Terraform & Azure

Copyright © 2019 HashiCorp
Terraform & Azure
Tom Harvey @tombuildsstuff
Terraform Engineer, HashiCorp

s
What’s the state of play?
!3
Azure @ HashiCorp

▪ Vagrant has an Azure plugin that allows
provisioning Vagrant machines in Azure
▪ https://github.com/Azure/vagrant-azure
!6
Vagrant & Azure
Provisioning a virtual
machine in Azure

Copyright © 2019 HashiCorp !7
Provisioning a virtual
machine in Azure
Vagrant & Azure
Vagrant.configure('2') do |config|
config.vm.box = 'azure'
# use local ssh key to connect to remote vagrant box
config.ssh.private_key_path = '~/.ssh/id_rsa'
config.vm.provider :azure do |azure, override|
# each of the below values will default to use the env vars
named as below if not specified explicitly
azure.tenant_id = ENV['AZURE_TENANT_ID']
azure.client_id = ENV['AZURE_CLIENT_ID']
azure.client_secret = ENV['AZURE_CLIENT_SECRET']
azure.subscription_id = ENV['AZURE_SUBSCRIPTION_ID']
end
end

▪ Packer Builder for Azure: `azure-arm`
▪ Can produce either a VHD / Managed Disk
▪ Authenticating via a Service Principal / MSI
!8
Packer & Azure
Building Images with
Packer on Azure

Building Images with
Packer on Azure
Packer & Azure
{
"variables": {},
"builders": [{
"type": "azure-arm",
"resource_group_name": "packer-images",
"storage_account": "myexamplestoraccount",
"subscription_id": "00000000-0000-0000-0000-000000000000",
"os_type": "Linux",
"image_publisher": "Canonical",
"image_offer": "UbuntuServer",
"image_sku": "16.04-LTS",
"location": "West US",
}],
"provisioners": [{
# ...
}]
}

▪ Terraform has multiple Providers supporting
Azure:
▪ Azure Active Directory
▪ Azure Resource Manager
▪ Azure Stack
▪ Now supports 190 Resources & 59 Data Sources
!10
Provisioning Resources
on Azure using
Terraform
Terraform & Azure

provider "azurerm" {
version = "=1.22.0"
}
resource "azurerm_resource_group" "test" {
name = "oslo-hug-resources"
location = "West Europe"
}
resource "azurerm_virtual_network" "test" {
name = "oslo-hug-network"
resource_group_name = "${azurerm_resource_group.test.name}"
location = "${azurerm_resource_group.test.location}"
address_space = ["10.0.0.0/16"]
}
!11
Provisioning Resources
on Azure using
Terraform
Terraform & Azure

▪ Vault supports both an Auth Method and a
Secrets Backend
▪ Allows you to verify that a VM/VM Scale Set
exists
!13
Vault & Azure
Supported Integrations

Vault & Azure
Auth Method
$ vault write auth/azure/login
role="dev-role"
jwt="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
subscription_id="12345-..."
resource_group_name="test-group"
vm_name="test-vm"

Vault & Azure
Secrets Backend
$ vault read azure/creds/my-role
Key Value
--- -----
lease_id azure/creds/sp_role/1afd0969-ad23-73e2-f974-962f7ac1c2b4
lease_duration 60m
lease_renewable true
client_id 408bf248-dd4e-4be5-919a-7f6207a307ab
client_secret ad06228a-2db9-4e0a-8a5d-e047c7f32594

▪ Nomad (and Consul) support automatic
discovery of other nodes
▪ Documentation: https://www.nomadproject.io/
docs/configuration/server_join.html
!16
Automatic discovery of
cluster members in
Azure
Nomad & Azure

cluster members in
Azure
Nomad & Azure
log_level = "DEBUG"
data_dir = “/var/lib/nomad/server"
datacenter = “westeurope”
server {
enabled = true
bootstrap_expect = 3
retry_join = ["provider=azure tag_name="HashiStack"
tag_value="OsloDev"
client_id="00000000-0000-0000-0000-000000000000"
subscription_id="00000000-0000-0000-0000-000000000000"
secret_access_key="00000000-0000-0000-0000-000000000000"
tenant_id="00000000-0000-0000-0000-000000000000""]
}

cluster members in
Azure
Consul & Azure
{
"bootstrap_expect": 3,
"server": true,
"encrypt": "zYB6e/vH/P38J8GIgklSlA==",
"leave_on_terminate": true,
"log_level": "INFO",
"rejoin_after_leave": true,
"datacenter": "westeurope",
"data_dir": "/var/consul",
"retry_join": ["provider=azure tag_name="HashiStack"
tag_value="OsloDev"
client_id="00000000-0000-0000-0000-000000000000"
subscription_id="00000000-0000-0000-0000-000000000000"
secret_access_key="00000000-0000-0000-0000-000000000000"
tenant_id="00000000-0000-0000-0000-000000000000""]
}

s
Consul, Nomad and Terraform on Azure
!21
Demo

s
Common stumbling blocks in Azure
!22
Common Pitfalls

▪ Dynamic IP Addresses in Azure aren’t assigned
until the VM/LB etc is Running
!23
Dynamic IP Addresses
Common Pitfalls

resource "azurerm_public_ip" "main" {
name = "example-pip"
resource_group_name = “example-resources"
location = “West Europe”
allocation_method = “Dynamic"
tags = "${var.tags}"
}
output "public_ip_address" {
value = "${azurerm_public_ip.main.ip_address}"
}
!24
Common Pitfalls

