From 153dbd26b52ccb0d3be99d77e024e2fa1b9c99e4 Mon Sep 17 00:00:00 2001 From: Ditmar Visser Date: Thu, 5 Jun 2025 19:54:17 +0000 Subject: [PATCH] feat: provision vm's --- README.md | 93 ++++++++++++++- terraform/.terraform.lock.hcl | 79 +++++++++++++ terraform/ansible-inventory.tmpl | 5 + terraform/cloudinit-azure.yaml | 8 ++ terraform/main.tf | 156 ++++++++++++++++++++++++++ terraform/metadata.yaml | 2 + terraform/providers.tf | 29 +++++ terraform/secrets.auto.tfvars.example | 8 ++ terraform/userdata.tftpl | 27 +++++ terraform/variables.tf | 53 +++++++++ 10 files changed, 458 insertions(+), 2 deletions(-) create mode 100644 terraform/.terraform.lock.hcl create mode 100644 terraform/ansible-inventory.tmpl create mode 100644 terraform/cloudinit-azure.yaml create mode 100644 terraform/main.tf create mode 100644 terraform/metadata.yaml create mode 100644 terraform/providers.tf create mode 100644 terraform/secrets.auto.tfvars.example create mode 100644 terraform/userdata.tftpl create mode 100644 terraform/variables.tf diff --git a/README.md b/README.md index a7cc410..c7f956d 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,92 @@ -# les-06 +# Terraform Deployment – Week 6 -https://about.gitea.com/resources/tutorials/automating-release-versioning-with-gitea-actions-to-the-gitea-package-registry \ No newline at end of file +This repository contains Terraform configurations for provisioning infrastructure on ESXi and Azure, and Ansible playbooks for deploying a self made "Hello World" Docker container. + +All sensitive information (e.g. SSH key files, passwords) and custom values are handled using Terraform variables stored in a separate file. + + +## Provioning with Terraform + +```mermaid +graph TD + subgraph ESXi omgeving + ESXivSwitch[vSwitch]:::existing + Portgroup[Portgroup] + ESXiVM[Linux VM] + + ESXivSwitch --> Portgroup + Portgroup --> ESXiVM + end + + subgraph Azure + VNet[Virtual Network] + Subnet[Subnet] + NIC[NIC] + NSG["NSG (SSH open)"] + AzureVM[Linux VM] + PIP[Public IP] + + VNet --> Subnet + Subnet --> NIC + NIC --> AzureVM + NSG --> NIC + AzureVM --> PIP + end + + subgraph Gitea + subgraph Secrets + AzurePublicKey["SSH Public Key (azure.pub)"] + AzurePrivateKey["SSH Private Key (azure)"] + SkylabPublicKey["SSH Public Key (skylab.pub)"] + end + subgraph Container Registry + DockerImage[Hello World image] + end + Userdata[Userdata] + AzureCloudInit[Azure Cloudinit] + VMinfo["Output file: inventory.ini"] + end + + SkylabPublicKey --> Userdata + AzurePrivateKey --> Userdata + AzurePublicKey --> AzureCloudInit + Userdata --> ESXiVM + AzureCloudInit --> AzureVM + + DockerImage --> ESXiVM + DockerImage --> AzureVM + + ESXiVM --> VMinfo + AzureVM --> VMinfo + + classDef existing stroke:#268b26 +``` + +### Azure + +- Complete network setup: + - Virtual Network + - Subnet + - Network Security Group + - NIC +- One Ubuntu 24.04 VM. +- VM type: `Standard_B2ats_v2` +- Public IP address enabled +- The `testuser` user is created using cloud-init + - `azure.pub` is uploaded as public key. +- A file `/home/iac/hello.txt` containing `Hello World` is created using cloud-init +- VM public and private IP address is stored in the `vm_info.txt` file. + +### ESXi + +- One Ubuntu 24.04 VM. +- Provisioned with 1 vCPU and 2 GB RAM. +- The `testuser` user