-
Notifications
You must be signed in to change notification settings - Fork 192
/
main.tf
executable file
·432 lines (388 loc) · 14.9 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
terraform {
required_version = ">= 0.14.3"
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "~> 2.92.0"
}
random = {
version = "~> 2.2.1"
}
}
}
provider "azurerm" {
subscription_id = var.subscription_id
client_id = var.client_id
client_secret = var.client_secret
tenant_id = var.tenant_id
features {}
}
//********************** Basic Configuration **************************//
module "common" {
source = "../modules/common"
resource_group_name = var.resource_group_name
location = var.location
admin_password = var.admin_password
installation_type = var.installation_type
template_name = var.template_name
template_version = var.template_version
number_of_vm_instances = var.number_of_vm_instances
allow_upload_download = var.allow_upload_download
vm_size = var.vm_size
disk_size = var.disk_size
is_blink = var.is_blink
os_version = var.os_version
vm_os_sku = var.vm_os_sku
vm_os_offer = var.vm_os_offer
authentication_type = var.authentication_type
}
//********************** Networking **************************//
data "azurerm_subnet" "frontend" {
name = var.frontend_subnet_name
virtual_network_name = var.vnet_name
resource_group_name = var.vnet_resource_group
}
data "azurerm_subnet" "backend" {
name = var.backend_subnet_name
virtual_network_name = var.vnet_name
resource_group_name = var.vnet_resource_group
}
//********************** Load Balancers **************************//
resource "random_id" "random_id" {
byte_length = 13
keepers = {
rg_id = module.common.resource_group_id
}
}
resource "azurerm_public_ip" "public-ip-lb" {
count = var.deployment_mode != "Internal" ? 1 : 0
name = "${var.vmss_name}-app-1"
location = module.common.resource_group_location
resource_group_name = module.common.resource_group_name
allocation_method = var.vnet_allocation_method
sku = var.sku
domain_name_label = "${lower(var.vmss_name)}-${random_id.random_id.hex}"
}
resource "azurerm_lb" "frontend-lb" {
count = var.deployment_mode != "Internal" ? 1 : 0
name = "frontend-lb"
location = module.common.resource_group_location
resource_group_name = module.common.resource_group_name
sku = var.sku
frontend_ip_configuration {
name = "${var.vmss_name}-app-1"
public_ip_address_id = azurerm_public_ip.public-ip-lb[0].id
}
}
resource "azurerm_lb_backend_address_pool" "frontend-lb-pool" {
count = var.deployment_mode != "Internal" ? 1 : 0
resource_group_name = module.common.resource_group_name
loadbalancer_id = azurerm_lb.frontend-lb[0].id
name = "${var.vmss_name}-app-1"
}
resource "azurerm_lb" "backend-lb" {
count = var.deployment_mode != "External" ? 1 : 0
name = "backend-lb"
location = module.common.resource_group_location
resource_group_name = module.common.resource_group_name
sku = var.sku
frontend_ip_configuration {
name = "backend-lb"
subnet_id = data.azurerm_subnet.backend.id
private_ip_address_allocation = "Static"
private_ip_address = cidrhost(data.azurerm_subnet.backend.address_prefix,var.backend_lb_IP_address)
}
}
resource "azurerm_lb_backend_address_pool" "backend-lb-pool" {
count = var.deployment_mode != "External" ? 1 : 0
name = "backend-lb-pool"
loadbalancer_id = azurerm_lb.backend-lb[0].id
resource_group_name = module.common.resource_group_name
}
resource "azurerm_lb_probe" "azure_lb_healprob" {
count = var.deployment_mode == "Standard" ? 2 : 1
depends_on = [azurerm_lb.frontend-lb, azurerm_lb.frontend-lb]
