after apply)
+ load_balancer_inbound_nat_rules_ids = (known after apply)
+ name = "IPConfiguration"
+ primary = true
+ subnet_id = (known after apply)
}
}
+ os_profile {
+ admin_password = (sensitive value)
+ admin_username = "tfquickstart"
+ computer_name_prefix = "sfvm"
}
+ os_profile_linux_config {
+ disable_password_authentication = (known after apply)
+ ssh_keys {
+ key_data = (known after apply)
+ path = (known after apply)
}
}
+ os_profile_secrets {
+ source_vault_id = (known after apply)
+ vault_certificates {
+ certificate_store = "My"
+ certificate_url = (known after apply)
}
}
+ os_profile_windows_config {
+ enable_automatic_upgrades = true
+ provision_vm_agent = true
}
+ sku {
+ capacity = 3
+ name = "Standard_D1_v2"
+ tier = "Standard"
}
+ storage_profile_data_disk {
+ caching = "ReadWrite"
+ create_option = "Empty"
+ disk_size_gb = 10
+ lun = 0
+ managed_disk_type = (known after apply)
}
+ storage_profile_image_reference {
+ offer = "WindowsServer"
+ publisher = "MicrosoftWindowsServer"
+ sku = "2019-Datacenter-with-Containers"
+ version = "latest"
}
+ storage_profile_os_disk {
+ caching = "ReadWrite"
+ create_option = "FromImage"
+ managed_disk_type = "Standard_LRS"
+ vhd_containers = []
}
}
# azurerm_virtual_network.default will be created
+ resource "azurerm_virtual_network" "default" {
+ address_space = [
+ "10.0.0.0/16",
]
+ id = (known after apply)
+ location = "westus2"
+ name = "demo-tfquickstart-vnet"
+ resource_group_name = "demo-tfquickstart-sandbox-rg"
+ tags = (known after apply)
+ subnet {
+ address_prefix = (known after apply)
+ id = (known after apply)
+ name = (known after apply)
+ security_group = (known after apply)
}
}
# random_string.client_password will be created
+ resource "random_string" "client_password" {
+ id = (known after apply)
+ length = 32
+ lower = true
+ min_lower = 0
+ min_numeric = 0
+ min_special = 0
+ min_upper = 0
+ number = true
+ result = (known after apply)
+ special = true
+ upper = true
}
# random_string.cluster_password will be created
+ resource "random_string" "cluster_password" {
+ id = (known after apply)
+ length = 32
+ lower = true
+ min_lower = 0
+ min_numeric = 0
+ min_special = 0
+ min_upper = 0
+ number = true
+ result = (known after apply)
+ special = true
+ upper = true
}
Plan: 28 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
```

View File

@ -0,0 +1,78 @@
resource "azurerm_storage_account" "sf" {
name = "${var.dns_prefix}${substr(replace(var.name, "-", ""), 0, 16)}sf${var.environment_short}"
resource_group_name = "${azurerm_resource_group.default.name}"
location = "${azurerm_resource_group.default.location}"
account_tier = "Standard"
account_replication_type = "LRS"
}
resource "azurerm_service_fabric_cluster" "default" {
name = "${var.name}-sf"
resource_group_name = "${azurerm_resource_group.default.name}"
location = "${azurerm_resource_group.default.location}"
reliability_level = "Bronze"
vm_image = "Windows"
management_endpoint = "https://${azurerm_public_ip.sf.fqdn}:19080"
upgrade_mode = "Automatic"
add_on_features = ["DnsService"]
node_type {
name = "default"
instance_count = 3
is_primary = true
client_endpoint_port = 19000
http_endpoint_port = 19080
application_ports {
start_port = 20000
end_port = 30000
}
ephemeral_ports {
start_port = 49152 # possibly open client ports
end_port = 65534
}
}
azure_active_directory {
tenant_id = "${data.azurerm_subscription.current.tenant_id}"
cluster_application_id = "${azuread_application.client.application_id}"
client_application_id = "${azuread_application.cluster.application_id}"
}
fabric_settings {
name = "Security"
parameters = {
"ClusterProtectionLevel" = "EncryptAndSign"
}
}
fabric_settings {
name = "ClusterManager"
parameters = {
EnableDefaultServicesUpgrade = "True"
}
}
certificate {
thumbprint = "${azurerm_key_vault_certificate.cluster.thumbprint}"
thumbprint_secondary = "${azurerm_key_vault_certificate.cluster.thumbprint}"
x509_store_name = "My"
}
client_certificate_thumbprint {
thumbprint = "${azurerm_key_vault_certificate.client.thumbprint}"
is_admin = true
}
diagnostics_config {
storage_account_name = "${azurerm_storage_account.sf.name}"
protected_account_key_name = "StorageAccountKey1"
blob_endpoint = "${azurerm_storage_account.sf.primary_blob_endpoint}"
queue_endpoint = "${azurerm_storage_account.sf.primary_queue_endpoint}"
table_endpoint = "${azurerm_storage_account.sf.primary_table_endpoint}"
}
}

View File

@ -0,0 +1,44 @@
# ----------------------
# General Settings
# ----------------------
variable "name" {
default = "demo-tfquickstart"
}
variable "location" {
default = "West US 2"
}
variable "dns_prefix" {
default = "tfq"
}
variable "environment" {
default = "sandbox"
}
variable "environment_short" {
default = "sbx"
}
# ----------------------
# Service Fabric Cluster Settings
# ----------------------
variable "cluster_size" {
default = 3
}
variable "admin_username" {
default = "tfquickstart"
}
variable "admin_password" {
default = "password.1!"