▪ You can use the Data Source to obtain the IP
Address once it’s got an IP Address
!25
Common Pitfalls

resource "azurerm_public_ip" "main" { .. }
resource “azurerm_network_interface" "main" { .. }
resource “azurerm_virtual_machine” "main" { .. }
data “azurerm_public_ip” “main” {
name = “${azurerm_public_ip.main.name}”
resource_group_name = “${azurerm_public_ip.main.resource_group_name}”
depends_on = [“azurerm_virtual_machine.main”]
}
output "public_ip_address" {
value = “${data.azurerm_public_ip.main.ip_address}"
}
!26
Common Pitfalls

▪ You can use the Data Source to obtain the IP
Address once it’s got an IP Address
▪ Alternatively you can use a Static IP Address
!27
Common Pitfalls

▪ Azure uses the `name` as the unique identifier
!28
Resource ID’s
Common Pitfalls

▪ However Azure’s API’s are Upserts; meaning if a
resource already exists it’ll Update it, if not it’ll
Create it.
!29
Resource ID’s
Common Pitfalls

▪ However Azure’s API’s are Upserts; meaning if a
resource already exists it’ll Update it, if not it’ll
Create it.
▪ This means provisioning multiple resources with
the same `name` can conflict and end up
provisioning the same resource
!30
Resource ID’s
Common Pitfalls

resource “azurerm_resource_group” “test” {
name = “example-resources”
}
resource “azurerm_public_ip” “test” {
name = “example-pip”
location = “${azurerm_resource_group.test.location}”
resource_group_name = “${azurerm_resource_group.test.name}”
}
!31
Resource ID’s
Common Pitfalls

}
count = 3
name = “example-pip”
}
!32
Resource ID’s
Common Pitfalls

▪ Solutions:
▪ You can append a unique element (e.g. count)
to the `name` to ensure these are unique
!33
Resource ID’s
Common Pitfalls

}
count = 3
name = “example-pip-${count.index}”
}
!34
Resource ID’s
Common Pitfalls

▪ Solutions:
▪ You can append a unique element (e.g. count)
to the `name` to ensure these are unique
▪ v2 of Azure Provider solves this via Requires
Imports - more details later.
!35
Resource ID’s
Common Pitfalls

▪ Many of Azure’s resources are Monolithic, and
only allow one thing to change at once
!36
Monolithic Resources
Common Pitfalls

▪ e.g. Load Balancers, Networks & Virtual Machines
!37
Common Pitfalls

▪ This means that it can be hard to represent
these resources in Terraform, since there’s a
circular reference
!38
Common Pitfalls

▪ This means that it can be hard to represent
these resources in Terraform, since there’s a
circular reference
▪ We’re creating Virtual Resources where possible,
which help resolve the circular reference
!39
Common Pitfalls

resource "azurerm_resource_group" "test" { ... }
resource "azurerm_virtual_network" "test" { ... }
resource "azurerm_network_security_group" "test" { ... }
resource "azurerm_subnet" "test" {
# ...
network_security_group_id = "${azurerm_network_security_group.test.id}"
}
!40
Common Pitfalls

resource "azurerm_subnet" "test" {
# ...
}
resource "azurerm_subnet_network_security_group_association" "test" {
subnet_id = "${azurerm_subnet.test.id}"
}
!41
Common Pitfalls

resource "azurerm_subnet" "test" { ... }
resource "azurerm_subnet_network_security_group_association" "test" {
subnet_id = "${azurerm_subnet.test.id}"
}
!42
Common Pitfalls
Monolithic Resources 
 
 
 
 
Coming in 2.0

s
Which resources does Terraform support?
!43
What's supported?

▪ AKS / Kubernetes
▪ App Service
▪ Application Gateway
▪ Application Insights
▪ AutoScale Setting
▪ Automation
▪ AzureAD
▪ Azure Monitor
▪ Batch
▪ CDN
▪ Cognitive Services
▪ Container Instance
▪ Container Registry
What's supported in Terraform?
!44
▪ CosmosDB
▪ DNS
▪ Data Lake Analytics
▪ Data Lake Store
▪ DataBricks
▪ Dev Test Labs
▪ DevSpace
▪ EventGrid
▪ EventHub
▪ Express Route
▪ Firewall
▪ Function Apps
▪ IoTHub
▪ Key Vault
▪ Load Balancers
▪ Local Network
Gateway
▪ Log Analytics / OMS
▪ Logic Apps
▪ Management Group
▪ Management Locks
▪ MariaDB
▪ MySQL
▪ Networks
▪ Notification Hubs
▪ Policy
▪ PostgreSQL
▪ Recovery Services
▪ Redis
▪ Relay
▪ SQL Azure
▪ Scheduler Job
▪ Search
▪ Security Center
▪ Service Fabric
▪ ServiceBus
▪ SignalR
▪ Storage
▪ VM Scale Sets
▪ Virtual Machines

s
What’s coming over the next few months?
!45
What’s next?