resource_group_name = module.common.resource_group_name
loadbalancer_id = var.deployment_mode == "Standard" ? (count.index == 0 ? azurerm_lb.frontend-lb[0].id : azurerm_lb.backend-lb[0].id) : (var.deployment_mode == "External" ? azurerm_lb.frontend-lb[0].id : azurerm_lb.backend-lb[0].id)
name = var.deployment_mode == "Standard" ? (count.index == 0 ? "${var.vmss_name}-app-1" : "backend-lb") : (var.deployment_mode == "External" ? "${var.vmss_name}-app-1" : "backend-lb")
protocol = var.lb_probe_protocol
port = var.lb_probe_port
interval_in_seconds = var.lb_probe_interval
number_of_probes = var.lb_probe_unhealthy_threshold
}
// Standard deployment
resource "azurerm_lb_rule" "lbnatrule-standard" {
count = var.deployment_mode == "Standard" ? 2 : 0
depends_on = [azurerm_lb.frontend-lb[0],azurerm_lb_probe.azure_lb_healprob,azurerm_lb.backend-lb[0]]
resource_group_name = module.common.resource_group_name
loadbalancer_id = count.index == 0 ? azurerm_lb.frontend-lb[0].id : azurerm_lb.backend-lb[0].id
name = count.index == 0 ? "${var.vmss_name}-app-1" : "backend-lb"
protocol = count.index == 0 ? "Tcp" : "All"
frontend_port = count.index == 0 ? var.frontend_port : "0"
backend_port = count.index == 0 ? var.backend_port : "0"
backend_address_pool_id = count.index == 0 ? azurerm_lb_backend_address_pool.frontend-lb-pool[0].id : azurerm_lb_backend_address_pool.backend-lb-pool[0].id
frontend_ip_configuration_name = count.index == 0 ? azurerm_lb.frontend-lb[0].frontend_ip_configuration[0].name : azurerm_lb.backend-lb[0].frontend_ip_configuration[0].name
probe_id = azurerm_lb_probe.azure_lb_healprob[count.index].id
load_distribution = count.index == 0 ? var.frontend_load_distribution : var.backend_load_distribution
enable_floating_ip = var.enable_floating_ip
}
// External deployment
resource "azurerm_lb_rule" "lbnatrule-external" {
count = var.deployment_mode == "External" ? 1 : 0
depends_on = [azurerm_lb.frontend-lb[0],azurerm_lb_probe.azure_lb_healprob]
resource_group_name = module.common.resource_group_name
loadbalancer_id = azurerm_lb.frontend-lb[0].id
name = "${var.vmss_name}-app-1"
protocol = "Tcp"
frontend_port = var.frontend_port
backend_port = var.backend_port
backend_address_pool_id = azurerm_lb_backend_address_pool.frontend-lb-pool[0].id
frontend_ip_configuration_name = azurerm_lb.frontend-lb[0].frontend_ip_configuration[0].name
probe_id = azurerm_lb_probe.azure_lb_healprob[0].id
load_distribution = var.frontend_load_distribution
enable_floating_ip = var.enable_floating_ip
}
// Internal deployment
resource "azurerm_lb_rule" "lbnatrule-internal" {
count = var.deployment_mode == "Internal" ? 1 : 0
depends_on = [azurerm_lb_probe.azure_lb_healprob,azurerm_lb.backend-lb[0]]
resource_group_name = module.common.resource_group_name
loadbalancer_id = azurerm_lb.backend-lb[0].id
name = "backend-lb"
protocol = "All"
frontend_port = "0"
backend_port = "0"
backend_address_pool_id = azurerm_lb_backend_address_pool.backend-lb-pool[0].id
frontend_ip_configuration_name = azurerm_lb.backend-lb[0].frontend_ip_configuration[0].name
probe_id = azurerm_lb_probe.azure_lb_healprob[0].id
load_distribution = var.backend_load_distribution
enable_floating_ip = var.enable_floating_ip
}
//********************** Storage accounts **************************//
// Generate random text for a unique storage account name
resource "random_id" "randomId" {
keepers = {
# Generate a new ID only when a new resource group is defined
resource_group = module.common.resource_group_name
}
byte_length = 8
}
resource "azurerm_storage_account" "vm-boot-diagnostics-storage" {