}
# Your object_id in Azure Active Directory.
# Has to be manually provided when deploying with azure-cli auth.
# Used in creating KeyVault Access Policies
variable "client_object_id" {
default = "0938d8bc-3351-4bcc-ddb5-113c2218ff0d"
}

View File

@ -0,0 +1,111 @@
resource "azurerm_storage_account" "vmss" {
name = "${var.dns_prefix}${substr(replace(var.name, "-", ""), 0, 12)}vmss${var.environment_short}"
resource_group_name = "${azurerm_resource_group.default.name}"
location = "${azurerm_resource_group.default.location}"
account_tier = "Standard"
account_replication_type = "LRS"
}
# Vm Scale Set
resource "azurerm_virtual_machine_scale_set" "default" {
name = "${var.name}-vmss"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
upgrade_policy_mode = "Automatic"
overprovision = false
sku {
name = "Standard_D1_v2"
tier = "Standard"
capacity = "${var.cluster_size}"
}
storage_profile_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServer"
sku = "2019-Datacenter-with-Containers"
version = "latest"
}
storage_profile_os_disk {
name = ""
caching = "ReadWrite"
create_option = "FromImage"
managed_disk_type = "Standard_LRS"
}
storage_profile_data_disk {
lun = 0
caching = "ReadWrite"
create_option = "Empty"
disk_size_gb = 10
}
os_profile {
computer_name_prefix = "sfvm"
admin_username = "${var.admin_username}"
admin_password = "${var.admin_password}"
}
os_profile_secrets {
source_vault_id = "${azurerm_key_vault.cluster.id}"
vault_certificates {
certificate_url = "${azurerm_key_vault.cluster.vault_uri}secrets/${azurerm_key_vault_certificate.cluster.name}/${azurerm_key_vault_certificate.cluster.version}"
certificate_store = "My"
}
}
# These default to on if not specified, causing terraform to always want to make changes
os_profile_windows_config {
enable_automatic_upgrades = true
provision_vm_agent = true
}
boot_diagnostics {
enabled = true
storage_uri = "${azurerm_storage_account.vmss.primary_blob_endpoint}"
}
network_profile {
name = "NetworkProfile"
primary = true
ip_configuration {
primary = true
name = "IPConfiguration"
subnet_id = "${azurerm_subnet.sf.id}"
load_balancer_backend_address_pool_ids = ["${azurerm_lb_backend_address_pool.sf.id}"]
load_balancer_inbound_nat_rules_ids = ["${azurerm_lb_nat_pool.sf[0].id}"]
}
}
extension {
name = "ServiceFabricNodeVmExt_vmDefault" # This extension connects vms to the cluster.
publisher = "Microsoft.Azure.ServiceFabric"
type = "ServiceFabricNode"
type_handler_version = "1.0"
settings = <<EOT
{
"certificate": {
"thumbprint": "${azurerm_key_vault_certificate.cluster.thumbprint}",
"x509StoreName": "My"
},
"clusterEndpoint": "${azurerm_service_fabric_cluster.default.cluster_endpoint}",
"nodeTypeRef": "default",
"dataPath": "D:\\SvcFab",
"enableParallelJobs": true,
"durabilityLevel": "Bronze",
"nicPrefixOverride": "10.0.1.0/24"
}
EOT
protected_settings = <<EOT
{
"StorageAccountKey1": "${azurerm_storage_account.sf.primary_access_key}"
}
EOT
}
}

45
quickstart/README.md Normal file
View File

@ -0,0 +1,45 @@
# Azure Terraform QuickStart Templates
This repo contains all currently available Azure Terraform templates contributed by the community.
A of now this reposity should be considered in preview. As it grows a set of best-practice guidelines for contributing will be developed and implemented.
# Contributing
This project welcomes contributions and suggestions from the internal Microsoft and public community. See the [**Contribution guide**](/quickstart/CONTRIBUTE.md) for how to use or contribute to this repo.
## Note
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.
