reorganize, add scaffold folder
update readmes clean up tf provider add readme and initial templates add initial pass at readmes more readme updates update various quickstarts finish cleaning up 101s more updates lots fo template updates add remaining more updates
This commit is contained in:
Joey Lorich
10
quickstart/201-aks-acr-identity/acr.tf
Normal file
10
quickstart/201-aks-acr-identity/acr.tf
Normal file
@ -0,0 +1,10 @@
|
||||
locals {
|
||||
acr_name = "${replace(var.dns_prefix, "-", "")}${replace(var.name, "-", "")}acr"
|
||||
}
|
||||
resource "azurerm_container_registry" "default" {
|
||||
name = "${local.acr_name}"
|
||||
resource_group_name = "${azurerm_resource_group.default.name}"
|
||||
location = "${azurerm_resource_group.default.location}"
|
||||
sku = "Standard"
|
||||
admin_enabled = false
|
||||
}
|
||||
24
quickstart/201-aks-acr-identity/aks.tf
Normal file
24
quickstart/201-aks-acr-identity/aks.tf
Normal file
@ -0,0 +1,24 @@
|
||||
resource "azurerm_kubernetes_cluster" "default" {
|
||||
name = "${var.name}-aks"
|
||||
location = "${azurerm_resource_group.default.location}"
|
||||
resource_group_name = "${azurerm_resource_group.default.name}"
|
||||
dns_prefix = "${var.dns_prefix}-${var.name}-aks-${var.environment}"
|
||||
depends_on = ["azurerm_role_assignment.aks_network", "azurerm_role_assignment.aks_acr"]
|
||||
|
||||
agent_pool_profile {
|
||||
name = "default"
|
||||
count = "${var.node_count}"
|
||||
vm_size = "${var.node_type}"
|
||||
os_type = "Linux"
|
||||
os_disk_size_gb = 30
|
||||
}
|
||||
|
||||
service_principal {
|
||||
client_id = "${azuread_application.default.application_id}"
|
||||
client_secret = "${azuread_service_principal_password.default.value}"
|
||||
}
|
||||
|
||||
role_based_access_control {
|
||||
enabled = true
|
||||
}
|
||||
}
|
||||
30
quickstart/201-aks-acr-identity/azuread.tf
Normal file
30
quickstart/201-aks-acr-identity/azuread.tf
Normal file
@ -0,0 +1,30 @@
|
||||
resource "azuread_application" "default" {
|
||||
name = "${var.name}-${var.environment}"
|
||||
}
|
||||
|
||||
resource "azuread_service_principal" "default" {
|
||||
application_id = "${azuread_application.default.application_id}"
|
||||
}
|
||||
|
||||
resource "random_string" "password" {
|
||||
length = 32
|
||||
special = true
|
||||
}
|
||||
|
||||
resource "azuread_service_principal_password" "default" {
|
||||
service_principal_id = "${azuread_service_principal.default.id}"
|
||||
value = "${random_string.password.result}"
|
||||
end_date = "2099-01-01T01:00:00Z"
|
||||
}
|
||||
|
||||
resource "azurerm_role_assignment" "aks_network" {
|
||||
scope = "${data.azurerm_subscription.current.id}/resourceGroups/${azurerm_resource_group.default.name}"
|
||||
role_definition_name = "Network Contributor"
|
||||
principal_id = "${azuread_service_principal.default.id}"
|
||||
}
|
||||
|
||||
resource "azurerm_role_assignment" "aks_acr" {
|
||||
scope = "${data.azurerm_subscription.current.id}/resourceGroups/${azurerm_resource_group.default.name}/providers/Microsoft.ContainerRegistry/registries/${azurerm_container_registry.default.name}"
|
||||
role_definition_name = "Reader"
|
||||
principal_id = "${azuread_service_principal.default.id}"
|
||||
}
|
||||
18
quickstart/201-aks-acr-identity/main.tf
Normal file
18
quickstart/201-aks-acr-identity/main.tf
Normal file
@ -0,0 +1,18 @@
|
||||
