Terraform Module - Azure Cloud Cluster Elastic Storage Deployment

This module deploys a new Rubrik Cloud Cluster Elastic Storage (CCES) in Azure.

Usage

module "rubrik_azure_cloud_cluster_elastic_storage" {
  source  = "rubrikinc/rubrik-cloud-cluster-elastic-storage/azure"
  version = "1.0.2"

  admin_email           = "build@rubrik.com"
  admin_password        = "RubrikGoForward"
  azure_cces_plan_name  = "rubrik-cdm-90"
  azure_cces_sku        = "rubrik-cdm-90"
  azure_location        = "West US2"
  azure_resource_group  = "Rubrik-CCES"
  azure_sa_name         = "rubrikcces"
  azure_subnet_name     = "private-subnet"
  azure_vnet_name       = "private-vnet"
  azure_vnet_rg_name    = "Company_VNets"
  cluster_name          = "rubrik-cloud-cluster"
  dns_name_servers      = ["8.8.8.8", "8.8.4.4"]
  dns_search_domain     = ["rubrikdemo.com"]
  number_of_nodes       = 3
  ntp_server1_name      = "0.north-america.pool.ntp.org"
  ntp_server2_name      = "1.north-america.pool.ntp.org"
}

Changelog

v1.0.2

Make the Storage service endpoint of the VPC optional. The Storage endpoint is enabled by default, but it's possible to not enable it by setting azure_enable_subnet_storage_endpoint module input variable to false.
Add support for automatically registering the Rubrik Cloud Cluster with Rubrik Security Cloud. To register the cluster set the register_cluster_with_rsc module input variable to true.
NTP servers can now be specified using a FQDN. Previously they were required to be IP addresses, now both IP addresses and FQDN are allowed.
Relax the version constraint for the Azure RM Terraform provider to >=4.14.0.
Bump the RSC (polaris) Terraform provider from version ~>1.1.1 to >=1.1.3.
Run terraform fmt on the module.

v1.0.1

Deprecate the azure_subscription_id module input variable in favor of provider configuration provided by the root module.

v1.0.0

Remove hard-coded provider setup from the module.
Add gen_docs.sh script and update the Terraform documentation.
Fix SKU regular expression.
Bump RSC (polaris) Terraform provider to 1.1.1.

v0.2.0

Initial stable release of the Terraform module for deploying Rubrik Cloud Cluster Elastic Storage (CCES) in Azure.
Support for deploying multi-node CCES clusters with configurable node count.
Automated Azure Storage Account and container creation with optional immutability features.
SSH key pair generation and secure storage in Azure Key Vault.
Network interface and VM provisioning with marketplace image support.
Automatic disk attachment for data, metadata, and cache storage (split disk support for CDM 9.2.2+).
Bootstrap integration using Polaris provider for automated cluster configuration.
Comprehensive variable validation and resource locking capabilities.
Support for custom Azure tags and resource group management.
Initial module development and testing.
Basic CCES deployment functionality.
Core Azure resource provisioning.

Upgrading

Before upgrading the module, be sure to read through the changelog to understand the changes in the new version and any upgrade instruction for the version you are upgrading to.

To upgrade the module to a new version, use the following steps:

Update the version field in the module block to the version you want to upgrade to, e.g. version = "1.0.3".
Run terraform init --upgrade to update the modules in your configuration.
Run terraform plan and check the output carefully to ensure that there are no unexpected changes caused by the upgrade.
Run terraform apply if there are expected changes that you want to apply.

Note, as variables in the module are deprecated, you may see warnings in the output of terraform plan. These warnings can be ignored, but it's recommended that you follow the instructions in the deprecation message. Eventually deprecated variables will be removed.

v1.0.0 to v1.0.1

In version v1.0.1 the azure_subscription_id input variable has been deprecated. If you are using the input variable, you will see a warning message similar to this:

The 'azure_subscription_id' variable is deprecated and should not be used as it will be removed in a future release. Configure the subscription ID in the azurerm provider configuration instead.