is created using cloud-init + - `skylab.pub` is uploaded as public key. + - `azure` private key us uploaded to access the Azure VM. + - A SSH config file is created with info for connecting to the Azure VM. + - sudo access. + - no password prompt. +- VM private IP addresses are stored in the `vm_info.txt` file. + +## VM Configuration with Ansible \ No newline at end of file diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl new file mode 100644 index 0000000..c48b2bf --- /dev/null +++ b/terraform/.terraform.lock.hcl @@ -0,0 +1,79 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/azurerm" { + version = "4.27.0" + constraints = "~> 4.27.0" + hashes = [ + "h1:2fs47aLDaEm93ANXXVRdTjlbUBmFBZRsFjyshKoPE3o=", + "zh:0c69edea1995bd3bd9e61980757169c35bf22281b660b5c755b6cb13d08d29d2", + "zh:25b86bf7b9678371d8573983954c571696f3e64a3967133be3b835da36307106", + "zh:49921cff4f26a49bafada60cd07dabb52c5eb35231059ed928a4f4722e269c82", + "zh:4b986166531f9fd1289f01d8220519443e74888a21da512c1b841b006dad6215", + "zh:53fb65b2ca4df637f03e4748a100a7d7fc77249e307c03e294d6259cec0310f6", + "zh:5c0d021a387ca4e2a5a01da009746a08c45f08e971c10d9bda54539d7264d671", + "zh:600043f2b20dc5a45275e43f175c19fe8b6e8e9557a0c884aef018f1f63de90e", + "zh:a0284f6f38912f67bb4cb7829fda3fa75be81fea6a9b21119965c2a839430092", + "zh:a7ac0576e2069ef77557042c6b5157ded364fbd355b2f9bf7f5441622424086e", + "zh:c5db0bcafe986868e28cc6225b68b2d1cf4bf631939d260ca845f17a9aa1677d", + "zh:ce620c0eb71b1fdd925828b30cf232a869abccf1c459180f2f991c4166315251", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + ] +} + +provider "registry.terraform.io/hashicorp/local" { + version = "2.5.3" + hashes = [ + "h1:1Nkh16jQJMp0EuDmvP/96f5Unnir0z12WyDuoR6HjMo=", + "zh:284d4b5b572eacd456e605e94372f740f6de27b71b4e1fd49b63745d8ecd4927", + "zh:40d9dfc9c549e406b5aab73c023aa485633c1b6b730c933d7bcc2fa67fd1ae6e", + "zh:6243509bb208656eb9dc17d3c525c89acdd27f08def427a0dce22d5db90a4c8b", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:885d85869f927853b6fe330e235cd03c337ac3b933b0d9ae827ec32fa1fdcdbf", + "zh:bab66af51039bdfcccf85b25fe562cbba2f54f6b3812202f4873ade834ec201d", + "zh:c505ff1bf9442a889ac7dca3ac05a8ee6f852e0118dd9a61796a2f6ff4837f09", + "zh:d36c0b5770841ddb6eaf0499ba3de48e5d4fc99f4829b6ab66b0fab59b1aaf4f", + "zh:ddb6a407c7f3ec63efb4dad5f948b54f7f4434ee1a2607a49680d494b1776fe1", + "zh:e0dafdd4500bec23d3ff221e3a9b60621c5273e5df867bc59ef6b7e41f5c91f6", + "zh:ece8742fd2882a8fc9d6efd20e2590010d43db386b920b2a9c220cfecc18de47", + "zh:f4c6b3eb8f39105004cf720e202f04f57e3578441cfb76ca27611139bc116a82", + ] +} + +provider "registry.terraform.io/hashicorp/template" { + version = "2.2.0" + hashes = [ + "h1:94qn780bi1qjrbC3uQtjJh3Wkfwd5+tTtJHOb7KTg9w=", + "zh:01702196f0a0492ec07917db7aaa595843d8f171dc195f4c988d2ffca2a06386", + "zh:09aae3da826ba3d7df69efeb25d146a1de0d03e951d35019a0f80e4f58c89b53", + "zh:09ba83c0625b6fe0a954da6fbd0c355ac0b7f07f86c91a2a97849140fea49603", + "zh:0e3a6c8e16f17f19010accd0844187d524580d9fdb0731f675ffcf4afba03d16", + "zh:45f2c594b6f2f34ea663704cc72048b212fe7d16fb4cfd959365fa997228a776", + "zh:77ea3e5a0446784d77114b5e851c970a3dde1e08fa6de38210b8385d7605d451", + "zh:8a154388f3708e3df5a69122a23bdfaf760a523788a5081976b3d5616f7d30ae", + "zh:992843002f2db5a11e626b3fc23dc0c87ad3729b3b3cff08e32ffb3df97edbde", + "zh:ad906f4cebd3ec5e43d5cd6dc8f4c5c9cc3b33d2243c89c5fc18f97f7277b51d", + "zh:c979425ddb256511137ecd093e23283234da0154b7fa8b21c2687182d9aea8b2", + ] +} + +provider "registry.terraform.io/josenk/esxi" { + version = "1.10.3" + hashes = [ + "h1:o78ERC8riDT2nHWCbXECt+S/RKwM98/G5ZojJHRm8fA=", + "zh:208a6a8092fa50d63fe1780447f2c4c3115b1987902a0c986452172c2c35677e", + "zh:3a0755aec960e32dbfbb31be61bba6ee2d11aff0513707e93f4eaebe3d557d93", + "zh:3daef19f36c9438771833dc15ae0eddc95faf9df00f9de9ab143bd031314ce50", + "zh:4cb4ba24aa3975f3928f5f16bc535ce0b18159ede16abaee39f93b3e13c36334", + "zh:56f30098aca0874210c4546530a5bfa5dd49bfad63950f3d9f3623cc6767280b", + "zh:716c62ae2d0cb7c64b5b3328792d7e135c4c0905e399e4b7335b7808508a7027", + "zh:81b0e8fab21088785e51f2d6af518ac31959b104facb2a25b0481d586a6fc692", + "zh:8b415ab7e39ca8e16f923bc73a8af418859faa594d97ed73e3a4aff7a736b08f", + "zh:9072bdd960ef85dc735b82423560b027ebb44790af1e84b122f1014f96acfc91", + "zh:9e6e1c2a7bf93c4705d280cea5b3d6bfb84c4540b92563e64fbc3a20155ef775", + "zh:af14c0e96273470dfb398b1701f575e5ea4963c208a32a4436db5ea0e2f2f385", + "zh:c79e772730ab4ac75c58d368f452c7a76abc738bb3666df0cfb567ac01e32c59", + "zh:d0068e7ca381d4b18df8b0219540733c996dfc69a89673b6bf52e4d69350c09a", + "zh:e188b20664bdcda50c45d071a8d0ba9870368941dac9138cd655f50db4ea15d2", + ] +} diff --git a/terraform/ansible-inventory.tmpl b/terraform/ansible-inventory.tmpl new file mode 100644 index 0000000..a897d44 --- /dev/null +++ b/terraform/ansible-inventory.tmpl @@ -0,0 +1,5 @@ +[esxi] +${esxi_name} ansible_host=${esxi_ip} ansible_user=testuser ansible_ssh_private_key_file=${esxi_private_key_file} + +[azure] +${azure_name} ansible_host=${azure_ip} ansible_user=testuser ansible_ssh_private_key_file=${azure_private_key_file} diff --git a/terraform/cloudinit-azure.yaml b/terraform/cloudinit-azure.yaml new file mode 100644 index 0000000..48accb1 --- /dev/null +++ b/terraform/cloudinit-azure.yaml @@ -0,0 +1,8 @@ +#cloud-config +local-hostname: ${hostname} + +users: + - name: testuser + ssh-authorized-keys: + - ${azure_ssh_public_key} + shell: /bin/bash diff --git a/terraform/main.tf b/terraform/main.tf new file mode 100644 index 0000000..6481e33 --- /dev/null +++ b/terraform/main.tf @@ -0,0 +1,156 @@ +# ESXi +# Render userdata template with skylab SSH key +data "template_file" "esxi_userdata" { + template = file("${path.module}/userdata.tftpl") + vars = { + skylab-ssh-public-key = trimspace(var.skylab_ssh_public_key) + azure-ssh-private-key = indent(6, trimspace(var.azure_ssh_private_key)) + azure-vm-ip = azurerm_linux_virtual_machine.week-6.public_ip_address + } +} + +resource "esxi_portgroup" "week-6" { + name = "${var.prefix}-portgoup" + vswitch = "vSwitch0" +} + +resource "esxi_guest" "week-6" { + guest_name = var.prefix + disk_store = "datadisk1" + + memsize = "2048" + numvcpus = "1" + power = "on" + + ovf_source = "https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-amd64.ova" + + network_interfaces { + virtual_network = esxi_portgroup.week-6.name + } + + guestinfo = { + "metadata" = base64encode(templatefile("${path.module}/metadata.yaml", { + hostname = var.prefix + })) + "metadata.encoding" = "base64" + "userdata" = base64encode(data.template_file.esxi_userdata.rendered) + "userdata.encoding" = "base64" + } +} + +# Azure + +resource "azurerm_virtual_network" "week-6" { + name = "${var.prefix}-network" + address_space = ["10.0.0.0/16"] + location = var.azure_location + resource_group_name = var.azure_resourcegroup +} + +resource "azurerm_subnet" "week-6" { + name = "internal" + resource_group_name = var.azure_resourcegroup + virtual_network_name = azurerm_virtual_network.week-6.name + address_prefixes = ["10.0.2.0/24"] +} + +resource "azurerm_public_ip" "week-6" { + name = "${var.prefix}-pip" + resource_group_name = var.azure_resourcegroup + location = var.azure_location + allocation_method = "Static" +} + +resource "azurerm_network_interface" "week-6" { + name = "${var.prefix}-nic" + location = var.azure_location + resource_group_name = var.azure_resourcegroup + + ip_configuration { + name = "internal" + subnet_id = azurerm_subnet.week-6.id + private_ip_address_allocation = "Dynamic" + public_ip_address_id = azurerm_public_ip.week-6.id + } +} + +resource "azurerm_network_security_group" "week-6" { + name = "${var.prefix}-nsg" + location = var.azure_location + resource_group_name = var.azure_resourcegroup + security_rule { + access = "Allow" + direction = "Inbound" + name = "tls" + priority = 100 + protocol = "Tcp" + source_port_range = "*" + source_address_prefix = "*" + destination_port_range = "22" + destination_address_prefix = azurerm_network_interface.week-6.private_ip_address + } +} + +resource "azurerm_network_interface_security_group_association" "week-6" { + network_interface_id = azurerm_network_interface.week-6.id + network_security_group_id = azurerm_network_security_group.week-6.id +} + +# Render userdata template with skylab SSH key +data "template_file" "azure_cloudinit" { + template = file("${path.module}/cloudinit-azure.yaml") + vars = { + hostname = var.prefix + azure_ssh_public_key = trimspace(var.azure_ssh_public_key) + } +} + +resource "azurerm_linux_virtual_machine" "week-6" { + name = var.prefix + location = var.azure_location + resource_group_name = var.azure_resourcegroup + network_interface_ids = [ + azurerm_network_interface.week-6.id, + ] + size = "Standard_B2ats_v2" + + admin_username = "adminuser" + admin_ssh_key { + username = "adminuser" + public_key = trimspace(var.azure_ssh_public_key) + } + + custom_data = base64encode(data.template_file.azure_cloudinit.rendered) + + os_disk { + caching = "ReadWrite" + storage_account_type = "Standard_LRS" + } + + source_image_reference { + publisher = "Canonical" + offer = "ubuntu-24_04-lts" + sku = "server" + version = "latest" + } +} + +locals { + inventory = templatefile("${path.module}/ansible-inventory.tmpl", { + esxi_name = esxi_guest.week-6.guest_name + esxi_ip = esxi_guest.week-6.ip_address + esxi_private_key_file = "~/.ssh/skylab" + azure_name = azurerm_linux_virtual_machine.week-6.name + azure_ip = azurerm_linux_virtual_machine.week-6.public_ip_address + azure_private_key_file = "~/.ssh/azure" + }) +} + +resource "local_file" "ansible_inventory" { + content = local.inventory + filename = "${path.module}/../ansible/inventory.ini" +} + +output "ip_addresses" { + value = local_file.ansible_inventory.content +} diff --git a/terraform/metadata.yaml b/terraform/metadata.yaml new file mode 100644 index 0000000..1366afc --- /dev/null +++ b/terraform/metadata.yaml @@ -0,0 +1,2 @@ +#cloud-config +local-hostname: ${hostname} diff --git a/terraform/providers.tf b/terraform/providers.tf new file mode 100644 index 0000000..70db5d0 --- /dev/null +++ b/terraform/providers.tf @@ -0,0 +1,29 @@ +terraform { + required_providers { + esxi = { + source = "registry.terraform.io/josenk/esxi" + } + azurerm = { + source = "hashicorp/azurerm" + version = "~> 4.27.0" + } + } + backend "pg" { + conn_str = "postgres://terraform:tfbackend123@192.168.1.4/terraform_state?sslmode=disable" + } +} + +provider "esxi" { + esxi_hostname = var.esxi_hostname + esxi_hostport = var.esxi_hostport + esxi_hostssl = var.esxi_hostssl + esxi_username = var.esxi_username + esxi_password = var.esxi_password +} + + +provider "azurerm" { + resource_provider_registrations = "none" + subscription_id = var.azure_subscriptionid + features {} +} diff --git a/terraform/secrets.auto.tfvars.example b/terraform/secrets.auto.tfvars.example new file mode 100644 index 0000000..17b23b2 --- /dev/null +++ b/terraform/secrets.auto.tfvars.example @@ -0,0 +1,8 @@ +esxi_hostname = "" +esxi_username = "" +esxi_password = "" +azure_subscriptionid = "" +azure_resourcegroup = "" +skylab_ssh_public_key = "" +azure_ssh_public_key = "" +azure_ssh_private_key = "" \ No newline at end of file diff --git a/terraform/userdata.tftpl b/terraform/userdata.tftpl new file mode 100644 index 0000000..d2800d9 --- /dev/null +++ b/terraform/userdata.tftpl @@ -0,0 +1,27 @@ +#cloud-config +users: + - name: testuser + ssh-authorized-keys: + - ${skylab-ssh-public-key} + shell: /bin/bash + sudo: ["ALL=(ALL) NOPASSWD:ALL"] + +write_files: + - path: /home/testuser/.ssh/azure + content: | + ${azure-ssh-private-key} + permissions: "0600" + owner: testuser:testuser + defer: true + + - path: /home/testuser/.ssh/config + content: | + Host azurevm + HostName ${azure-vm-ip} + User iac + IdentityFile ~/.ssh/azure + StrictHostKeyChecking no + UserKnownHostsFile=/dev/null + permissions: "0600" + owner: testuser:testuser + defer: true diff --git a/terraform/variables.tf b/terraform/variables.tf new file mode 100644 index 0000000..bd91f1d --- /dev/null +++ b/terraform/variables.tf @@ -0,0 +1,53 @@ +variable "prefix" { + description = "The Prefix used for all resources" + default = "week-6" +} + +variable "esxi_hostname" { + description = "IP address of the ESXi host" +} + +variable "esxi_hostport" { + description = "SSH port of the ESXi host" + default = "22" +} + +variable "esxi_hostssl" { + description = "SSL port of the ESXi host" + default = "443" +} + +variable "esxi_username" { + description = "Username to connect to the ESXi host" +} + +variable "esxi_password" { + description = "Password to connect to the ESXi host" + sensitive = true +} + +variable "azure_subscriptionid" { + description = "ID of the Azure Subscription." + sensitive = true +} + +variable "azure_resourcegroup" { + description = "Name of the Azure Resource Group." +} + +variable "azure_location" { + description = "Location of the Azure resources" + default = "westeurope" +} + +variable "skylab_ssh_public_key" { + description = "Public key for the ESXi VM" +} + +variable "azure_ssh_public_key" { + description = "Public key for the Azure VM" +} + +variable "azure_ssh_private_key" { + description = "Private key of the Azure VM" +}