name = "diag${random_id.randomId.hex}"
resource_group_name = module.common.resource_group_name
location = module.common.resource_group_location
account_tier = module.common.storage_account_tier
account_replication_type = module.common.account_replication_type
}
//********************** Virtual Machines **************************//
locals {
SSH_authentication_type_condition = var.authentication_type == "SSH Public Key" ? true : false
availability_zones_num_condition = var.availability_zones_num == "0" ? null : var.availability_zones_num == "1" ? ["1"] : var.availability_zones_num == "2" ? ["1", "2"] : ["1", "2", "3"]
custom_image_condition = var.source_image_vhd_uri == "noCustomUri" ? false : true
management_interface_name = split("-", var.management_interface)[0]
management_ip_address_type = split("-", var.management_interface)[1]
}
resource "azurerm_image" "custom-image" {
count = local.custom_image_condition ? 1 : 0
name = "custom-image"
location = var.location
resource_group_name = module.common.resource_group_name
os_disk {
os_type = "Linux"
os_state = "Generalized"
blob_uri = var.source_image_vhd_uri
}
}
resource "azurerm_virtual_machine_scale_set" "vmss" {
name = var.vmss_name
location = module.common.resource_group_location
resource_group_name = module.common.resource_group_name
zones = local.availability_zones_num_condition
overprovision = false
dynamic "identity" {
for_each = var.enable_custom_metrics ? [
1] : []
content {
type = "SystemAssigned"
}
}
storage_profile_image_reference {
id = local.custom_image_condition ? azurerm_image.custom-image[0].id : null
publisher = local.custom_image_condition ? null : module.common.publisher
offer = module.common.vm_os_offer
sku = module.common.vm_os_sku
version = module.common.vm_os_version
}
storage_profile_os_disk {
create_option = module.common.storage_os_disk_create_option
caching = module.common.storage_os_disk_caching
managed_disk_type = module.common.storage_account_type
}
dynamic "plan" {
for_each = local.custom_image_condition ? [
] : [1]
content {
name = module.common.vm_os_sku
publisher = module.common.publisher
product = module.common.vm_os_offer
}
}
os_profile {
computer_name_prefix = var.vmss_name
admin_username = module.common.admin_username
admin_password = module.common.admin_password
custom_data = templatefile("${path.module}/cloud-init.sh",{
installation_type=module.common.installation_type
allow_upload_download= module.common.allow_upload_download
os_version=module.common.os_version
template_name=module.common.template_name
template_version=module.common.template_version
template_type = "terraform"
is_blink=module.common.is_blink
bootstrap_script64=base64encode(var.bootstrap_script)
location=module.common.resource_group_location
sic_key=var.sic_key
vnet=data.azurerm_subnet.frontend.address_prefix
enable_custom_metrics=var.enable_custom_metrics ? "yes" : "no"
admin_shell = var.admin_shell
})
}
os_profile_linux_config {
disable_password_authentication = local.SSH_authentication_type_condition
dynamic "ssh_keys" {
for_each = local.SSH_authentication_type_condition ? [
1] : []
content {
path = "/home/notused/.ssh/authorized_keys"
key_data = file("${path.module}/azure_public_key")
}
}
}
boot_diagnostics {
enabled = module.common.boot_diagnostics
storage_uri = module.common.boot_diagnostics ? join(",", azurerm_storage_account.vm-boot-diagnostics-storage.*.primary_blob_endpoint) : ""
}
upgrade_policy_mode = "Manual"
network_profile {
name = "eth0"
primary = true
ip_forwarding = false