Remove the variable from your module block and instead pass it to the Azure RM provider configuration block in the root module. Similar to this:

provider "azurerm" {
  subscription_id = "<subscription-id>"
}

Where <subscription-id> is your Azure subscription ID.

v0.2.0 to v1.0.0

In version v1.0.0 the provider configuration blocks has been removed from the module to support the for_each meta-argument. Instead, the configuration blocks needs to be specified in the root module of the Terraform configuration. If your root module doesn't already contain a provider configuration block for the Azure RM provider, you can use this provider configuration block:

provider "azurerm" {
  features {
    key_vault {
      purge_soft_delete_on_destroy    = true
      recover_soft_deleted_key_vaults = true
    }
  }

  subscription_id = "<subscription-id>"
}

Where <subscription-id> is your Azure subscription ID.

Authenticating with Azure

You can authenticate Terraform with Azure by either using the Azure CLI or by using environment variables.

Authenticating with Azure CLI

Terraform Module for AzureRM CLI Authentication provides a complete guide on how to authenticate Terraform with Azure. The following commands can be used from a command line interface with the Microsoft Azure CLI to manually run Terraform:

az login --tenant <tenant-id>

Where <tenant-id> is the ID of the tenant to log in to. If you only have one tenant you can remove the --tenant option.

Next before running this module, the subscription must be selected. Do this by running the command:

az account set --subscription <subscription-id>

Where <subscription-id> is the ID of the subscription where CCES will be deployed.

Authenticating with Environment Variables

For environments that require a non-interactive authentication method such as Terraform Cloud, the Azure CLI can be authenticated using environment variables. The following environment variables must be set:

ARM_CLIENT_ID
ARM_CLIENT_SECRET
ARM_TENANT_ID Additionally, you can set ARM_SUBSCRIPTION_ID. But if you specify the subscription ID in the root module of your configuration, this is not mandatory.

The environment variables can be set as follows in your terminal:

export ARM_CLIENT_ID="<client-id>"
export ARM_CLIENT_SECRET="<client-secret>"
export ARM_TENANT_ID="<tenant-id>"

Where <client-id> is the application ID of your application in Entra ID, <client-secret> is the secret of your application in Entra ID and <tenant-id> is the ID of your tenant in Azure. Alternatively, they can be added to the workspace variables in Terraform Cloud.

If you unsure how to get these, you can use the Azure CLI to create a service principal and get the values. See the Azure CLI documentation for more information.

Accept the Azure Marketplace Agreement for CCES

In order to deploy Cloud Cluster ES from the Azure marketplace two things must happen. First, the marketplace agreement for the specific plan must be accepted in the subscription where Cloud Cluster ES will be deployed. Second, valid values for the azure_cces_plan_name and azure_cces_sku input variables must be collected.

One method for accepting the Marketplace Agreement is to use the Azure CLI. To do this the SKU of the Azure Marketplace Plan for CCES to use must first be identified. To do this run the command:

az vm image list-skus --location <location> -p rubrik-inc -f rubrik-data-protection --output table`

Where <location> is the Azure Location code for the region where CCES will be deployed. E.g:

az vm image list-skus --location westus2 -p rubrik-inc -f rubrik-data-protection --output table

Depending on the current set of SKUs available, the result should look something similar to:

Location    Name
----------  --------------
westus2     rubrik-cdm-60
westus2     rubrik-cdm-70
westus2     rubrik-cdm-80
westus2     rubrik-cdm-81
westus2     rubrik-cdm-90

Tke SKUs in the output will represent the major and minor version numbers of the various Rubrik CCES releases. For example rubrik-cdm-90 represents Rubrik CDM v9.0.x. The specific maintenance release will be selected later on. Select the SKU name for the version of CCES that you plan to use.

Next the plan name for the SKU that has been selected must be obtained. Generally with CCES the plan name and the SKU name are the same, however, it is best to check in case they do differ. To do this run the command:

az vm image show --location <location> --urn rubrik-inc:rubrik-data-protection:<SKU>:latest --query plan.name --output tsv

Where <location> is the Azure Location code for the region where CCES will be deployed and <SKU> is the SKU that was selected in the previous step. E.g:

az vm image show --location westus2 --urn rubrik-inc:rubrik-data-protection:rubrik-cdm-90:latest --query plan.name --output tsv

Next the Azure Marketplace Agreement must be accepted. To do this run the command:

az vm image terms accept --offer rubrik-data-protection --publisher rubrik-inc --plan <plan-name> --output jsonc

Where <plan-name> is the name of the plan that was collected in the previous step. E.g:

az vm image terms accept --offer rubrik-data-protection --publisher rubrik-inc --plan rubrik-cdm-90 --output jsonc