## QuickStarts
#### Beginner
- [Static Website hosted on Azure Storage](./101-storage-static-website)
- [Azure Web App hosting a Linux Container](./101-web-app-linux-container)
- [Azure Web App hosting a Java 8 App on Linux](./101-web-app-linux-java)
- [Azure Web App hosting a .NET App on Windows](./101-web-app-windows-dotnet)
#### Intermediate
- [Azure Web App with ACR](./201-web-app-docker-acr/)
- [Azure Kubernetes Service with an Admin Dashboard](./201-aks-rbac-dashboard-admin/)
- [Azure Kubernetes Service with Log Analytics](./201-aks-log-analytics/)
- [Azure Kubernetes Service with Helm](./201-aks-helm/)
- [Azure Kubernetes Service with ACR](./201-aks-acr-identity/)
#### Advanced
- [Azure Service Fabric](./301-service-fabric/)
- [Azure Service Fabric with APIM](./301-service-fabric-apim/)
- [Enterprise-ready AKS](./301-aks-enterprise/)
#### Coming Soon
- [Static Website fronted with an SSL CDN](./201-storage-static-website-cdn-ssl)
- [AKS with GPU node pools](./201-aks-gpu-nodepool/)
- [Azure Web App on Linux with PostgreSQL and KeyVault](./201-web-app-postgres-keyvault/)
- [Azure Web App on Windows in a Vnet](./201-web-app-windows-vnet/)
- [AppGateway fronted VM Scale Set](./201-vmss-appgw-waf/)
- [Azure Pipeline CI/CD for Terraform](./201-azure-pipelines-ci-cd/)
- [AKS with Windows node pools](./301-aks-windows-nodepool/)
- [Hub and Spoke VNet with VMs](./301-hub-spoke-network-3vm/)

View File

@ -1,178 +1,178 @@
{
"$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
"handler": "Microsoft.Compute.MultiVm",
"version": "0.1.2-preview",
"parameters": {
"basics": [
{
"name": "vmName",
"type": "Microsoft.Common.TextBox",
"label": "Name",
"defaultValue": "Terraform",
"toolTip": "",
"constraints": {
"required": true,
"regex": "^[a-z0-9A-Z]{1,54}$",
"validationMessage": "Only alphanumeric characters are allowed, and the value must be 1-54 characters long."
},
"visible": true
},
{
"name": "userName",
"type": "Microsoft.Compute.UserNameTextBox",
"label": "User name",
"defaultValue": "",
"toolTip": "",
"constraints": {
"required": true
},
"osPlatform": "Linux",
"visible": true
},
{
"name": "authType",
"type": "Microsoft.Compute.CredentialsCombo",
"label": {
"authenticationType": "Authentication type",
"password": "Password",
"confirmPassword": "Confirm password",
"sshPublicKey": "SSH public key"
},
"toolTip": {
"authenticationType": "",
"password": "",
"sshPublicKey": ""
},
"constraints": {
"required": true,
"customPasswordRegex": "^(?=.*[A-Za-z])(?=.*\\d)[A-Za-z\\d@#\\$%\\^&\\*-_!+=\\[\\]\\{\\}\\|\\\\:',\\.\\?\\/`~\"\\(\\);]{8,}$",
"customValidationMessage": "The password must contain at least 8 characters, with at least 1 letter and 1 number. Alphanumerical (@#$%^&*-_!+=[]{}|\\:',.?/`~\"();)and special characters are allowed"
},
"options": {
"hideConfirmation": false,
"hidePassword": false
},
"osPlatform": "Linux",
"visible": true
}
],
"steps": [
{
"name": "firstStep",
"label": "Additional Settings",
"bladeTitle": "Additional Settings",
"subLabel": {
"preValidation": "",
"postValidation": "Done"
},
"elements": [
{
"name": "vmSize",
"type": "Microsoft.Compute.SizeSelector",
"label": "Size",
"toolTip": "",
"recommendedSizes": [
"Standard_DS2_v2",
"Standard_DS1_v2",
"Standard_DS11_v2"
],
"constraints": {
"allowedSizes": [
"Standard_B1s",
"Standard_B1ms",
"Standard_B2s",
"Standard_B2ms",
"Standard_B4ms",
"Standard_B8ms",
"Standard_D2s_v3",
"Standard_D4s_v3",
"Standard_D8s_v3",
"Standard_D16s_v3",
"Standard_D32s_v3",
"Standard_D64s_v3",
"Standard_DS1_v2",
"Standard_DS2_v2",
"Standard_DS3_v2",
"Standard_DS4_v2",
"Standard_DS5_v2",
"Standard_DS1",
"Standard_DS2",
"Standard_DS3",
"Standard_DS4",
"Standard_F2s_v2",
"Standard_F4s_v2",
"Standard_F8s_v2",
"Standard_F16s_v2",
"Standard_F32s_v2",
"Standard_F64s_v2",
"Standard_F72s_v2",
"Standard_F1s",
"Standard_F2s",
"Standard_F4s",
"Standard_F8s",
"Standard_F16s",
"Standard_E2s_v3",
"Standard_E4s_v3",
"Standard_E8s_v3",
"Standard_E16s_v3",
"Standard_E32s_v3",
"Standard_E64s_v3",
"Standard_M64s",
"Standard_M64ms",
"Standard_M128s",
"Standard_M128ms",
"Standard_GS1",
"Standard_GS2",
"Standard_GS3",
"Standard_GS4",
"Standard_GS5",
"Standard_DS11_v2",
"Standard_DS12_v2",
"Standard_DS13_v2",
"Standard_DS14_v2",
"Standard_DS15_v2",
"Standard_DS11",
"Standard_DS12",
"Standard_DS13",
"Standard_DS14"
]
},
"osPlatform": "Linux",
"count": 1,
"visible": true
},
{
"name": "vmDiskType",
"type": "Microsoft.Common.OptionsGroup",
"label": "VM disk type",
"defaultValue": "SSD",
"toolTip": "Premium disks (SSD) are backed by solid state drives and offer consistent, low-latency performance. They provide the best balance between price and performance, and are ideal for I/O-intensive applications and production workloads. Standard disks (HDD) are backed by magnetic drives and are preferable for applications where data is accessed infrequently.",
"constraints": {
"allowedValues": [
{
"label": "SSD",
"value": "Premium_LRS"
},
{
"label": "HDD",
"value": "Standard_LRS"
}
]
},
"visible": true
}
]
}
],
"outputs": {
"adminPassword": "[basics('authType').password]",
"adminSSHPublicKey": "[basics('authType').sshPublicKey]",
"adminUserName": "[basics('userName')]",
"authenticationType": "[basics('authType').authenticationType]",
"vmName": "[basics('vmName')]",
"vmSize": "[steps('firstStep').vmSize]",
"storageAccountType": "[steps('firstStep').vmDiskType]",
"location": "[location()]"
}
}
}
{
"$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
"handler": "Microsoft.Compute.MultiVm",
"version": "0.1.2-preview",
"parameters": {
"basics": [
{
"name": "vmName",
"type": "Microsoft.Common.TextBox",
"label": "Name",
"defaultValue": "Terraform",
"toolTip": "",
"constraints": {
"required": true,
"regex": "^[a-z0-9A-Z]{1,54}$",
"validationMessage": "Only alphanumeric characters are allowed, and the value must be 1-54 characters long."
},
"visible": true
},
{
"name": "userName",
"type": "Microsoft.Compute.UserNameTextBox",
"label": "User name",
"defaultValue": "",
"toolTip": "",
"constraints": {
"required": true
},
"osPlatform": "Linux",
"visible": true
},
{
"name": "authType",
"type": "Microsoft.Compute.CredentialsCombo",
"label": {
"authenticationType": "Authentication type",
"password": "Password",
"confirmPassword": "Confirm password",
"sshPublicKey": "SSH public key"
},
"toolTip": {
"authenticationType": "",
"password": "",
"sshPublicKey": ""
},
"constraints": {
"required": true,
"customPasswordRegex": "^(?=.*[A-Za-z])(?=.*\\d)[A-Za-z\\d@#\\$%\\^&\\*-_!+=\\[\\]\\{\\}\\|\\\\:',\\.\\?\\/`~\"\\(\\);]{8,}$",
"customValidationMessage": "The password must contain at least 8 characters, with at least 1 letter and 1 number. Alphanumerical (@#$%^&*-_!+=[]{}|\\:',.?/`~\"();)and special characters are allowed"
},
"options": {
"hideConfirmation": false,
"hidePassword": false
},
"osPlatform": "Linux",
"visible": true
}
],
"steps": [
{
"name": "firstStep",
"label": "Additional Settings",
"bladeTitle": "Additional Settings",
"subLabel": {
"preValidation": "",
"postValidation": "Done"
},
"elements": [
{
"name": "vmSize",
"type": "Microsoft.Compute.SizeSelector",
"label": "Size",
"toolTip": "",
"recommendedSizes": [
"Standard_DS2_v2",
"Standard_DS1_v2",
"Standard_DS11_v2"
],
"constraints": {
"allowedSizes": [
"Standard_B1s",
"Standard_B1ms",
"Standard_B2s",
"Standard_B2ms",
"Standard_B4ms",
"Standard_B8ms",
"Standard_D2s_v3",
"Standard_D4s_v3",
"Standard_D8s_v3",
"Standard_D16s_v3",
"Standard_D32s_v3",
"Standard_D64s_v3",
"Standard_DS1_v2",
"Standard_DS2_v2",
"Standard_DS3_v2",
"Standard_DS4_v2",
"Standard_DS5_v2",
"Standard_DS1",
"Standard_DS2",
"Standard_DS3",
"Standard_DS4",
"Standard_F2s_v2",
"Standard_F4s_v2",
"Standard_F8s_v2",
"Standard_F16s_v2",
"Standard_F32s_v2",
"Standard_F64s_v2",
"Standard_F72s_v2",
"Standard_F1s",
"Standard_F2s",
"Standard_F4s",
"Standard_F8s",
"Standard_F16s",
"Standard_E2s_v3",
"Standard_E4s_v3",
"Standard_E8s_v3",
"Standard_E16s_v3",
"Standard_E32s_v3",
"Standard_E64s_v3",
"Standard_M64s",
"Standard_M64ms",
"Standard_M128s",
"Standard_M128ms",
"Standard_GS1",
"Standard_GS2",
"Standard_GS3",
"Standard_GS4",
"Standard_GS5",
"Standard_DS11_v2",
"Standard_DS12_v2",
"Standard_DS13_v2",
"Standard_DS14_v2",
"Standard_DS15_v2",
"Standard_DS11",
"Standard_DS12",
"Standard_DS13",
"Standard_DS14"
]
},
"osPlatform": "Linux",
"count": 1,
"visible": true
},
{
"name": "vmDiskType",
"type": "Microsoft.Common.OptionsGroup",
"label": "VM disk type",
"defaultValue": "SSD",
"toolTip": "Premium disks (SSD) are backed by solid state drives and offer consistent, low-latency performance. They provide the best balance between price and performance, and are ideal for I/O-intensive applications and production workloads. Standard disks (HDD) are backed by magnetic drives and are preferable for applications where data is accessed infrequently.",
"constraints": {
"allowedValues": [
{
"label": "SSD",
"value": "Premium_LRS"
},
{
"label": "HDD",
"value": "Standard_LRS"
}
]
},
"visible": true
}
]
}
],
"outputs": {
"adminPassword": "[basics('authType').password]",
"adminSSHPublicKey": "[basics('authType').sshPublicKey]",
"adminUserName": "[basics('userName')]",
"authenticationType": "[basics('authType').authenticationType]",
"vmName": "[basics('vmName')]",
"vmSize": "[steps('firstStep').vmSize]",
"storageAccountType": "[steps('firstStep').vmDiskType]",
"location": "[location()]"
}
}
}

View File

@ -1,338 +1,338 @@
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"artifactsLocation": {
"metadata": {
"artifactsBaseUrl": "",
"description": "The base URI where artifacts required by this template are located. When the template is deployed using the accompanying scripts, a private location in the subscription will be used and this value will be automatically generated."