# The Azure Active Resource Manager Terraform provider
|
||||
provider "azurerm" {
|
||||
version = "=1.36.0"
|
||||
}
|
||||
|
||||
# The Azure Active Directory Terraform provider
|
||||
provider "azuread" {
|
||||
version = "=0.6.0"
|
||||
}
|
||||
|
||||
# Reference to the current subscription. Used when creating role assignments
|
||||
data "azurerm_subscription" "current" {}
|
||||
|
||||
# The main resource group for this deployment
|
||||
resource "azurerm_resource_group" "default" {
|
||||
name = "${var.name}-${var.environment}-rg"
|
||||
location = "${var.location}"
|
||||
}
|
||||
226
quickstart/201-aks-acr-identity/readme.md
Normal file
226
quickstart/201-aks-acr-identity/readme.md
Normal file
@ -0,0 +1,226 @@
|
||||
# AKC + ACR with Managed Identity
|
||||
|
||||
This template deploys an Azure Kubernetes Service cluster with a user-assigned Identity along with an Azure Container Registry. The identity of the AKS cluster has an assigned reader role to the ACR instance so AKS can pull containers without needing to have a Docker username and password configured.
|
||||
|
||||
## Variables
|
||||
|
||||
| Name | Description |
|
||||
|-|-|
|
||||
| name | Name of the deployment |
|
||||
| environment | The depolyment environment name (used for postfixing resource names) |
|
||||
| location | The Azure Region to deploy these resources in |
|
||||
| vm_sku | The SKU of the VMs to deploy for AKS |
|
||||
| dns_prefix | A DNS Prefix to use in the AKS Cluster |
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
```bash
|
||||
> terraform plan
|
||||
Refreshing Terraform state in-memory prior to plan...
|
||||
The refreshed state will be used to calculate this plan, but will not be
|
||||
persisted to local or remote state storage.
|
||||
|
||||
data.azurerm_subscription.current: Refreshing state...
|
||||
|
||||
------------------------------------------------------------------------
|
||||
|
||||
An execution plan has been generated and is shown below.
|
||||
Resource actions are indicated with the following symbols:
|
||||
+ create
|
||||
|
||||
Terraform will perform the following actions:
|
||||
|
||||
# azuread_application.default will be created
|
||||
+ resource "azuread_application" "default" {
|
||||
+ application_id = (known after apply)
|
||||
+ homepage = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ identifier_uris = (known after apply)
|
||||
+ name = "demo-tfquickstart-dev"
|
||||
+ object_id = (known after apply)
|
||||
+ public_client = (known after apply)
|
||||
+ reply_urls = (known after apply)
|
||||
+ type = "webapp/api"
|
||||
|
||||
+ oauth2_permissions {
|
||||
+ admin_consent_description = (known after apply)
|
||||
+ admin_consent_display_name = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ is_enabled = (known after apply)
|
||||
+ type = (known after apply)
|
||||
+ user_consent_description = (known after apply)
|
||||
+ user_consent_display_name = (known after apply)
|
||||
+ value = (known after apply)
|
||||
}
|
||||
}
|
||||
|
||||
# azuread_service_principal.default will be created
|
||||
+ resource "azuread_service_principal" "default" {
|
||||
+ application_id = (known after apply)
|
||||
+ display_name = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ object_id = (known after apply)
|
||||
|
||||
+ oauth2_permissions {
|
||||
+ admin_consent_description = (known after apply)