Depending on the plan accepted, the result should look something similar to:

{
  "accepted": true,
  "id": "/subscriptions/<Subscription_ID>/providers/Microsoft.MarketplaceOrdering/offerTypes/Microsoft.MarketplaceOrdering/offertypes/publishers/rubrik-inc/offers/rubrik-data-protection/plans/rubrik-cdm-90/agreements/current",
  "licenseTextLink": "https://storelegalterms.blob.core.windows.net/legalterms/3E5ED_legalterms_RUBRIK%253a2DINC%253a24RUBRIK%253a2DDATA%253a2DPROTECTION%253a24RUBRIK%253a2DCDM%253a2D90%253a24JRAHGUAQ44GVF2TFRYQ5727EY5ZA3HLQ3KU2L76ISIHHQQY2ZJYDCGQTOHXDJ7LU7UO4PPM6UM6DMUQXIIVE763XZJZZNTLHNRCZXBA.txt",
  "marketplaceTermsLink": "https://mpcprodsa.blob.core.windows.net/marketplaceterms/3EDEF_marketplaceterms_VIRTUALMACHINE%253a24AAK2OAIZEAWW5H4MSP5KSTVB6NDKKRTUBAU23BRFTWN4YC2MQLJUB5ZEYUOUJBVF3YK34CIVPZL2HWYASPGDUY5O2FWEGRBYOXWZE5Y.txt",
  "name": "rubrik-cdm-90",
  "plan": "rubrik-cdm-90",
  "privacyPolicyLink": "https://www.rubrik.com/legal/privacy-policy",
  "product": "rubrik-data-protection",
  "publisher": "rubrik-inc",
  "retrieveDatetime": "2023-09-04T05:14:55.6081829Z",
  "signature": "<Unique_Signature>",
  "systemData": {
    "createdAt": "2023-09-04T05:14:57.794366+00:00",
    "createdBy": "<Subscription_ID>",
    "createdByType": "ManagedIdentity",
    "lastModifiedAt": "2023-09-04T05:14:57.794366+00:00",
    "lastModifiedBy": "<Subscription_ID>",
    "lastModifiedByType": "ManagedIdentity"
  },
  "type": "Microsoft.MarketplaceOrdering/offertypes"
}

Verify that the accepted field is set to true.

The values for the azure_cces_sku and the azure_cces_plan_name input variables are the SKU name and plan name that were collected in the previous steps.

Select the version of CCES to deploy (optional)

By default, this module will deploy the latest version of CCES that is available in the SKU that the azure_cces_sku input variable is set to. If a specific version of CCES is desired for a given SKU, run the following command to get the available version numbers:

az vm image list --location <location> --publisher rubrik-inc --offer rubrik-data-protection --sku <SKU> --all --query sku --query "[].version" --output tsv

Where <location> is the Azure Location code for the region where CCES will be deployed and <SKU> is the SKU that was selected in the previous step.

With CDM v8.0 and earlier the versions numbers represent the major.minor.maintenance number of the release. For example 8.0.3 represents CDM 8.0.3-p9-22986. There is an assumption that every maintenance release is the latest patch release as well. As patches are released to a maintenance release, the older patch release is removed.

With CDM v8.1 and later the version numbers represent the minor.maintenance.build number of the release. The SKU number represents the major.minor number of the release. For example the plan rubrik-cdm-81 with a version number of 3.1.24838 represents 8.1.3-p1-24838. This notation allows the user to understand what patch release is represented in the marketplace. The build numbers correspond to the various patch releases.

Set the input variable azure_cces_version to the version number from the list that is desired. Setting the azure_cces_version input variable to latest will deploy the latest version of CCES from the list.

Subnet Network Storage Endpoint

This module will attempt to enable the Storage Endpoint in the subnet where CCES is deployed by default. A Storage Endpoint is required by CCES. If a VNet Storage Endpoint or private Storage Endpoint will be used, the default behaviour of the module can be disabled by setting the azure_enable_subnet_storage_endpoint to false.

