cloudnationhq / terraform-azure-vm

Terraform module which creates virtual machine resources used by workloads and accelerators.

Virtual Machine

This Terraform module simplifies the configuration and management of virtual machines. It offers extensive customization options to match your specific deployment needs, streamlining the provisioning and maintenance process.

Goals

The main objective is to create a more logic data structure, achieved by combining and grouping related resources together in a complex object.

The structure of the module promotes reusability. It's intended to be a repeatable component, simplifying the process of building diverse workloads and platform accelerators consistently.

A primary goal is to utilize keys and values in the object that correspond to the REST API's structure. This enables us to carry out iterations, increasing its practical value as time goes on.

A last key goal is to separate logic from configuration in the module, thereby enhancing its scalability, ease of customization, and manageability.

Non-Goals

These modules are not intended to be complete, ready-to-use solutions; they are designed as components for creating your own patterns.

They are not tailored for a single use case but are meant to be versatile and applicable to a range of scenarios.

Security standardization is applied at the pattern level, while the modules include default values based on best practices but do not enforce specific security standards.

End-to-end testing is not conducted on these modules, as they are individual components and do not undergo the extensive testing reserved for complete patterns or solutions.

Features

• flexibility to incorporate multiple extensions
• utilization of Terratest for robust validation
• ability to use multiple interfaces and disks
• supports both system and multiple user assigned identities
• supports custom data integration
• compatible with both Linux and Windows environments
• supports availability sets to enhance fault tolerance and availability
• offers optional multiple ip configurations per interface

Requirements

Name	Version
terraform	~> 1.0
azurerm	~> 3.61
random	~> 3.5.1
tls	~> 4.0.4

Providers

Name	Version
azurerm	~> 3.61
random	~> 3.5.1
tls	~> 4.0.4

Resources

Name	Type
random_password	resource
azurerm_key_vault_secret	resource
azurerm_linux_virtual_machine	resource
azurerm_windows_virtual_machine	resource
azurerm_network_interface	resource
azurerm_virtual_machine_extension	resource
azurerm_subscription	data source
tls_private_key	resource
azurerm_key_vault_secret	resource
azurerm_managed_disk	resource
azurerm_virtual_machine_data_disk_attachment	resource
azurerm_user_assigned_identity	resource
azurerm_availability_set	resource

Modules

Name	Source
availability-sets	resource

Inputs

Name	Description	Type	Required
instance	contains all virtual machine config	object	yes
naming	used for naming purposes	string	yes
keyvault	keyvault to store secrets	string	yes
location	default azure region and can be used if location is not specified inside the object	string	no
resource_group	default resource group and can be used if resourcegroup is not specified inside the object	string	no
tags	tags to be added to the resources	map(string)	no

Outputs

Name	Description
instance	contains all virtual machine config
subscription_id	contains the current subscription id
uai	contains the user assigned identity

Testing

As a prerequirement, please ensure that both go and terraform are properly installed on your system.

The Makefile includes two distinct variations of tests. The first one is designed to deploy different usage scenarios of the module. These tests are executed by specifying the TF_PATH environment variable, which determines the different usages located in the example directory.

To execute this test, input the command make test TF_PATH=default, substituting default with the specific usage you wish to test.

The second variation is known as a extended test. This one performs additional checks and can be executed without specifying any parameters, using the command make test_extended.

Both are designed to be executed locally and are also integrated into the github workflow.

Each of these tests contributes to the robustness and resilience of the module. They ensure the module performs consistently and accurately under different scenarios and configurations.

Notes

Using a dedicated module, we've developed a naming convention for resources that's based on specific regular expressions for each type, ensuring correct abbreviations and offering flexibility with multiple prefixes and suffixes

Full examples detailing all usages, along with integrations with dependency modules, are located in the examples directory

Authentication for linux virtual machines can be done with either ssh keys or passwords.

Authors

Module is maintained by these awesome contributors.

Contributing

We welcome contributions from the community! Whether it's reporting a bug, suggesting a new feature, or submitting a pull request, your input is highly valued.

