Azure Provisioning Server using Docker, Terraform and Ansible, for use with Azure DevOps pipelines.
This server (container) allows you to provision resources using Terraform and configure them using Ansible. As an added bonus, we've integrated Azure Dynamic inventory.
The primary motivation for this project was to be able seamlessly integrate Terraform and Ansible within a CI/CD pipeline, using dynamic inventory.
Usage is pretty straight forward:
- Build the image
- Spin up an instance of the container that can connect to Azure DevOps.
- Create your Terraform / Ansible tasks as bash commands within a release pipeline.
- Ensure your pipeline runs on the correct agent. ("Run on Agent")
Dockerfile
builds a new Azure DevOps Agent based on Centos 7 with the following installed:
- Terraform
- Ansible
- Ansible Inventory Plugin for Azure
- Python & Pip
The image can be built with a clean docker build
command, without having to specify any configuration:
sudo docker build -t anabelle:latest
Terraform and Ansible Azure Dynamic Inventory plugin authenticate with Azure using an Azure Service Principle.
The following command can be used to create a new service principle:
az ad sp create-for-rbac --name ServicePrincipalName
app Id (client Id), tenant Id and password (secret) will need to be passed to the container as environment varaibles.
The Azure DevOps agent authenticates using a personal access token (PAT), which can be generated within the DevOps portal.
Due to the limitations (see https://hub.docker.com/_/centos/#systemd-integration) imposed on running systemd and therefore also starting the SSH daemon within a container, Anabelle relies on password based authentication.
The server password must be specified within an ansible-vault encrypted file, this can be done by creating the file during pipeline execution, or checking the encrypted file into source control.
This provisioning container requires a number of environment variables that can be specified at startup (docker run
) or runtime (during pipeline execution).
Environment variables for the Azure DevOps agent must be supplied at startup.
Variable Name | Required By | Description | Startup | Runtime |
---|---|---|---|---|
SERVER_URL | Azure DevOps Agent | Azure Organisation Url, E.G: https://dev.azure.com/[YourOrg]/ | ✔️ | ❌ |
PAT | Azure DevOps Agent | Personal Access Token | ✔️ | ❌ |
POOL | Azure DevOps Agent | Agent Pool Name | ✔️ | ❌ |
AGENT_NAME | Azure DevOps Agent | Agent Name | ✔️ | ❌ |
AGENT_DIR | Azure DevOps Agent | Working Directory for the Agent | ✔️ | ❌ |
AZURE_SUBSCRIPTION_ID | Ansible | Your Azure Subscription Id | ✔️ | ✔️ |
AZURE_CLIENT_ID | Ansible | Client Id for the Azure Service Principle | ✔️ | ✔️ |
AZURE_SECRET | Anisble | Azure Service Principle Secret | ✔️ | ✔️ |
AZURE_TENANT | Ansible | Azure Service Principle Tenant Id | ✔️ | ✔️ |
ARM_SUBSCRIPTION_ID | Terraform | Your Azure Subscription Id | ✔️ | ✔️ |
ARM_CLIENT_ID | Terraform | Client Id for the Azure Service Principle | ✔️ | ✔️ |
ARM_CLIENT_SECRET | Terraform | Azure Service Principle Secret | ✔️ | ✔️ |
ARM_TENANT_ID | Terraform | Azure Service Principle Tenant Id | ✔️ | ✔️ |
Note: Specifiying the Ansible variables at container startup will also set the Terraform variables with matching values.
Before running the container, create a copy of the env.vars file called env.vars.mine and fill in your azure details.
sudo docker run --env-file env.vars.mine anabelle:latest
We recommend pushing the built image to an Azure Container Registry and deploying via an Azure Container Instance.
First, login to your azure container registry from the command line:
az acr login --name [acrName]
Next, tag the image with your registry url:
docker tag anabelle [acrLoginUri]/anabelle:latest
Finally, push the image to to registry:
docker push [acrLoginUri]/anabelle:latest
On your local machine:
- Replace the variable placeholders within the
createContainer.sh
script with the correct values. - Login to your Azure Container Registry:
az acr login --name [acr_name]
- Run
createContainer.sh