accelerated_networking = true
ip_configuration {
name = "ipconfig1"
subnet_id = data.azurerm_subnet.frontend.id
load_balancer_backend_address_pool_ids = var.deployment_mode != "Internal" ? [azurerm_lb_backend_address_pool.frontend-lb-pool[0].id]: null
primary = true
public_ip_address_configuration {
name = "${var.vmss_name}-public-ip"
idle_timeout = 15
domain_name_label = "${var.vmss_name}-dns-name"
}
}
}
network_profile {
name = "eth1"
primary = false
ip_forwarding = true
accelerated_networking = true
ip_configuration {
name = "ipconfig2"
subnet_id = data.azurerm_subnet.backend.id
load_balancer_backend_address_pool_ids = var.deployment_mode != "External" ? [azurerm_lb_backend_address_pool.backend-lb-pool[0].id] : null
primary = true
}
}
sku {
capacity = var.number_of_vm_instances
name = module.common.vm_size
tier = "Standard"
}
tags = var.management_interface == "eth0"?{
x-chkp-management = var.management_name,
x-chkp-template = var.configuration_template_name,
x-chkp-ip-address = local.management_ip_address_type,
x-chkp-management-interface = local.management_interface_name,
x-chkp-management-address = var.management_IP,
x-chkp-topology = "eth0:external,eth1:internal",
x-chkp-anti-spoofing = "eth0:false,eth1:false",
x-chkp-srcImageUri = var.source_image_vhd_uri
}:{
x-chkp-management = var.management_name,
x-chkp-template = var.configuration_template_name,
x-chkp-ip-address = local.management_ip_address_type,
x-chkp-management-interface = local.management_interface_name,
x-chkp-topology = "eth0:external,eth1:internal",
x-chkp-anti-spoofing = "eth0:false,eth1:false",
x-chkp-srcImageUri = var.source_image_vhd_uri
}
}
resource "azurerm_monitor_autoscale_setting" "vmss_settings" {
depends_on = [azurerm_virtual_machine_scale_set.vmss]
name = var.vmss_name
resource_group_name = module.common.resource_group_name
location = module.common.resource_group_location
target_resource_id = azurerm_virtual_machine_scale_set.vmss.id
profile {
name = "Profile1"
capacity {
default = module.common.number_of_vm_instances
minimum = var.minimum_number_of_vm_instances
maximum = var.maximum_number_of_vm_instances
}
rule {
metric_trigger {
metric_name = "Percentage CPU"
metric_resource_id = azurerm_virtual_machine_scale_set.vmss.id
time_grain = "PT1M"
statistic = "Average"
time_window = "PT5M"
time_aggregation = "Average"
operator = "GreaterThan"
threshold = 80
}
scale_action {
direction = "Increase"
type = "ChangeCount"
value = "1"
cooldown = "PT5M"
}
}
rule {
metric_trigger {
metric_name = "Percentage CPU"
metric_resource_id = azurerm_virtual_machine_scale_set.vmss.id
time_grain = "PT1M"
statistic = "Average"
time_window = "PT5M"
time_aggregation = "Average"
operator = "LessThan"
threshold = 60
}
scale_action {
direction = "Decrease"
type = "ChangeCount"
value = "1"
cooldown = "PT5M"
}
}
}
notification {
email {
send_to_subscription_administrator = false
send_to_subscription_co_administrator = false
custom_emails = var.notification_email == "" ? [] : [var.notification_email]
}
}
}
resource "azurerm_role_assignment" "custom_metrics_role_assignment"{
depends_on = [azurerm_virtual_machine_scale_set.vmss]
count = var.enable_custom_metrics ? 1 : 0
role_definition_id = join("", ["/subscriptions/", var.subscription_id, "/providers/Microsoft.Authorization/roleDefinitions/", "3913510d-42f4-4e42-8a64-420c390055eb"])
principal_id = lookup(azurerm_virtual_machine_scale_set.vmss.identity[0], "principal_id")
scope = module.common.resource_group_id
lifecycle {
ignore_changes = [
role_definition_id, principal_id
]
}
}