},
"defaultValue": "https://raw.githubusercontent.com/Azure/terraform/master/solution_template/vm-linux-terraform",
"type": "string"
},
"artifactsLocationSasToken": {
"metadata": {
"description": "The sasToken required to access artifactsLocation. When the template is deployed using the accompanying scripts, a sasToken will be automatically generated."
},
"defaultValue": "",
"type": "securestring"
},
"adminPassword": {
"metadata": {
"description": "Password for the Virtual Machine. Will be used only if authenticationType is 'password'"
},
"defaultValue": "",
"type": "securestring"
},
"adminSSHPublicKey": {
"metadata": {
"description": "Public SSH key for the Virtual Machine. Will be used only if authenticationType is 'sshPublicKey'"
},
"defaultValue": "",
"type": "string"
},
"adminUserName": {
"metadata": {
"description": "User name for the Virtual Machine"
},
"type": "string"
},
"authenticationType": {
"metadata": {
"description": "Authentication type (can be 'password' or 'sshPublicKey')"
},
"type": "string"
},
"location": {
"metadata": {
"description": "Azure location where to deploy the resources"
},
"type": "string",
"defaultValue": "[resourceGroup().location]"
},
"vmName": {
"metadata": {
"description": "Virtual Machine Name (also used as a prefix for other resources)"
},
"type": "string",
"defaultValue": "terraform"
},
"vmSize": {
"metadata": {
"description": "Virtual Machine Size"
},
"type": "string",
"defaultValue": "Standard_DS1_v2"
},
"storageAccountType": {
"defaultValue": "Standard_LRS",
"metadata": {
"description": "Storage Account Type"
},
"type": "string"
}
},
"variables": {
"dnsLabelPrefix": "[concat('msi',uniquestring(resourceGroup().id))]",
"infraStorageAccountName": "[take(concat('storeinfra', uniquestring(resourceGroup().id), variables('dnsLabelPrefix')),24)]",
"stateStorageAccountName": "[take(concat('storestate', uniquestring(resourceGroup().id), variables('dnsLabelPrefix')),24)]",
"addressPrefix": "10.0.0.0/16",
"subnetName": "TerraformSubnet",
"subnetPrefix": "10.0.0.0/24",
"nicName": "[concat('nic',uniquestring(resourceGroup().id))]",
"virtualNetworkName": "[concat('vnet',uniquestring(resourceGroup().id))]",
"subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]",
"publicIPAddressName": "[concat('pip',uniquestring(resourceGroup().id))]",
"networkSecurityGroupName": "[concat('nsg',uniquestring(resourceGroup().id))]",
"linuxConfiguration": {
"disablePasswordAuthentication": true,
"ssh": {
"publicKeys": [
{
"path": "[concat('/home/', parameters('adminUserName'), '/.ssh/authorized_keys')]",
"keyData": "[parameters('adminSSHPublicKey')]"
}
]
}
},
"contributor" : "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
"installParm1": "[concat(' -u ', parameters('adminUserName'))]",
"installParm2": "[concat(' -s ', subscription().subscriptionId)]",
"installParm3": "[concat(' -a ', variables('stateStorageAccountName'))]",
"installParm4": "[concat(' -t ', subscription().tenantId)]",
"resourceGuid": "[guid(resourceGroup().id, deployment().name)]"
},
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"name": "[variables('infraStorageAccountName')]",
"apiVersion": "2017-10-01",
"location": "[parameters('location')]",
"sku": {
"name": "Standard_LRS"
},
"kind": "Storage",
"properties": {}
},
{
"type": "Microsoft.Storage/storageAccounts",
"name": "[variables('stateStorageAccountName')]",
"apiVersion": "2017-10-01",
"location": "[parameters('location')]",
"sku": {
"name": "Standard_LRS"
},
"kind": "Storage",
"properties": {}
},
{
"apiVersion": "2017-11-01",
"type": "Microsoft.Network/publicIPAddresses",
"name": "[variables('publicIPAddressName')]",
"location": "[parameters('location')]",
"properties": {
"publicIPAllocationMethod": "Dynamic",
"dnsSettings": {
"domainNameLabel": "[variables('dnsLabelPrefix')]"
}
}
},
{
"apiVersion": "2017-11-01",
"type": "Microsoft.Network/virtualNetworks",
"name": "[variables('virtualNetworkName')]",
"location": "[parameters('location')]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"[variables('addressPrefix')]"
]
},
"subnets": [
{
"name": "[variables('subnetName')]",
"properties": {
"addressPrefix": "[variables('subnetPrefix')]"
}
}
]
}
},
{
"name": "[variables('networkSecurityGroupName')]",
"type": "Microsoft.Network/networkSecurityGroups",
"apiVersion": "2017-11-01",
"location": "[parameters('location')]",
"properties": {
"securityRules": [
{
"name": "default-allow-ssh",
"properties": {
"priority": 1000,
"sourceAddressPrefix": "*",
"protocol": "Tcp",
"destinationPortRange": "22",
"access": "Allow",
"direction": "Inbound",
"sourcePortRange": "*",
"destinationAddressPrefix": "*"
}
},
{
"name": "rdp-rule",
"properties": {
"description": "Allow RDP",
"protocol": "Tcp",
"sourcePortRange": "*",
"destinationPortRange": "3389",