|
||||
+ admin_consent_display_name = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ is_enabled = (known after apply)
|
||||
+ type = (known after apply)
|
||||
+ user_consent_description = (known after apply)
|
||||
+ user_consent_display_name = (known after apply)
|
||||
+ value = (known after apply)
|
||||
}
|
||||
}
|
||||
|
||||
# azuread_service_principal_password.default will be created
|
||||
+ resource "azuread_service_principal_password" "default" {
|
||||
+ end_date = "2099-01-01T01:00:00Z"
|
||||
+ id = (known after apply)
|
||||
+ key_id = (known after apply)
|
||||
+ service_principal_id = (known after apply)
|
||||
+ start_date = (known after apply)
|
||||
+ value = (sensitive value)
|
||||
}
|
||||
|
||||
# azurerm_container_registry.default will be created
|
||||
+ resource "azurerm_container_registry" "default" {
|
||||
+ admin_enabled = false
|
||||
+ admin_password = (sensitive value)
|
||||
+ admin_username = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ location = "westus2"
|
||||
+ login_server = (known after apply)
|
||||
+ name = "tfqdemotfquickstartacr"
|
||||
+ network_rule_set = (known after apply)
|
||||
+ resource_group_name = "demo-tfquickstart-dev-rg"
|
||||
+ sku = "Standard"
|
||||
+ tags = (known after apply)
|
||||
}
|
||||
|
||||
# azurerm_kubernetes_cluster.default will be created
|
||||
+ resource "azurerm_kubernetes_cluster" "default" {
|
||||
+ dns_prefix = "tfq-demo-tfquickstart-aks-dev"
|
||||
+ enable_pod_security_policy = (known after apply)
|
||||
+ fqdn = (known after apply)
|
||||
+ id = (known after apply)
|
||||
+ kube_admin_config = (known after apply)
|
||||
+ kube_admin_config_raw = (sensitive value)
|
||||
+ kube_config = (known after apply)
|
||||
+ kube_config_raw = (sensitive value)
|
||||
+ kubernetes_version = (known after apply)
|
||||
+ location = "westus2"
|
||||
+ name = "demo-tfquickstart-aks"
|
||||
+ node_resource_group = (known after apply)
|
||||
+ resource_group_name = "demo-tfquickstart-dev-rg"
|
||||
+ tags = (known after apply)
|
||||
|
||||
+ addon_profile {
|
||||
+ aci_connector_linux {
|
||||
+ enabled = (known after apply)
|
||||
+ subnet_name = (known after apply)
|
||||
}
|
||||
|
||||
+ azure_policy {
|
||||
+ enabled = (known after apply)
|
||||
}
|
||||
|
||||
+ http_application_routing {
|
||||
+ enabled = (known after apply)
|
||||
+ http_application_routing_zone_name = (known after apply)
|
||||
}
|
||||
|
||||
+ kube_dashboard {
|
||||
+ enabled = (known after apply)
|
||||
}
|
||||
|
||||
+ oms_agent {
|
||||
+ enabled = (known after apply)
|
||||
+ log_analytics_workspace_id = (known after apply)
|
||||
}
|
||||
}
|
||||
|
||||
+ agent_pool_profile {
|
||||
+ count = 3
|
||||
+ dns_prefix = (known after apply)
|
||||
+ fqdn = (known after apply)
|
||||
+ max_pods = (known after apply)
|
||||
+ name = "default"
|
||||
+ os_disk_size_gb = 30
|
||||
+ os_type = "Linux"
|
||||
+ type = "AvailabilitySet"
|
||||
+ vm_size = "Standard_D1_v2"
|
||||
}
|
||||
|
||||
+ network_profile {
|
||||
+ dns_service_ip = (known after apply)
|
||||
+ docker_bridge_cidr = (known after apply)
|
||||
+ load_balancer_sku = (known after apply)
|
||||
+ network_plugin = (known after apply)
|
||||
+ network_policy = (known after apply)
|
||||
+ pod_cidr = (known after apply)
|
||||
+ service_cidr = (known after apply)
|
||||
}
|
||||
|
||||