Additional Documentation

Requirements

Name	Version
terraform	>= 1.2.0
azapi	>=2.0.0
azurerm	>=4.14.0
polaris	>=1.1.3

Providers

Name	Version
azapi	>=2.0.0
azurerm	>=4.14.0
polaris	>=1.1.3
time	n/a
tls	n/a

Resources

Name	Type
azapi_resource.cc_container	resource
azapi_update_resource.cces_subnet_storage_endpoint	resource
azurerm_key_vault.cc_key_vault	resource
azurerm_key_vault_secret.cc_private_ssh_key	resource
azurerm_linux_virtual_machine.cces_node	resource
azurerm_managed_disk.cces_cache_disk	resource
azurerm_managed_disk.cces_data_disk	resource
azurerm_managed_disk.cces_metadata_disk	resource
azurerm_management_lock.cces_cache_disk	resource
azurerm_management_lock.cces_data_disk	resource
azurerm_management_lock.cces_metadata_disk	resource
azurerm_management_lock.cces_nic	resource
azurerm_management_lock.cces_node	resource
azurerm_network_interface.cces_nic	resource
azurerm_resource_group.cc_rg	resource
azurerm_ssh_public_key.cc_public_ssh_key	resource
azurerm_storage_account.cc_storage_account	resource
azurerm_virtual_machine_data_disk_attachment.cces_cache_disk	resource
azurerm_virtual_machine_data_disk_attachment.cces_data_disk	resource
azurerm_virtual_machine_data_disk_attachment.cces_metadata_disk	resource
polaris_cdm_bootstrap_cces_azure.bootstrap_cces_azure	resource
polaris_cdm_registration.cces_azure_registration	resource
time_sleep.wait_for_nodes_to_boot	resource
tls_private_key.cc-key	resource
azurerm_client_config.current	data source
azurerm_subnet.cces_subnet	data source
azurerm_subscription.current	data source

Inputs

Name	Description	Type	Default	Required
admin_email	The Rubrik Cloud Cluster sends messages for the admin account to this email address.	`string`	n/a	yes
admin_password	Password for the Rubrik Cloud Cluster admin account.	`string`	`"ChangeMe"`	no
azure_cces_plan_name	The Azure Marketplace Plan Name/ID of the CCES image to deploy. See the README.MD file of this module for information on finding the plan name.	`any`	n/a	yes
azure_cces_sku	The SKU for the Azure Marketplace Image of CCES to deploy. See the README.MD file of this module for information on finding the SKU.	`string`	n/a	yes
azure_cces_version	The version of CCES to deploy. Use 'latest' to deploy the latest available version. Note: This only applies to the version within a SKU (major/minor version).	`string`	`"latest"`	no
azure_cces_vm_size	The Azure VM Machine Type to use for the Cloud Cluster nodes.	`string`	`"Standard_D16s_v5"`	no
azure_enable_subnet_storage_endpoint	Whether to enable the Storage service endpoint on the VPC subnet. Defaults to `true`.	`bool`	`true`	no
azure_key_vault_name	The name of the Azure Key Vault to create, into which the CCES private ssh key will be stored.	`string`	`""`	no
azure_location	The region to deploy Rubrik Cloud Cluster resources.	`any`	n/a	yes
azure_resource_group	The Azure Resource Group into which deploy Rubrik Cloud Cluster resources.	`string`	`"RubrikCloudCluster"`	no
azure_resource_lock	Enable the Azure Resource Lock on critical components that are created by this module.	`bool`	`true`	no
azure_sa_name	The name of the Azure Storage Account to create for Rubrik Cloud Cluster resources.	`string`	n/a	yes
azure_sa_replication_type	The type of replication to use with the the Azure Storage Account for Rubrik Cloud Cluster.	`string`	`"LRS"`	no
azure_subnet_name	Name of the Azure subnet to deploy Rubrik Cloud Cluster into. This subnet must be in the VNet that is defined in the 'azure_vnet_name' variable.	`string`	n/a	yes
azure_subscription_id	Subscription ID of the Azure account to deploy Rubrik Cloud Cluster resources. Deprecated: This variable is no longer required as the subscription ID is now determined by the provider configuration.	`string`	`null`	no
azure_tags	Tags to add to the Azure resources that this Terraform script creates, including the Rubrik cluster nodes.	`map(string)`	`{}`	no
azure_vnet_name	Name of the Azure Virtual Network (VNet) to deploy Rubrik Cloud Cluster ES into.	`string`	n/a	yes
azure_vnet_rg_name	Name of the Resource Group of the Azure VNet that is defined in the 'azure_vnet_name' variable.	`string`	n/a	yes
cluster_name	Unique name to assign to the Rubrik Cloud Cluster. This will also be used as part of the Storage Account name. For example, rubrik-cloud-cluster-1, rubrik-cloud-cluster-2 etc.	`string`	`"rubrik-cloud-cluster"`	no
dns_name_servers	List of the IPv4 addresses of the DNS servers.	`list(any)`	[ "169.254.169.253" ]	no
dns_search_domain	List of search domains that the DNS Service will use to resolve host names that are not fully qualified.	`list(any)`	`[]`	no
enableImmutability	Enables object lock and versioning on the Storage Account and Container. Sets the object lock flag during bootstrap. Not supported on CDM v8.0.1 and earlier.	`bool`	`true`	no
ntp_server1_key	Symmetric key material for NTP server #1.	`string`	`""`	no
ntp_server1_key_id	The ID number of the symmetric key used with NTP server #1. (Typically this is 0)	`number`	`0`	no
ntp_server1_key_type	Symmetric key type for NTP server #1.	`string`	`""`	no
ntp_server1_name	The FQDN or IPv4 addresses of network time protocol (NTP) server #1.	`string`	`"8.8.8.8"`	no
ntp_server2_key	Symmetric key material for NTP server #2.	`string`	`""`	no
ntp_server2_key_id	The ID number of the symmetric key used with NTP server #2. (Typically this is 0)	`number`	`0`	no
ntp_server2_key_type	Symmetric key type for NTP server #2.	`string`	`""`	no
ntp_server2_name	The FQDN or IPv4 addresses of network time protocol (NTP) server #2.	`string`	`"8.8.4.4"`	no
number_of_nodes	The total number of nodes in Rubrik Cloud Cluster.	`number`	`3`	no
register_cluster_with_rsc	Register the Rubrik Cloud Cluster with Rubrik Security Cloud.	`bool`	`false`	no
timeout	The number of seconds to wait to establish a connection the Rubrik cluster before returning a timeout error.	`string`	`"4m"`	no

