Tips-Of-Mine/terraform-azure
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reorganize, add scaffold folder

Browse Source 
update readmes

clean up tf provider

add readme and initial templates

add initial pass at readmes

more readme updates

update various quickstarts

finish cleaning up 101s

more updates

lots fo template updates

add remaining

more updates
This commit is contained in:
Joey Lorich
2019-10-15 13:03:36 -06:00
committed by Joey Lorich
parent fa82feccc7
commit 415e3caa97
89 changed files with 7503 additions and 1140 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
quickstart/201-aks-helm/aks.tf Normal file
View File

@ -0,0 +1,24 @@
resource "azurerm_kubernetes_cluster" "default" {
name = "${var.name}-aks"
location = "${azurerm_resource_group.default.location}"
resource_group_name = "${azurerm_resource_group.default.name}"
dns_prefix = "${var.dns_prefix}-${var.name}-aks-${var.environment}"
depends_on = ["azurerm_role_assignment.default"]
agent_pool_profile {
name = "default"
count = "${var.node_count}"
vm_size = "${var.node_type}"
os_type = "Linux"
os_disk_size_gb = 30
}
service_principal {
client_id = "${azuread_application.default.application_id}"
client_secret = "${azuread_service_principal_password.default.value}"
}
role_based_access_control {
enabled = true
}
}

24
quickstart/201-aks-helm/azuread.tf Normal file
View File

@ -0,0 +1,24 @@
resource "azuread_application" "default" {
name = "${var.name}-${var.environment}"
}
resource "azuread_service_principal" "default" {
application_id = "${azuread_application.default.application_id}"
}
resource "random_string" "password" {
length = 32
special = true
}
resource "azuread_service_principal_password" "default" {
service_principal_id = "${azuread_service_principal.default.id}"
value = "${random_string.password.result}"
end_date = "2099-01-01T01:00:00Z"
}
resource "azurerm_role_assignment" "default" {
scope = "${data.azurerm_subscription.current.id}/resourceGroups/${azurerm_resource_group.default.name}"
role_definition_name = "Network Contributor"
principal_id = "${azuread_service_principal.default.id}"
}

20
quickstart/201-aks-helm/helm.tf Normal file
View File

@ -0,0 +1,20 @@
# Define the helm provider to use the AKS cluster
provider "helm" {
kubernetes {
host = "${azurerm_kubernetes_cluster.default.kube_config.0.host}"
client_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_certificate)}"
client_key = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_key)}"
cluster_ca_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.cluster_ca_certificate)}"
}
service_account = "tiller"
}
# Install a sample ghost blog
resource "helm_release" "ghost" {
name = "ghost-blog"
chart = "bitnami/ghost"
depends_on = ["kubernetes_cluster_role_binding.tiller"]
}

35
quickstart/201-aks-helm/kubernetes.tf Normal file
View File

@ -0,0 +1,35 @@
# Define Kubernetes provider to use the AKS cluster
provider "kubernetes" {
host = "${azurerm_kubernetes_cluster.default.kube_config.0.host}"
client_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_certificate)}"
client_key = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.client_key)}"
cluster_ca_certificate = "${base64decode(azurerm_kubernetes_cluster.default.kube_config.0.cluster_ca_certificate)}"
}
# Create a service account for the Helm Tiller
resource "kubernetes_service_account" "tiller" {
metadata {
name = "tiller"
namespace = "kube-system"
}
}
# Grant cluster-admin rights to the Tiller Service Account
resource "kubernetes_cluster_role_binding" "tiller" {
metadata {
name = "${kubernetes_service_account.tiller.metadata.0.name}"
}
role_ref {
api_group = "rbac.authorization.k8s.io"
kind = "ClusterRole"
name = "cluster-admin"
}
subject {
kind = "ServiceAccount"
name = "${kubernetes_service_account.tiller.metadata.0.name}"
namespace = "kube-system"
}
}

18
quickstart/201-aks-helm/main.tf Normal file
View File

@ -0,0 +1,18 @@
# The Azure Active Resource Manager Terraform provider
provider "azurerm" {
version = "=1.36.1"
}
# The Azure Active Directory Terraform provider
provider "azuread" {
version = "=0.6.0"
}
# Reference to the current subscription. Used when creating role assignments
data "azurerm_subscription" "current" {}
# The main resource group for this deployment
resource "azurerm_resource_group" "default" {
name = "${var.name}-${var.environment}-rg"
location = "${var.location}"
}