"sourceAddressPrefix": "Internet",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 1001,
"direction": "Inbound"
}
}
]
}
},
{
"apiVersion": "2017-11-01",
"type": "Microsoft.Network/networkInterfaces",
"name": "[variables('nicName')]",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]",
"[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]"
],
"properties": {
"ipConfigurations": [
{
"name": "ipconfig1",
"properties": {
"privateIPAllocationMethod": "Dynamic",
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]"
},
"subnet": {
"id": "[variables('subnetRef')]"
}
}
}
],
"networkSecurityGroup": {
"id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]"
}
}
},
{
"apiVersion": "2017-12-01",
"type": "Microsoft.Compute/virtualMachines",
"name": "[parameters('vmName')]",
"location": "[parameters('location')]",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"hardwareProfile": {
"vmSize": "[parameters('vmSize')]"
},
"osProfile": {
"computerName": "[parameters('vmName')]",
"adminUsername": "[parameters('adminUserName')]",
"adminPassword": "[parameters('adminPassword')]",
"linuxConfiguration": "[if(equals(parameters('authenticationType'), 'password'), json('null'), variables('linuxConfiguration'))]"
},
"storageProfile": {
"imageReference": {
"publisher": "Canonical",
"offer": "UbuntuServer",
"sku": "16.04-LTS",
"version": "latest"
},
"osDisk": {
"createOption": "FromImage",
"managedDisk": {
"storageAccountType": "[parameters('storageAccountType')]"
}
}
},
"networkProfile": {
"networkInterfaces": [
{
"id": "[resourceId('Microsoft.Network/networkInterfaces',variables('nicName'))]"
}
]
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": true,
"storageUri": "[reference(concat('Microsoft.Storage/storageAccounts/', variables('infraStorageAccountName')),'2016-12-01').primaryEndpoints.blob]"
}
}
}
},
{
"type": "Microsoft.Compute/virtualMachines/extensions",
"name": "[concat(parameters('vmName'),'/MSILinuxExtension')]",
"apiVersion": "2017-12-01",
"location": "[parameters('location')]",
"dependsOn": [
"[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
],
"properties": {
"publisher": "Microsoft.ManagedIdentity",
"type": "ManagedIdentityExtensionForLinux",
"typeHandlerVersion": "1.0",
"autoUpgradeMinorVersion": true,
"settings": {
"port": 50342
},
"protectedSettings": {}
}
},
{
"apiVersion": "2017-09-01",
"name": "[variables('resourceGuid')]",
"type": "Microsoft.Authorization/roleAssignments",
"dependsOn": [
"[resourceId('Microsoft.Compute/virtualMachines/extensions/', parameters('vmName'),'MSILinuxExtension')]"
],
"properties": {
"roleDefinitionId": "[variables('contributor')]",
"principalId": "[reference(concat(resourceId('Microsoft.Compute/virtualMachines/', parameters('vmName')),'/providers/Microsoft.ManagedIdentity/Identities/default'),'2015-08-31-PREVIEW').principalId]",
"scope": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name)]"
}
},
{
"name": "[concat(parameters('vmName'),'/customscriptextension')]",
"type": "Microsoft.Compute/virtualMachines/extensions",
"apiVersion": "2017-03-30",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Authorization/roleAssignments', variables('resourceGuid'))]"
],
"properties": {
"publisher": "Microsoft.Azure.Extensions",
"type": "CustomScript",
"typeHandlerVersion": "2.0",
"autoUpgradeMinorVersion": true,
"settings": {
"fileUris": [
"[concat(parameters('artifactsLocation'), '/scripts/infra.sh', parameters('artifactsLocationSasToken'))]",
"[concat(parameters('artifactsLocation'), '/scripts/install.sh', parameters('artifactsLocationSasToken'))]",
"[concat(parameters('artifactsLocation'), '/scripts/azureProviderAndCreds.tf', parameters('artifactsLocationSasToken'))]"
]
},
"protectedSettings": {
"commandToExecute": "[concat('bash infra.sh && bash install.sh ', variables('installParm1'), variables('installParm2'), variables('installParm3'), variables('installParm4'), ' -k ', listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('stateStorageAccountName')), '2017-10-01').keys[0].value, ' -l ', reference(concat(resourceId('Microsoft.Compute/virtualMachines/', parameters('vmName')),'/providers/Microsoft.ManagedIdentity/Identities/default'),'2015-08-31-PREVIEW').principalId)]"
}
}
}
],
"outputs": {
"fqdn": {
"value": "[reference(resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName')),'2017-10-01').dnsSettings.fqdn]",
"type": "string"
}
}
}
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"artifactsLocation": {
"metadata": {
"artifactsBaseUrl": "",
"description": "The base URI where artifacts required by this template are located. When the template is deployed using the accompanying scripts, a private location in the subscription will be used and this value will be automatically generated."