For more information, please see our contribution guidelines.

License

MIT Licensed. See LICENSE for full details.

Reference

• Documentation
• Rest Api
• Rest Api Specs

terraform-azure-vm's Issues

Data disks are required instead of optional

In the v1.0.0 release a new issue was introduced making the data disk(s) no longer optional, see below commit:
fd56760#r137702455

add support for auto incrementing the lun id in data disks

It should look for a lun id property in the config. This would be good when doing migrations of existing resources. If the property doesn't exist it should auto increment one use a index.

add optional maintenance configuration

resources are available at

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/maintenance_configuration

and

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/maintenance_assignment_virtual_machine

for each map includes keys that cannot be determined until apply

On virtual machine extensions i get the below error.

Error: Invalid for_each argument

  on ../../main.tf line 291, in resource "azurerm_virtual_machine_extension" "ext":
 291:   for_each = local.ext_keys
    ├────────────────
    │ local.ext_keys will be known only after apply

The "for_each" map includes keys derived from resource attributes that cannot be determined until apply, and so Terraform cannot determine the full set of keys that will identify the instances of this resource.

When working with unknown values in for_each, it's better to define the map keys statically in your configuration and place apply-time results only in the map values.

Alternatively, you could use the -target planning option to first apply only the resources that the for_each value depends on, and then apply a second time to fully converge.

This happens when i need log analytics workspace id or keys as output from another module

locals {
  extensions = {
    monitoring = {
      name                 = "AzureMonitoringAgent"
      ext_key              = "static-extension-key-1",
      publisher            = "Microsoft.EnterpriseCloud.Monitoring"
      type                 = "MicrosoftMonitoringAgent"
      type_handler_version = "1.0"
      auto_upgrade         = true
      settings = {
        "workspaceId" : module.analytics.workspace.workspace_id
      }
      protected_settings = {
        "workspaceKey" : module.analytics.workspace.primary_shared_key
      }
    }
    ```

[REQUEST] - Create VM from source_image_id instead of source_image_reference only

Is there an existing issue for this?

• I have searched the existing issues

Description

Currently it is not possible to specify a source_image_id to create a VM from. It is not allowed to use source_image_id and source_image_reference at the same time. Setting the source_image_reference to null will not work. Still we get this error:

│` Error: Invalid combination of arguments

│ 

│   with module.Infrastructure.module.vm-hallo["vm_muv"].azurerm_windows_virtual_machine.vm["vmmueudev"],

│   on .terraform/modules/Infrastructure.vm-hallo/main.tf line 137, in resource "azurerm_windows_virtual_machine" "vm":

│  137: resource "azurerm_windows_virtual_machine" "vm" {

│ 

│ "source_image_reference": only one of

│ `source_image_id,source_image_reference` can be specified, but

│ `source_image_id,source_image_reference` were specified.

╵

╷

│ Error: Invalid combination of arguments

│ 

│   with module.Infrastructure.module.vm-hallo["vm_muv"].azurerm_windows_virtual_machine.vm["vmmueudev"],

│   on .terraform/modules/Infrastructure.vm-hallo/main.tf line 168, in resource "azurerm_windows_virtual_machine" "vm":

│  168:   source_image_id               = try(var.instance.source_image_id, null)

│ 

│ "source_image_id": only one of `source_image_id,source_image_reference` can

│ be specified, but `source_image_id,source_image_reference` were specified.`

Potential Terraform Configuration

Perhaps add code to make the source_image_reference dynamic like so:

  dynamic "source_image_reference" {
    for_each = var.source_image_reference == null ? [] : [
      "source_image_reference"
    ]

    content {
      offer     = var.source_image_reference.offer
      publisher = var.source_image_reference.publisher
      sku       = var.source_image_reference.sku
      version   = var.source_image_reference.version
    }
  }

References

No response

Provide possibility to overwrite name of the UAI

add support for protected settings from key vault in extensions

available at

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine_extension#:~:text=A-,protected_settings_from_key_vault,-block%20supports%20the

add support to use availability sets

enable password / ssh key retrieval from module outputs as fallback

It should be possible to retrieve the virtual machine's password or SSH key through module outputs, applying conditional expressions to the property:

admin_password = azurerm_key_vault_secret.secret[var.instance.type].value

The process should first check for var.instance.password. If present, use the keyvault module's outputs. Otherwise, default to the already existing value.

add encryption set support for managed disks

related resources

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/managed_disk
https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/disk_encryption_set

add type definitions usages

Is there an existing issue for this?

