Skip to content

Commit f4492d4

Browse files
grayzugrayzu
authored
Merge pull request microsoft#81 from TomArcherMsft/UserStory1871520-2
User Story 1871520 (Code)
2 parents 112c5b5 + 7446139 commit f4492d4

7 files changed

Lines changed: 348 additions & 295 deletions

File tree

‎quickstart/201-k8s-cluster-with-aks-applicationgateway-ingress/main.tf‎

Lines changed: 203 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,210 @@
1-
terraform {
1+
resource "random_pet" "rg-name" {
2+
prefix = var.resource_group_name_prefix
3+
}
24

3-
required_version = ">=0.12"
5+
resource "azurerm_resource_group" "rg" {
6+
name = random_pet.rg-name.id
7+
location = var.resource_group_location
8+
}
49

5-
required_providers {
6-
azurerm = {
7-
source = "hashicorp/azurerm"
8-
version = "~>2.0"
9-
}
10+
# Locals block for hardcoded names
11+
locals {
12+
backend_address_pool_name = "${azurerm_virtual_network.test.name}-beap"
13+
frontend_port_name = "${azurerm_virtual_network.test.name}-feport"
14+
frontend_ip_configuration_name = "${azurerm_virtual_network.test.name}-feip"
15+
http_setting_name = "${azurerm_virtual_network.test.name}-be-htst"
16+
listener_name = "${azurerm_virtual_network.test.name}-httplstn"
17+
request_routing_rule_name = "${azurerm_virtual_network.test.name}-rqrt"
18+
app_gateway_subnet_name = "appgwsubnet"
19+
}
20+
21+
# User Assigned Identities
22+
resource "azurerm_user_assigned_identity" "testIdentity" {
23+
resource_group_name = azurerm_resource_group.rg.name
24+
location = azurerm_resource_group.rg.location
25+
26+
name = "identity1"
27+
28+
tags = var.tags
29+
}
30+
31+
resource "azurerm_virtual_network" "test" {
32+
name = var.virtual_network_name
33+
location = azurerm_resource_group.rg.location
34+
resource_group_name = azurerm_resource_group.rg.name
35+
address_space = [var.virtual_network_address_prefix]
36+
37+
subnet {
38+
name = var.aks_subnet_name
39+
address_prefix = var.aks_subnet_address_prefix
40+
}
41+
42+
subnet {
43+
name = "appgwsubnet"
44+
address_prefix = var.app_gateway_subnet_address_prefix
45+
}
46+
47+
tags = var.tags
48+
}
49+
50+
data "azurerm_subnet" "kubesubnet" {
51+
name = var.aks_subnet_name
52+
virtual_network_name = azurerm_virtual_network.test.name
53+
resource_group_name = azurerm_resource_group.rg.name
54+
depends_on = [azurerm_virtual_network.test]
55+
}
56+
57+
data "azurerm_subnet" "appgwsubnet" {
58+
name = "appgwsubnet"
59+
virtual_network_name = azurerm_virtual_network.test.name
60+
resource_group_name = azurerm_resource_group.rg.name
61+
depends_on = [azurerm_virtual_network.test]
62+
}
63+
64+
# Public Ip
65+
resource "azurerm_public_ip" "test" {
66+
name = "publicIp1"
67+
location = azurerm_resource_group.rg.location
68+
resource_group_name = azurerm_resource_group.rg.name
69+
allocation_method = "Static"
70+
sku = "Standard"
71+
72+
tags = var.tags
73+
}
74+
75+
resource "azurerm_application_gateway" "network" {
76+
name = var.app_gateway_name
77+
resource_group_name = azurerm_resource_group.rg.name
78+
location = azurerm_resource_group.rg.location
79+
80+
sku {
81+
name = var.app_gateway_sku
82+
tier = "Standard_v2"
83+
capacity = 2
84+
}
85+
86+
gateway_ip_configuration {
87+
name = "appGatewayIpConfig"
88+
subnet_id = data.azurerm_subnet.appgwsubnet.id
89+
}
90+
91+
frontend_port {
92+
name = local.frontend_port_name
93+
port = 80
94+
}
95+
96+
frontend_port {
97+
name = "httpsPort"
98+
port = 443
99+
}
100+
101+
frontend_ip_configuration {
102+
name = local.frontend_ip_configuration_name
103+
public_ip_address_id = azurerm_public_ip.test.id
10104
}
11-
backend "azurerm" {
12-
resource_group_name = var.resource_group_name
13-
storage_account_name = var.storage_account_name
14-
container_name = "tfstate"
15-
key = "codelab.microsoft.tfstate"
105+
106+
backend_address_pool {
107+
name = local.backend_address_pool_name
108+
}
109+
110+
backend_http_settings {
111+
name = local.http_setting_name
112+
cookie_based_affinity = "Disabled"
113+
port = 80
114+
protocol = "Http"
115+
request_timeout = 1
116+
}
117+
118+
http_listener {
119+
name = local.listener_name
120+
frontend_ip_configuration_name = local.frontend_ip_configuration_name
121+
frontend_port_name = local.frontend_port_name
122+
protocol = "Http"
16123
}
124+
125+
request_routing_rule {
126+
name = local.request_routing_rule_name
127+
rule_type = "Basic"
128+
http_listener_name = local.listener_name
129+
backend_address_pool_name = local.backend_address_pool_name
130+
backend_http_settings_name = local.http_setting_name
17131
}
18132