+ role_based_access_control {
|
||||
+ enabled = true
|
||||
}
|
||||
|
||||
+ service_principal {
|
||||
+ client_id = (known after apply)
|
||||
+ client_secret = (sensitive value)
|
||||
}
|
||||
}
|
||||
|
||||
# azurerm_resource_group.default will be created
|
||||
+ resource "azurerm_resource_group" "default" {
|
||||
+ id = (known after apply)
|
||||
+ location = "westus2"
|
||||
+ name = "demo-tfquickstart-dev-rg"
|
||||
+ tags = (known after apply)
|
||||
}
|
||||
|
||||
# azurerm_role_assignment.aks_acr will be created
|
||||
+ resource "azurerm_role_assignment" "aks_acr" {
|
||||
+ id = (known after apply)
|
||||
+ name = (known after apply)
|
||||
+ principal_id = (known after apply)
|
||||
+ principal_type = (known after apply)
|
||||
+ role_definition_id = (known after apply)
|
||||
+ role_definition_name = "Reader"
|
||||
+ scope = "/subscriptions/b0e04a4a-a321-4b66-b8fd-13715262ba3c/resourceGroups/demo-tfquickstart-dev-rg/providers/Microsoft.ContainerRegistry/registries/tfqdemotfquickstartacr"
|
||||
+ skip_service_principal_aad_check = (known after apply)
|
||||
}
|
||||
|
||||
# azurerm_role_assignment.aks_network will be created
|
||||
+ resource "azurerm_role_assignment" "aks_network" {
|
||||
+ id = (known after apply)
|
||||
+ name = (known after apply)
|
||||
+ principal_id = (known after apply)
|
||||
+ principal_type = (known after apply)
|
||||
+ role_definition_id = (known after apply)
|
||||
+ role_definition_name = "Network Contributor"
|
||||
+ scope = "/subscriptions/b0e04a4a-a321-4b66-b8fd-13715262ba3c/resourceGroups/demo-tfquickstart-dev-rg"
|
||||
+ skip_service_principal_aad_check = (known after apply)
|
||||
}
|
||||
|
||||
# random_string.password will be created
|
||||
+ resource "random_string" "password" {
|
||||
+ id = (known after apply)
|
||||
+ length = 32
|
||||
+ lower = true
|
||||
+ min_lower = 0
|
||||
+ min_numeric = 0
|
||||
+ min_special = 0
|
||||
+ min_upper = 0
|
||||
+ number = true
|
||||
+ result = (known after apply)
|
||||
+ special = true
|
||||
+ upper = true
|
||||
}
|
||||
|
||||
Plan: 9 to add, 0 to change, 0 to destroy.
|
||||
|
||||
------------------------------------------------------------------------
|
||||
```
|
||||
40
quickstart/201-aks-acr-identity/variables.tf
Normal file
40
quickstart/201-aks-acr-identity/variables.tf
Normal file
@ -0,0 +1,40 @@
|
||||
// Naming
|
||||
variable "name" {
|
||||
type = "string"
|
||||
description = "Location of the azure resource group."
|
||||
default = "demo-tfquickstart"
|
||||
}
|
||||
|
||||
variable "environment" {
|
||||
type = "string"
|
||||
description = "Name of the deployment environment"
|
||||
default = "dev"
|
||||
}
|
||||
|
||||
// Resource information
|
||||
|
||||
variable "location" {
|
||||
type = "string"
|
||||
description = "Location of the azure resource group."
|
||||
default = "WestUS2"
|
||||
}
|
||||
|
||||
// Node type information
|
||||
|
||||
variable "node_count" {
|
||||
type = "string"
|
||||
description = "The number of K8S nodes to provision."
|
||||
default = 3
|
||||
}
|
||||
|
||||
variable "node_type" {
|
||||
type = "string"
|
||||
description = "The size of each node."
|
||||
default = "Standard_D1_v2"
|
||||
}
|
||||
|
||||
variable "dns_prefix" {
|
||||
type = "string"
|
||||
description = "DNS Prefix"
|
||||
default = "tfq"
|
||||
}
|
||||
Reference in New Issue
Block a user