!48
Provider: Azure Active Directory (0.x)
▪ Groups (0.2)
▪ Users (0.3)

!49
Provider: AzureRM (1.x)
▪ API Management
▪ CosmosDB Collections
▪ CosmosDB Databases
▪ EventGrid
▪ HDInsights
▪ Subscriptions
▪ Terraform 0.12 support

!52
Provider: AzureRM (2.0)
▪ Custom Timeouts

▪ At the moment all API calls are hard-limited to
an hour
▪ v2.0 of the Azure Provider will allow you to
specify the timeout on resources
!53
Custom Timeouts
Azure Provider 2.0

name = "example-resource-group"
}
Custom Timeouts
Azure Provider 2.0
!54

name = "example-resource-group"
timeouts {
create = "10m"
delete = "30m"
}
}
Custom Timeouts
Azure Provider 2.0
!55

!56
▪ Custom Timeouts
▪ Requiring Imports

▪ As seen earlier - Azure using the `name` as the Resource ID
and having API’s which are Upserts means it’s possible to
intentionally import an existing resource into Terraform
!57
Requiring Imports
Azure Provider 2.0

▪ However some API’s require that a separate Update API is called
when the resource is being changed, as such users can see
unhelpful error messages
!58
Requiring Imports
Azure Provider 2.0

▪ To work around this we’re going to check for an existing
resource with the same name as each resource is created, and
then require that these resources are Imported
!59
Requiring Imports
Azure Provider 2.0

▪ To work around this we’re going to check for an existing
resource with the same name as each resource is created, and
then require that these resources are Imported
▪ You can opt into this behaviour from v1.22 onwards,
enhancements to come but will be fully available in 2.0
!60
Requiring Imports
Azure Provider 2.0

!61
▪ Custom Timeouts
▪ New VM / VM Scale Set Resources

resource “azurerm_network_interface” “test” { ... }
resource “azurerm_managed_disk” “test” { ... }
resource “azurerm_linux_virtual_machine” “test” {
name = “example-virtual-machine”
location = “westeurope”
resource_group_name = “example-resources”
network_interfaces = [“${azurerm_network_interface.test.id}”]
username = “myuser”
ssh_keys = [
“${file(“~/.ssh/id_rsa.pub”)”,
]
os_disk {
id = “${azurerm_managed_disk.test.id”
}
}
!62
New Virtual Machine /
VM Scale Set Resources 
 
 
 
Disclaimer: Early Days / WIP
Azure Provider 2.0

!63
▪ Custom Timeouts
▪ New VM / VM Scale Set Resources
▪ Removing deprecated fields/resources

!64
Terraform 0.12
▪ Azure Backend Enhancements:

!65
Terraform 0.12
▪ Fixes a bug where the lock wouldn’t be released

!66
Terraform 0.12
▪ Authenticate using the Azure CLI

terraform {
backend "azurerm" {
storage_account_name = "abcd1234"
container_name = "tfstate"
key = "prod.terraform.tfstate"
}
}
!67
Authenticating using the
Azure CLI
Terraform 0.12

!68
Terraform 0.12
▪ Authenticate using a Service Principal with a Client Certificate (soon)

!69
Terraform 0.12
▪ Authenticate using Managed Service Identity

terraform {
backend "azurerm" {
use_msi = true
subscription_id = "00000000-0000-0000-0000-000000000000"
tenant_id = "00000000-0000-0000-0000-000000000000"
}
}
!70
Authenticating using
Managed Service
Identity
Terraform 0.12

!71
Terraform 0.12
▪ Authenticate using a SAS Token

terraform {
backend "azurerm" {
# rather than defining this inline, the SAS Token can also be sourced
# from an Environment Variable - more information is available below.
sas_token = "abcdefghijklmnopqrstuvwxyz0123456789..."
}
}
!72
Authenticating using a
Storage Access Token
Terraform 0.12

!73
Terraform 0.12
▪ Support for Azure Stack

terraform {
backend "azurerm" {
environment = "stack"
endpoint = "https://management.westus.mycloud.com"
}
}
!74
Support for Azure Stack
Terraform 0.12

!75
Terraform 0.12
▪ Support for Azure Stack
▪ Proxy support

Thank you.
hello@hashicorp.comwww.hashicorp.com

Terraform & Azure

More Related Content

What's hot (17)

Similar to Terraform & Azure (20)

Recently uploaded (20)

Terraform & Azure