19-
provider "azurerm" {
20-
features {}
133+
tags = var.tags
134+
135+
depends_on = [azurerm_virtual_network.test, azurerm_public_ip.test]
136+
}
137+
138+
resource "azurerm_role_assignment" "ra1" {
139+
scope = data.azurerm_subnet.kubesubnet.id
140+
role_definition_name = "Network Contributor"
141+
principal_id = var.aks_service_principal_object_id
142+
143+
depends_on = [azurerm_virtual_network.test]
144+
}
145+
146+
resource "azurerm_role_assignment" "ra2" {
147+
scope = azurerm_user_assigned_identity.testIdentity.id
148+
role_definition_name = "Managed Identity Operator"
149+
principal_id = var.aks_service_principal_object_id
150+
depends_on = [azurerm_user_assigned_identity.testIdentity]
151+
}
152+
153+
resource "azurerm_role_assignment" "ra3" {
154+
scope = azurerm_application_gateway.network.id
155+
role_definition_name = "Contributor"
156+
principal_id = azurerm_user_assigned_identity.testIdentity.principal_id
157+
depends_on = [azurerm_user_assigned_identity.testIdentity, azurerm_application_gateway.network]
158+
}
159+
160+
resource "azurerm_role_assignment" "ra4" {
161+
scope = azurerm_resource_group.rg.id
162+
role_definition_name = "Reader"
163+
principal_id = azurerm_user_assigned_identity.testIdentity.principal_id
164+
depends_on = [azurerm_user_assigned_identity.testIdentity, azurerm_application_gateway.network]
21165
}
166+
167+
resource "azurerm_kubernetes_cluster" "k8s" {
168+
name = var.aks_name
169+
location = azurerm_resource_group.rg.location
170+
dns_prefix = var.aks_dns_prefix
171+
172+
resource_group_name = azurerm_resource_group.rg.name
173+
174+
http_application_routing_enabled = false
175+
176+
linux_profile {
177+
admin_username = var.vm_user_name
178+
179+
ssh_key {
180+
key_data = file(var.public_ssh_key_path)
181+
}
182+
}
183+
184+
default_node_pool {
185+
name = "agentpool"
186+
node_count = var.aks_agent_count
187+
vm_size = var.aks_agent_vm_size
188+
os_disk_size_gb = var.aks_agent_os_disk_size
189+
vnet_subnet_id = data.azurerm_subnet.kubesubnet.id
190+
}
191+
192+
service_principal {
193+
client_id = var.aks_service_principal_app_id
194+
client_secret = var.aks_service_principal_client_secret
195+
}
196+
197+
network_profile {
198+
network_plugin = "azure"
199+
dns_service_ip = var.aks_dns_service_ip
200+
docker_bridge_cidr = var.aks_docker_bridge_cidr
201+
service_cidr = var.aks_service_cidr
202+
}
203+
204+
role_based_access_control {
205+
enabled = var.aks_enable_rbac
206+
}
207+
208+
depends_on = [azurerm_virtual_network.test, azurerm_application_gateway.network]
209+
tags = var.tags
210+
}

‎quickstart/201-k8s-cluster-with-aks-applicationgateway-ingress/output.tf‎

Lines changed: 18 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,44 @@
1+
output "resource_group_name" {
2+
value = azurerm_resource_group.rg.name
3+
}
4+
15
output "client_key" {
2-
value = azurerm_kubernetes_cluster.k8s.kube_config.0.client_key
6+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.client_key
37
}
48

59
output "client_certificate" {
6-
value = azurerm_kubernetes_cluster.k8s.kube_config.0.client_certificate
10+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.client_certificate
711
}
812

913
output "cluster_ca_certificate" {
10-
value = azurerm_kubernetes_cluster.k8s.kube_config.0.cluster_ca_certificate
14+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.cluster_ca_certificate
1115
}
1216

1317
output "cluster_username" {
14-
value = azurerm_kubernetes_cluster.k8s.kube_config.0.username
18+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.username
1519
}
1620

1721
output "cluster_password" {
18-
value = azurerm_kubernetes_cluster.k8s.kube_config.0.password
22+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.password
1923
}
2024

2125
output "kube_config" {
22-
value = azurerm_kubernetes_cluster.k8s.kube_config_raw
23-
sensitive = true
26+
value = azurerm_kubernetes_cluster.k8s.kube_config_raw
27+
sensitive = true
2428
}
2529

2630
output "host" {
27-
value = azurerm_kubernetes_cluster.k8s.kube_config.0.host
31+
value = azurerm_kubernetes_cluster.k8s.kube_config.0.host
2832
}
2933

