Skip to content

Commit dd8ca23

Browse files
paulzhang97paulzhang97
authored
Merge pull request #9 from redpanda-data/paulz/azure-byo-vnet-1
Azure customer managed resources deployed via TF
2 parents 855cb4e + a86c5f4 commit dd8ca23

17 files changed

Lines changed: 1133 additions & 0 deletions

‎customer-managed/azure/terraform/.terraform.lock.hcl‎

Lines changed: 22 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎customer-managed/azure/terraform/data.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
data "azurerm_client_config" "current" {}
2+
3+
data "azurerm_location" "redpanda" {
4+
location = var.region
5+
}

‎customer-managed/azure/terraform/identities.tf‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
resource "azurerm_user_assigned_identity" "redpanda_agent" {
2+
location = azurerm_resource_group.iam.location
3+
name = "${var.resource_name_prefix}${var.redpanda_agent_identity_name}"
4+
resource_group_name = azurerm_resource_group.iam.name
5+
}
6+
7+
resource "azurerm_user_assigned_identity" "cert_manager" {
8+
location = azurerm_resource_group.iam.location
9+
name = "${var.resource_name_prefix}${var.redpanda_cert_manager_identity_name}"
10+
resource_group_name = azurerm_resource_group.iam.name
11+
}
12+
13+
resource "azurerm_user_assigned_identity" "external_dns" {
14+
location = azurerm_resource_group.iam.location
15+
name = "${var.resource_name_prefix}${var.redpanda_external_dns_identity_name}"
16+
resource_group_name = azurerm_resource_group.iam.name
17+
}
18+
19+
resource "azurerm_user_assigned_identity" "redpanda_cluster" {
20+
location = azurerm_resource_group.iam.location
21+
name = "${var.resource_name_prefix}${var.redpanda_cluster_identity_name}"
22+
resource_group_name = azurerm_resource_group.iam.name
23+
}
24+
25+
resource "azurerm_user_assigned_identity" "aks" {
26+
location = azurerm_resource_group.iam.location
27+
name = "${var.resource_name_prefix}${var.aks_identity_name}"
28+
resource_group_name = azurerm_resource_group.iam.name
29+
}
30+
31+
resource "azurerm_user_assigned_identity" "redpanda_console" {
32+
location = azurerm_resource_group.iam.location
33+
name = "${var.resource_name_prefix}${var.redpanda_console_identity_name}"
34+
resource_group_name = azurerm_resource_group.iam.name
35+
}

‎customer-managed/azure/terraform/key_vaults.tf‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
locals {
2+
allowed_subnet_ids = [for s in azurerm_subnet.private : s.id]
3+
}
4+
5+
6+
resource "azurerm_key_vault" "vault" {
7+
count = var.redpanda_management_key_vault_name != "" ? 1 : 0
8+
name = "${var.resource_name_prefix}${var.redpanda_management_key_vault_name}"
9+
resource_group_name = azurerm_resource_group.redpanda.name
10+
location = azurerm_resource_group.redpanda.location
11+
sku_name = "standard"
12+
tenant_id = var.azure_tenant_id
13+
14+
public_network_access_enabled = true
15+
16+
enabled_for_deployment = true
17+
enabled_for_disk_encryption = true
18+
enabled_for_template_deployment = true
19+
purge_protection_enabled = true
20+
enable_rbac_authorization = true
21+
22+
network_acls {
23+
bypass = "AzureServices"
24+
default_action = "Allow"
25+
virtual_network_subnet_ids = local.allowed_subnet_ids
26+
}
27+
28+
access_policy {
29+
tenant_id = var.azure_tenant_id
30+
object_id = data.azurerm_client_config.current.object_id
31+
application_id = data.azurerm_client_config.current.client_id
32+
33+
secret_permissions = [
34+
"Set",
35+
"Get",
36+
"List",
37+
"Delete",
38+
"Purge",
39+
"Recover",
40+
"Restore",
41+
"Backup",
42+
]
43+
}
44+
45+
tags = var.tags
46+
}
47+
48+
resource "azurerm_key_vault" "console" {
49+
count = var.redpanda_console_key_vault_name != "" ? 1 : 0
50+
name = "${var.resource_name_prefix}${var.redpanda_console_key_vault_name}"
51+
resource_group_name = azurerm_resource_group.redpanda.name
52+
location = azurerm_resource_group.redpanda.location
53+
sku_name = "standard"
54+
tenant_id = var.azure_tenant_id
55+
56+
public_network_access_enabled = true
57+
58+
enabled_for_deployment = true
59+
enabled_for_disk_encryption = true
60+
enabled_for_template_deployment = true
61+
purge_protection_enabled = true
62+
enable_rbac_authorization = true
63+
64+
network_acls {
65+
bypass = "AzureServices"
66+
default_action = "Allow"
67+
virtual_network_subnet_ids = local.allowed_subnet_ids
68+
}
69+
70+
access_policy {
71+
tenant_id = var.azure_tenant_id
72+
object_id = data.azurerm_client_config.current.object_id
73+
application_id = data.azurerm_client_config.current.client_id
74+
75+
secret_permissions = [
76+
"Set",
77+
"Get",
78+
"List",
79+
"Delete",
80+
"Purge",
81+
"Recover",
82+
"Restore",
83+
"Backup",
84+
]
85+
}
86+
87+
tags = var.tags
88+
}