},
"defaultValue": "https://raw.githubusercontent.com/Azure/terraform/master/solution_template/vm-linux-terraform",
"type": "string"
},
"artifactsLocationSasToken": {
"metadata": {
"description": "The sasToken required to access artifactsLocation. When the template is deployed using the accompanying scripts, a sasToken will be automatically generated."
},
"defaultValue": "",
"type": "securestring"
},
"adminPassword": {
"metadata": {
"description": "Password for the Virtual Machine. Will be used only if authenticationType is 'password'"
},
"defaultValue": "",
"type": "securestring"
},
"adminSSHPublicKey": {
"metadata": {
"description": "Public SSH key for the Virtual Machine. Will be used only if authenticationType is 'sshPublicKey'"
},
"defaultValue": "",
"type": "string"
},
"adminUserName": {
"metadata": {
"description": "User name for the Virtual Machine"
},
"type": "string"
},
"authenticationType": {
"metadata": {
"description": "Authentication type (can be 'password' or 'sshPublicKey')"
},
"type": "string"
},
"location": {
"metadata": {
"description": "Azure location where to deploy the resources"
},
"type": "string",
"defaultValue": "[resourceGroup().location]"
},
"vmName": {
"metadata": {
"description": "Virtual Machine Name (also used as a prefix for other resources)"
},
"type": "string",
"defaultValue": "terraform"
},
"vmSize": {
"metadata": {
"description": "Virtual Machine Size"
},
"type": "string",
"defaultValue": "Standard_DS1_v2"
},
"storageAccountType": {
"defaultValue": "Standard_LRS",
"metadata": {
"description": "Storage Account Type"
},
"type": "string"
}
},
"variables": {
"dnsLabelPrefix": "[concat('msi',uniquestring(resourceGroup().id))]",
"infraStorageAccountName": "[take(concat('storeinfra', uniquestring(resourceGroup().id), variables('dnsLabelPrefix')),24)]",
"stateStorageAccountName": "[take(concat('storestate', uniquestring(resourceGroup().id), variables('dnsLabelPrefix')),24)]",
"addressPrefix": "10.0.0.0/16",
"subnetName": "TerraformSubnet",
"subnetPrefix": "10.0.0.0/24",
"nicName": "[concat('nic',uniquestring(resourceGroup().id))]",
"virtualNetworkName": "[concat('vnet',uniquestring(resourceGroup().id))]",
"subnetRef": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('virtualNetworkName'), variables('subnetName'))]",
"publicIPAddressName": "[concat('pip',uniquestring(resourceGroup().id))]",
"networkSecurityGroupName": "[concat('nsg',uniquestring(resourceGroup().id))]",
"linuxConfiguration": {
"disablePasswordAuthentication": true,
"ssh": {
"publicKeys": [
{
"path": "[concat('/home/', parameters('adminUserName'), '/.ssh/authorized_keys')]",
"keyData": "[parameters('adminSSHPublicKey')]"
}
]
}
},
"contributor" : "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Authorization/roleDefinitions/', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
"installParm1": "[concat(' -u ', parameters('adminUserName'))]",
"installParm2": "[concat(' -s ', subscription().subscriptionId)]",
"installParm3": "[concat(' -a ', variables('stateStorageAccountName'))]",
"installParm4": "[concat(' -t ', subscription().tenantId)]",
"resourceGuid": "[guid(resourceGroup().id, deployment().name)]"
},
"resources": [
{
"type": "Microsoft.Storage/storageAccounts",
"name": "[variables('infraStorageAccountName')]",
"apiVersion": "2017-10-01",
"location": "[parameters('location')]",
"sku": {
"name": "Standard_LRS"
},
"kind": "Storage",
"properties": {}
},
{
"type": "Microsoft.Storage/storageAccounts",
"name": "[variables('stateStorageAccountName')]",
"apiVersion": "2017-10-01",
"location": "[parameters('location')]",
"sku": {
"name": "Standard_LRS"
},
"kind": "Storage",
"properties": {}
},
{
"apiVersion": "2017-11-01",
"type": "Microsoft.Network/publicIPAddresses",
"name": "[variables('publicIPAddressName')]",
"location": "[parameters('location')]",
"properties": {
"publicIPAllocationMethod": "Dynamic",
"dnsSettings": {
"domainNameLabel": "[variables('dnsLabelPrefix')]"
}
}
},
{
"apiVersion": "2017-11-01",
"type": "Microsoft.Network/virtualNetworks",
"name": "[variables('virtualNetworkName')]",
"location": "[parameters('location')]",
"properties": {
"addressSpace": {
"addressPrefixes": [
"[variables('addressPrefix')]"
]
},
"subnets": [
{
"name": "[variables('subnetName')]",
"properties": {
"addressPrefix": "[variables('subnetPrefix')]"
}
}
]
}
},
{
"name": "[variables('networkSecurityGroupName')]",
"type": "Microsoft.Network/networkSecurityGroups",
"apiVersion": "2017-11-01",
"location": "[parameters('location')]",
"properties": {
"securityRules": [
{
"name": "default-allow-ssh",
"properties": {
"priority": 1000,
"sourceAddressPrefix": "*",
"protocol": "Tcp",
"destinationPortRange": "22",
"access": "Allow",
"direction": "Inbound",
"sourcePortRange": "*",
"destinationAddressPrefix": "*"
}
},
{
"name": "rdp-rule",
"properties": {
"description": "Allow RDP",
"protocol": "Tcp",
"sourcePortRange": "*",
"destinationPortRange": "3389",
"sourceAddressPrefix": "Internet",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 1001,
"direction": "Inbound"
}
}
]
}
},
{
"apiVersion": "2017-11-01",
"type": "Microsoft.Network/networkInterfaces",
"name": "[variables('nicName')]",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Network/publicIPAddresses/', variables('publicIPAddressName'))]",
"[resourceId('Microsoft.Network/virtualNetworks/', variables('virtualNetworkName'))]"
],
"properties": {
"ipConfigurations": [
{
"name": "ipconfig1",
"properties": {
"privateIPAllocationMethod": "Dynamic",
"publicIPAddress": {
"id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('publicIPAddressName'))]"
},
"subnet": {
"id": "[variables('subnetRef')]"
}
}
}
],
"networkSecurityGroup": {
"id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('networkSecurityGroupName'))]"
}
}
},
{
"apiVersion": "2017-12-01",
"type": "Microsoft.Compute/virtualMachines",
"name": "[parameters('vmName')]",
"location": "[parameters('location')]",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"hardwareProfile": {
"vmSize": "[parameters('vmSize')]"
},
"osProfile": {
"computerName": "[parameters('vmName')]",
"adminUsername": "[parameters('adminUserName')]",
"adminPassword": "[parameters('adminPassword')]",
"linuxConfiguration": "[if(equals(parameters('authenticationType'), 'password'), json('null'), variables('linuxConfiguration'))]"
},
"storageProfile": {
"imageReference": {
"publisher": "Canonical",
"offer": "UbuntuServer",
"sku": "16.04-LTS",
"version": "latest"
},
"osDisk": {
"createOption": "FromImage",
"managedDisk": {
"storageAccountType": "[parameters('storageAccountType')]"
}
}
},
"networkProfile": {
"networkInterfaces": [
{
"id": "[resourceId('Microsoft.Network/networkInterfaces',variables('nicName'))]"
}
]
},
"diagnosticsProfile": {
"bootDiagnostics": {
"enabled": true,
"storageUri": "[reference(concat('Microsoft.Storage/storageAccounts/', variables('infraStorageAccountName')),'2016-12-01').primaryEndpoints.blob]"
}
}
}
},
{
"type": "Microsoft.Compute/virtualMachines/extensions",
"name": "[concat(parameters('vmName'),'/MSILinuxExtension')]",
"apiVersion": "2017-12-01",
"location": "[parameters('location')]",
"dependsOn": [
"[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
],
"properties": {
"publisher": "Microsoft.ManagedIdentity",
"type": "ManagedIdentityExtensionForLinux",
"typeHandlerVersion": "1.0",
"autoUpgradeMinorVersion": true,
"settings": {
"port": 50342
},
"protectedSettings": {}
}
},
{
"apiVersion": "2017-09-01",
"name": "[variables('resourceGuid')]",
"type": "Microsoft.Authorization/roleAssignments",
"dependsOn": [
"[resourceId('Microsoft.Compute/virtualMachines/extensions/', parameters('vmName'),'MSILinuxExtension')]"
],
"properties": {
"roleDefinitionId": "[variables('contributor')]",
"principalId": "[reference(concat(resourceId('Microsoft.Compute/virtualMachines/', parameters('vmName')),'/providers/Microsoft.ManagedIdentity/Identities/default'),'2015-08-31-PREVIEW').principalId]",
"scope": "[concat('/subscriptions/', subscription().subscriptionId, '/resourceGroups/', resourceGroup().name)]"
}
},
{
"name": "[concat(parameters('vmName'),'/customscriptextension')]",
"type": "Microsoft.Compute/virtualMachines/extensions",
"apiVersion": "2017-03-30",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Authorization/roleAssignments', variables('resourceGuid'))]"
],
"properties": {
"publisher": "Microsoft.Azure.Extensions",
"type": "CustomScript",
"typeHandlerVersion": "2.0",
"autoUpgradeMinorVersion": true,
"settings": {
"fileUris": [
"[concat(parameters('artifactsLocation'), '/scripts/infra.sh', parameters('artifactsLocationSasToken'))]",
"[concat(parameters('artifactsLocation'), '/scripts/install.sh', parameters('artifactsLocationSasToken'))]",
"[concat(parameters('artifactsLocation'), '/scripts/azureProviderAndCreds.tf', parameters('artifactsLocationSasToken'))]"
]
},
"protectedSettings": {
"commandToExecute": "[concat('bash infra.sh && bash install.sh ', variables('installParm1'), variables('installParm2'), variables('installParm3'), variables('installParm4'), ' -k ', listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('stateStorageAccountName')), '2017-10-01').keys[0].value, ' -l ', reference(concat(resourceId('Microsoft.Compute/virtualMachines/', parameters('vmName')),'/providers/Microsoft.ManagedIdentity/Identities/default'),'2015-08-31-PREVIEW').principalId)]"
}
}
}
],
"outputs": {
"fqdn": {
"value": "[reference(resourceId('Microsoft.Network/publicIPAddresses',variables('publicIPAddressName')),'2017-10-01').dnsSettings.fqdn]",
"type": "string"
}
}
}