3034
output "identity_resource_id" {
31-
value = azurerm_user_assigned_identity.testIdentity.id
35+
value = azurerm_user_assigned_identity.testIdentity.id
3236
}
3337

3438
output "identity_client_id" {
35-
value = azurerm_user_assigned_identity.testIdentity.client_id
39+
value = azurerm_user_assigned_identity.testIdentity.client_id
40+
}
41+
42+
output "application_ip_address" {
43+
value = azurerm_public_ip.test.ip_address
3644
}

‎quickstart/201-k8s-cluster-with-aks-applicationgateway-ingress/providers.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
terraform {
2+
3+
required_version = ">=0.12"
4+
5+
required_providers {
6+
azurerm = {
7+
source = "hashicorp/azurerm"
8+
version = "~>2.0"
9+
}
10+
}
11+
backend "azurerm" {
12+
resource_group_name = "<storage_account_resource_group>"
13+
storage_account_name = "<storage_account_name>"
14+
container_name = "tfstate"
15+
key = "codelab.microsoft.tfstate"
16+
}
17+
}
18+
19+
provider "azurerm" {
20+
features {}
21+
}

‎quickstart/201-k8s-cluster-with-aks-applicationgateway-ingress/readme.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Create an Application Gateway Ingress Controller in Azure Kubernetes Service using Terraform
2+
3+
This template creates an Application Gateway Ingress Controller in Azure Kubernetes Service using Terraform.
4+
5+
## Terraform resource types
6+
7+
- [random_pet](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet)
8+
- [azurerm_resource_group](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group)
9+
- [azurerm_user_assigned_identity](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/user_assigned_identity)
10+
- [azurerm_virtual_network](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network)
11+
- [azurerm_subnet](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet)
12+
- [azurerm_public_ip](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/public_ip)
13+
- [azurerm_application_gateway](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/application_gateway)
14+
- [azurerm_role_assignment](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment)
15+
- [azurerm_kubernetes_cluster](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/kubernetes_cluster)
16+
17+
## Variables
18+
19+
| Name | Description | Default value |
20+
|-|-|-|
21+
22+
| `resource_group_name_prefix` | (Optional) Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription. | rg |
23+
| `location` | (Optional) Azure region in which to deploy demo resources.| eastus |
24+
| `aks_service_principal_app_id` | Application ID/Client ID of the service principal. Used by AKS to manage AKS related resources on Azure like vms, subnets.| |
25+
| `aks_service_principal_client_secret` | Secret of the service principal. Used by AKS to manage Azure. | |
26+
| `aks_service_principal_object_id` | Object ID of the service principal. | |
27+
| `virtual_network_name` | Virtual network name. | aksVirtualNetwork |
28+
| `virtual_network_address_prefix` | VNET address prefix. | 192.168.0.0/16 |
29+
| `aks_subnet_name` | Subnet name. | kubesubnet |
30+
| `aks_subnet_address_prefix` | Subnet address prefix. | 192.168.0.0/24 |
31+
| `app_gateway_subnet_address_prefix` | Subnet server IP address. | 192.168.1.0/24 |
32+
| `app_gateway_name` | Name of the Application Gateway. | ApplicationGateway1 |
33+
| `app_gateway_sku` | Name of the Application Gateway SKU. | Standard_v2 |
34+
| `app_gateway_tier` | Tier of the Application Gateway tier. | Standard_v2 |
35+
| `aks_name` | AKS cluster name. | aks-cluster1 |
36+
| `aks_dns_prefix` | (Optional) DNS prefix to use with hosted Kubernetes API server FQDN. | aks |
37+
| `aks_agent_os_disk_size` | Disk size (in GB) to provision for each of the agent pool nodes. This value ranges from 0 to 1023. Value of 0 applies the default disk size for that agentVMSize. | 40 |
38+
| `aks_agent_count` | The number of agent nodes for the cluster. | 3 |
39+
| `aks_agent_vm_size` | VM size. | Standard_D3_v2 |
40+
| `kubernetes_version` | Kubernetes version | 1.11.5 |
41+
| `aks_service_cidr` | CIDR notation IP range from which to assign service cluster IPs. | 10.0.0.0/16 |
42+
| `aks_dns_service_ip` | DNS server IP address. | 10.0.0.10 |
43+
| `aks_docker_bridge_cidr` | CIDR notation IP for Docker bridge. | 172.17.0.1/16 |
44+
| `aks_enable_rbac` | Enable RBAC on the AKS cluster. | false |
45+
| `vm_user_name` | User name for the VM. | vmuser1 |
46+
| `public_ssh_key_path` | Public key path for SSH. | ~/.ssh/id_rsa.pub |
47+
48+
## Example
49+
50+
To see how to run this example, see [Create an Application Gateway Ingress Controller in Azure Kubernetes Service using Terraform](https://docs.microsoft.com/azure/developer/terraform/create-k8s-cluster-with-aks-applicationgateway-ingress).

0 commit comments

Comments
 (0)