‎customer-managed/azure/terraform/network.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
resource "azurerm_virtual_network" "redpanda" {
2+
name = "${var.resource_name_prefix}${var.vnet_name}"
3+
location = var.region
4+
resource_group_name = azurerm_resource_group.network.name
5+
address_space = var.vnet_addresses
6+
7+
tags = var.tags
8+
}
9+
10+
11+
resource "azurerm_subnet" "private" {
12+
for_each = var.private_subnets
13+
14+
name = "${var.resource_name_prefix}${each.value.name}"
15+
resource_group_name = azurerm_resource_group.network.name
16+
virtual_network_name = azurerm_virtual_network.redpanda.name
17+
address_prefixes = [each.value.cidr]
18+
19+
# Use Azure's internal network to reach out to the following Azure services
20+
service_endpoints = [
21+
"Microsoft.Storage.Global",
22+
"Microsoft.AzureActiveDirectory",
23+
"Microsoft.KeyVault"
24+
]
25+
26+
lifecycle {
27+
# AKS automatically configures subnet delegations when the subnets are assigned
28+
# to node pools. To prevent undoing the delegations when network provisioning
29+
# re-runs, we ignore any changes on them.
30+
ignore_changes = [delegation]
31+
}
32+
}
33+
34+
resource "azurerm_subnet" "public" {
35+
for_each = var.egress_subnets
36+
37+
name = "${var.resource_name_prefix}${each.value.name}"
38+
resource_group_name = azurerm_resource_group.network.name
39+
virtual_network_name = azurerm_virtual_network.redpanda.name
40+
address_prefixes = [each.value.cidr]
41+
42+
# Use Azure's internal network to reach out to the following Azure services
43+
service_endpoints = [
44+
"Microsoft.Storage.Global",
45+
"Microsoft.AzureActiveDirectory",
46+
"Microsoft.KeyVault",
47+
]
48+
}