244
quickstart/201-aks-helm/readme.md Normal file
View File

@ -0,0 +1,244 @@
# AKS with Helm
This template deploys an Azure Kubernetes Service cluster then leverages the Kubernetes provider to configure Helm (v2) to manage deployed packages. Once stood up a basic blog demo is deployed.
## Variables
| Name | Description |
|-|-|
| name | Name of the deployment |
| environment | The depolyment environment name (used for postfixing resource names) |
| prefix | A prefix for globally-unique dns-based resources |
| location | The Azure Region to deploy these resources in |
| node_type | The type of node to deploy on (e.g. d1v2) |
| node_count | The number of nodes to deploy |
| dns_prefix | A unique dns prefix |
## Sample
```bash
> terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
data.azurerm_subscription.current: Refreshing state...
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# azuread_application.default will be created
+ resource "azuread_application" "default" {
+ application_id = (known after apply)
+ homepage = (known after apply)
+ id = (known after apply)
+ identifier_uris = (known after apply)
+ name = "quickstart-aks-dev"
+ object_id = (known after apply)
+ public_client = (known after apply)
+ reply_urls = (known after apply)
+ type = "webapp/api"
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal.default will be created
+ resource "azuread_service_principal" "default" {
+ application_id = (known after apply)
+ display_name = (known after apply)
+ id = (known after apply)
+ object_id = (known after apply)
+ oauth2_permissions {
+ admin_consent_description = (known after apply)
+ admin_consent_display_name = (known after apply)
+ id = (known after apply)
+ is_enabled = (known after apply)
+ type = (known after apply)
+ user_consent_description = (known after apply)
+ user_consent_display_name = (known after apply)
+ value = (known after apply)
}
}
# azuread_service_principal_password.default will be created
+ resource "azuread_service_principal_password" "default" {
+ end_date = "2099-01-01T01:00:00Z"
+ id = (known after apply)
+ key_id = (known after apply)
+ service_principal_id = (known after apply)
+ start_date = (known after apply)
+ value = (sensitive value)
}
# azurerm_kubernetes_cluster.default will be created
+ resource "azurerm_kubernetes_cluster" "default" {
+ dns_prefix = "tfquickstart-quickstart-aks-aks-dev"
+ enable_pod_security_policy = (known after apply)
+ fqdn = (known after apply)
+ id = (known after apply)
+ kube_admin_config = (known after apply)
+ kube_admin_config_raw = (sensitive value)
+ kube_config = (known after apply)
+ kube_config_raw = (sensitive value)
+ kubernetes_version = (known after apply)
+ location = "westus2"
+ name = "quickstart-aks-aks"
+ node_resource_group = (known after apply)
+ resource_group_name = "quickstart-aks-dev-rg"
+ tags = (known after apply)
+ addon_profile {
+ aci_connector_linux {
+ enabled = (known after apply)
+ subnet_name = (known after apply)
}
+ azure_policy {
+ enabled = (known after apply)
}
+ http_application_routing {
+ enabled = (known after apply)
+ http_application_routing_zone_name = (known after apply)
}
+ kube_dashboard {
+ enabled = (known after apply)
}
+ oms_agent {
+ enabled = (known after apply)
+ log_analytics_workspace_id = (known after apply)
}
}
+ agent_pool_profile {
+ count = 3
+ dns_prefix = (known after apply)
+ fqdn = (known after apply)
+ max_pods = (known after apply)
+ name = "default"
+ os_disk_size_gb = 30
+ os_type = "Linux"
+ type = "AvailabilitySet"
+ vm_size = "Standard_D1_v2"
}
+ network_profile {
+ dns_service_ip = (known after apply)
+ docker_bridge_cidr = (known after apply)
+ load_balancer_sku = (known after apply)
+ network_plugin = (known after apply)
+ network_policy = (known after apply)
+ pod_cidr = (known after apply)
+ service_cidr = (known after apply)
}
+ role_based_access_control {
+ enabled = true
}
+ service_principal {
+ client_id = (known after apply)
+ client_secret = (sensitive value)
}
}
# azurerm_resource_group.default will be created
+ resource "azurerm_resource_group" "default" {
+ id = (known after apply)
+ location = "westus2"
+ name = "quickstart-aks-dev-rg"
+ tags = (known after apply)
}
# azurerm_role_assignment.default will be created
+ resource "azurerm_role_assignment" "default" {
+ id = (known after apply)
+ name = (known after apply)
+ principal_id = (known after apply)
+ principal_type = (known after apply)
+ role_definition_id = (known after apply)
+ role_definition_name = "Network Contributor"
+ scope = "/subscriptions/b0e04a4a-a321-4b66-b8fd-13715262ba3c/resourceGroups/quickstart-aks-dev-rg"
+ skip_service_principal_aad_check = (known after apply)
}
# kubernetes_cluster_role_binding.tiller will be created
+ resource "kubernetes_cluster_role_binding" "tiller" {
+ id = (known after apply)
+ metadata {
+ generation = (known after apply)
+ name = "tiller"
+ resource_version = (known after apply)
+ self_link = (known after apply)
+ uid = (known after apply)
}
+ role_ref {
+ api_group = "rbac.authorization.k8s.io"
+ kind = "ClusterRole"
+ name = "cluster-admin"
}
+ subject {
+ api_group = (known after apply)
+ kind = "ServiceAccount"
+ name = "tiller"
+ namespace = "kube-system"
}
}
# kubernetes_service_account.tiller will be created
+ resource "kubernetes_service_account" "tiller" {
+ default_secret_name = (known after apply)
+ id = (known after apply)
+ metadata {
+ generation = (known after apply)
+ name = "tiller"
+ namespace = "kube-system"
+ resource_version = (known after apply)
+ self_link = (known after apply)
+ uid = (known after apply)
}
}
# random_string.password will be created
+ resource "random_string" "password" {
+ id = (known after apply)
+ length = 32
+ lower = true
+ min_lower = 0
+ min_numeric = 0
+ min_special = 0
+ min_upper = 0
+ number = true
+ result = (known after apply)
+ special = true
+ upper = true
}
Plan: 9 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
```
\* Example shown with [Bash](https://www.gnu.org/software/bash/). For [Powershell](https://docs.microsoft.com/en-us/powershell/) replace backslashes with backticks.

40
quickstart/201-aks-helm/variables.tf Normal file
View File

@ -0,0 +1,40 @@
// Naming
variable "name" {
type = "string"
description = "Location of the azure resource group."
default = "quickstart-aks"
}
variable "environment" {
type = "string"
description = "Name of the deployment environment"
default = "dev"
}
// Resource information
variable "location" {
type = "string"
description = "Location of the azure resource group."
default = "WestUS2"
}
// Node type information
variable "node_count" {
type = "string"
description = "The number of K8S nodes to provision."
default = 3
}
variable "node_type" {
type = "string"
description = "The size of each node."
default = "Standard_D1_v2"
}
variable "dns_prefix" {
type = "string"
description = "DNS Prefix"
default = "tfquickstart"
}