• I have searched the existing issues

Description

Type definitions in all usage examples needs to be added, and all redundant documentation needs to be removed.

Also CONTRIBUTE.md is renamed to CONTRIBUTING.md according to standards.

Potential Terraform Configuration

No response

References

No response

VM Module does not have an option to specify/modify secret name for VM password

CN VM module automatically includes the creation of a random password, after which a key vault secret is created. Currently, this way of working does not allow for the modification of the name of this secret. It is possible with workarounds to accomplish this, but might be nice to have the option in the module itself?

Multiple ip configuration blocks per nic

Hello,

Is it possible to update the module so we can add multiple private ip-addresses per network interface card.

Thank you!

Tags for the NIC and VM (instance) are the same and should be separate

Please add output for user assigned identity

Title pretty much. Unable to use the user assigned identity that is automatically created from the module.

Add Tags properties for all the resources

make managed identity optional in linux vm + add identity block to the windows vm resource

Linux VM:

• Include identity_ids within the identity block.
• Include other types: UserAssigned or SystemAssigned, UserAssigned.

Windows VM:

• Include support for identity block all together

Add support for computer_name as optional value

• [computer_name] - (Optional) Specifies the Hostname which should be used for this Virtual Machine. If unspecified this defaults to the value for the name field. If the value of the name field is not a valid computer_name, then you must specify computer_name. Changing this forces a new resource to be created.

This is needed to have longer (than 15 characters) names of the VM resource, as hostnames in Windows only are allowed up to 15 characters. For naming conventions this can be necessary.

[BUG] - random provider version constraint too strict

Is there an existing issue for this?

• I have searched the existing issues

Module Version

2.2.0

Terraform Version

1.8.1

AzureRM Provider Version

3.110.0

Short Description

random version constraint too strict

Terraform Configuration Files

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/random"
      version = "~> 3.6"
    }
  }
}

Expected Behaviour

The combination of the ~> 3.6 constraint and consuming the vm module should just work.

Actual Behaviour

This combination yields the following error:

│ Error: Failed to query available provider packages
│
│ Could not retrieve the list of available versions for provider
│ hashicorp/random: locked provider registry.terraform.io/hashicorp/random
│ 3.5.1 does not match configured version constraint >= 3.3.2, >= 3.5.1, ~>
│ 3.5.1, ~> 3.6, < 4.0.0; must use terraform init -upgrade to allow selection
│ of new versions
╵

As ~> 3.5.1 tells terraform to cap on everything < 3.6.0. Refer to: https://developer.hashicorp.com/terraform/language/expressions/version-constraints

Steps to Reproduce

1. terraform apply

Additional Context

No response

References

No response

add example that contains multiple resources

It should also show how to reference a specific output when using multiple resources, without bracket notations.

This is useful in scenario's where multiple resources are used and we need to pick a specific one using outputs from another module.

Provide possibility to overwrite name of the ip config name

Not clear how to set admin username and password

It is not clearly described how to add admin usernamen and password.

Password has to be set through a secrets block which is not in line with how the resource itself functions.

Add plan block with properties

• For both Linux and Windows VM's:
  A plan block supports the following:

[name]- (Required) Specifies the Name of the Marketplace Image this Virtual Machine should be created from. Changing this forces a new resource to be created.

[product] - (Required) Specifies the Product of the Marketplace Image this Virtual Machine should be created from. Changing this forces a new resource to be created.

[publisher]- (Required) Specifies the Publisher of the Marketplace Image this Virtual Machine should be created from. Changing this forces a new resource to be created.