‎customer-managed/azure/terraform/outputs.tf‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
output "resource_groups" {
2+
description = "Resource groups"
3+
value = {
4+
"redpanda" : {
5+
"name" : azurerm_resource_group.redpanda.name,
6+
"id" : azurerm_resource_group.redpanda.id
7+
},
8+
"storage" : {
9+
"name" : azurerm_resource_group.storage.name,
10+
"id" : azurerm_resource_group.storage.id
11+
},
12+
"network" : {
13+
"name" : azurerm_resource_group.network.name,
14+
"id" : azurerm_resource_group.network.id
15+
},
16+
"iam" : {
17+
"name" : azurerm_resource_group.iam.name,
18+
"id" : azurerm_resource_group.iam.id
19+
}
20+
}
21+
}
22+
23+
output "roles" {
24+
description = "IAM roles"
25+
value = {
26+
"agent" : azurerm_role_definition.redpanda_agent.id,
27+
"console" : azurerm_role_definition.redpanda_console.id,
28+
"private-link" : azurerm_role_definition.redpanda_private_link.id
29+
}
30+
}
31+
32+
output "identities" {
33+
description = "User assigned identities"
34+
value = {
35+
"agent" : azurerm_user_assigned_identity.redpanda_agent.id,
36+
"cert-manager" : azurerm_user_assigned_identity.cert_manager.id,
37+
"external-dns" : azurerm_user_assigned_identity.external_dns.id,
38+
"aks" : azurerm_user_assigned_identity.aks.id,
39+
"redpanda-cluster" : azurerm_user_assigned_identity.redpanda_cluster.id,
40+
"redpanda-console" : azurerm_user_assigned_identity.redpanda_console.id
41+
}
42+
}
43+
44+
output "networks" {
45+
description = "Networks"
46+
value = {
47+
"vnet" : {
48+
"name" : azurerm_virtual_network.redpanda.name,
49+
"resource_group" : azurerm_virtual_network.redpanda.resource_group_name,
50+
"address_space" : join(",", azurerm_virtual_network.redpanda.address_space)
51+
},
52+
"private-subnets" : {
53+
for k, v in azurerm_subnet.private : k => {
54+
"id" : v.id,
55+
"address_prefixes" : join(",", v.address_prefixes)
56+
}
57+
},
58+
"egress-subnets" : {
59+
for k, v in azurerm_subnet.public : k => {
60+
"id" : v.id,
61+
"address_prefixes" : join(",", v.address_prefixes)
62+
}
63+
}
64+
"subnet-cidrs-aks" : var.reserved_subnet_cidrs
65+
}
66+
}
67+
68+
output "security" {
69+
description = "Security groups"
70+
value = {
71+
"redpanda-cluster" : azurerm_network_security_group.redpanda_cluster.id
72+
}
73+
}
74+
75+
output "storage" {
76+
description = "Storage"
77+
value = {
78+
"management" : {
79+
"storage-account-id" : azurerm_storage_account.management.id,
80+
"bucket" : azurerm_storage_container.management.id
81+
},
82+
"tiered" : {
83+
"storage-account-id" : azurerm_storage_account.tiered_storage.id,
84+
"bucket" : azurerm_storage_container.tiered_storage.id
85+
}
86+
}
87+
}
88+
89+
output "vault" {
90+
description = "Key vault"
91+
value = {
92+
"redpanda-cluster" : var.redpanda_console_key_vault_name != "" ? azurerm_key_vault.vault[0].id : ""
93+
"redpanda-console" : var.redpanda_console_key_vault_name != "" ? azurerm_key_vault.console[0].id : ""
94+
}
95+
}

‎customer-managed/azure/terraform/providers.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
terraform {
2+
#backend "azurerm" {}
3+
required_providers {
4+
azurerm = {
5+
source = "hashicorp/azurerm"
6+
version = "=3.98.0"
7+
}
8+
}
9+
}
10+
11+
provider "azurerm" {
12+
features {}
13+
skip_provider_registration = false
14+
15+
client_id = var.azure_client_id
16+
client_secret = var.azure_client_secret
17+
tenant_id = var.azure_tenant_id
18+
subscription_id = var.azure_subscription_id
19+
20+
use_cli = var.azure_use_cli
21+
use_msi = var.azure_use_msi
22+
use_oidc = var.azure_use_oidc
23+
24+
# Always use Entra ID authentication instead of shared static keys
25+
# If set to false, we get
26+
# Error: retrieving queue properties for Storage Account (Subscription: "60fc0bed-3072-4c53-906a-d130a934d520"
27+
# Resource Group Name: "pz-tiered-storage-rg"
28+
# Storage Account Name: "pztieredstorage"): unmarshalling response: could not parse response body
29+
storage_use_azuread = true
30+
}

‎customer-managed/azure/terraform/resource_groups.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
2+
3+
resource "azurerm_resource_group" "redpanda" {
4+
name = "${var.resource_name_prefix}${var.redpanda_resource_group_name}"
5+
location = var.region
6+
7+
tags = var.tags
8+
}
9+
10+
resource "azurerm_resource_group" "storage" {
11+
name = "${var.resource_name_prefix}${var.redpanda_storage_resource_group_name}"
12+
location = var.region
13+
14+
tags = var.tags
15+
}
16+
17+
resource "azurerm_resource_group" "network" {
18+
name = "${var.resource_name_prefix}${var.redpanda_network_resource_group_name}"
19+
location = var.region
20+
21+
tags = var.tags
22+
}
23+
24+
resource "azurerm_resource_group" "iam" {
25+
name = "${var.resource_name_prefix}${var.redpanda_iam_resource_group_name}"
26+
location = var.region
27+
28+
tags = var.tags
29+
}
30+

0 commit comments

Comments
 (0)