azure-bastion.yml

name: "azure-09-administer-linux-vm-based-on-toolset-image"

on:
  workflow_call:
    inputs:
      resourceGroupName:
        description: "The name of an existing resource group"
        required: true
        type: string
      vmName:
        description: "The name given to bastion VM that provides a curated toolset"
        required: true
        type: string
      suffix:
        description: "A Virtual Network suffix.  Used for looking up the subnet where this bastion will be running and creating a network interface and public IP."
        required: true
        type: string
      imageName:
        required: true
        type: string
        description: "The image from the shared gallery to use"
      sharedGalleryName:
        required: true
        type: string
        description: "The shared gallery name"
      imageVersion:
        required: true
        type: string
        description: "The image version from the shared gallery to use"
      sigRgName:
        required: true
        type: string
        description: "Name of resource group that the gallery is in"
      action:
        required: true
        type: string
        description: "Create (new) or destroy (existing)"
    secrets:
      AZURE_AD_CLIENT_ID:
        required: true
      AZURE_AD_CLIENT_SECRET:
        required: true
      AZURE_SUBSCRIPTION_ID:
        required: true
      AZURE_AD_TENANT_ID:
        required: true
      TF_BACKEND_RESOURCE_GROUP_NAME:
        required: true
      TF_BACKEND_STORAGE_ACCOUNT_NAME:
        required: true
      TF_BACKEND_STORAGE_CONTAINER_NAME:
        required: true
    outputs:
      bastion_vm_name:
        description: "The name of the bastion VM"
        value: ${{ jobs.terraform.outputs.bastion_vm_name }}
      b64_private_openssh_key:
        description: "The contents of private SSH key"
        value: ${{ jobs.terraform.outputs.b64_private_openssh_key }}
jobs:
  terraform:
    env:
      ARM_CLIENT_ID: ${{ secrets.AZURE_AD_CLIENT_ID }}
      ARM_CLIENT_SECRET: ${{ secrets.AZURE_AD_CLIENT_SECRET }}
      ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      ARM_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }}
      TF_VAR_vm_resource_group_name: ${{ inputs.resourceGroupName }}
      TF_VAR_vm_name: ${{ inputs.vmName }}
      TF_VAR_toolset_image_version: ${{ inputs.imageVersion }}
      TF_VAR_toolset_image_name: ${{ inputs.imageName }}
      TF_VAR_sig_name: ${{ inputs.sharedGalleryName }}
      TF_VAR_suffix: ${{ inputs.suffix }}
      TF_VAR_sig_resource_group_name: ${{ inputs.sigRgName }}
    runs-on: ubuntu-22.04

    outputs:
      bastion_vm_name: ${{ steps.set_outputs.outputs.bastion_vm_name }}
      b64_private_openssh_key: ${{ steps.set_outputs.outputs.b64_private_openssh_key }}

    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-22.04, macos-latest, or windows-latest
    defaults:
      run:
        shell: bash
        working-directory: terraform/azure/bastion

    steps:
    # Checkout the repository to the GitHub Actions runner
    - name: Checkout
      uses: actions/checkout@v4

    # Install the latest version of Terraform CLI
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_wrapper: false
        terraform_version: 1.5.7

    - name: Generate backend configuration
      run: |
          cp ../backend/backend.tf .
          echo "resource_group_name = \"${{ secrets.TF_BACKEND_RESOURCE_GROUP_NAME }}\"" > config.azurerm.tfbackend
          echo "storage_account_name = \"${{ secrets.TF_BACKEND_STORAGE_ACCOUNT_NAME }}\"" >> config.azurerm.tfbackend
          echo "container_name = \"${{ secrets.TF_BACKEND_STORAGE_CONTAINER_NAME }}\"" >> config.azurerm.tfbackend
          echo "key = \"${{ inputs.resourceGroupName }}.${{ inputs.vmName }}.bastion.tfstate\"" >> config.azurerm.tfbackend

    # Initialize a new or existing Terraform working directory by creating initial files, loading any remote state, downloading modules, etc.
    - name: Terraform Init
      run: terraform init -upgrade -backend-config=./config.azurerm.tfbackend

    # Checks that all Terraform configuration files adhere to a canonical format
    - name: Terraform Format
      run: terraform fmt -check

    # Generates an execution plan for Terraform
    - name: Terraform Plan
      if: inputs.action == 'create'
      run: terraform plan

    - name: Terraform Apply
      if: inputs.action == 'create'
      run: terraform apply -auto-approve

    - name: Terraform Destroy
      if: inputs.action == 'destroy'
      run: terraform destroy -auto-approve

    - name: Set Outputs
      id: set_outputs
      if: inputs.action == 'create'
      run: |
        bastion_vm_name=$(terraform output --raw bastion_vm_name)
        echo "bastion_vm_name=${bastion_vm_name}" >> $GITHUB_OUTPUT
        b64_private_openssh_key=$(terraform output --raw private_openssh_key | base64 -w 0)
        echo "b64_private_openssh_key=${b64_private_openssh_key}" >> $GITHUB_OUTPUT