Outputs

Name	Description
key_vault_get_ssh_key_command	n/a
rubrik_cloud_cluster_ip_addresses	n/a

How You Can Help

We glady welcome contributions from the community. From updating the documentation to adding more functionality, all ideas are welcome. Thank you in advance for all of your issues, pull requests, and comments!

License

MIT License

About Rubrik Build

We encourage all contributors to become members. We aim to grow an active, healthy community of contributors, reviewers, and code owners. Learn more in our Welcome to the Rubrik Build Community page.

We'd love to hear from you! Email us: build@rubrik.com

Name		Name	Last commit message	Last commit date
.github		.github
.gitignore		.gitignore
.legitignore		.legitignore
CHANGELOG.md		CHANGELOG.md
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
LICENSE.txt		LICENSE.txt
README.md		README.md
gen_docs.sh		gen_docs.sh
main.tf		main.tf
output.tf		output.tf
providers.tf		providers.tf
split_disk.tf		split_disk.tf
variables.tf		variables.tf

Navigation Menu

Uh oh!

Repository files navigation

Terraform Module - Azure Cloud Cluster Elastic Storage Deployment

Usage

Changelog

v1.0.2

v1.0.1

v1.0.0

v0.2.0

Upgrading

v1.0.0 to v1.0.1

v0.2.0 to v1.0.0

Authenticating with Azure

Authenticating with Azure CLI

Authenticating with Environment Variables

Accept the Azure Marketplace Agreement for CCES

Select the version of CCES to deploy (optional)

Subnet Network Storage Endpoint

Additional Documentation

Requirements

Providers

Resources

Inputs

Outputs

How You Can Help

License

About Rubrik Build

About

Releases

Packages

Contributors

Languages

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

Terraform Module - Azure Cloud Cluster Elastic Storage Deployment

Usage

Changelog

v1.0.2

v1.0.1

v1.0.0

v0.2.0

Upgrading

v1.0.0 to v1.0.1

v0.2.0 to v1.0.0

Authenticating with Azure

Authenticating with Azure CLI

Authenticating with Environment Variables

Accept the Azure Marketplace Agreement for CCES

Select the version of CCES to deploy (optional)

Subnet Network Storage Endpoint

Additional Documentation

Requirements

Providers

Resources

Inputs

Outputs

How You Can Help

License

About Rubrik Build

About

Resources

Code of conduct

Contributing

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages