- Usage - Configuration options and additional functionality
- Reference - An under-the-hood peek at what the module is doing and how
Microsoft Azure exposes a powerful API for creating and managing its Infrastructure as a Service platform. The azure module allows you to drive that API using Puppet code. This allows you to use Puppet to create, stop, restart, and destroy Virtual Machines, and eventually to manage other resources, meaning you can manage even more of your infrastructure as code.
- Azure gem 0.7.0 or greater.
- Azure credentials (as detailed below).
To use this module, you need an Azure account. If you already have one, you can skip this section.
-
Sign up for an Azure account.
-
Install the Azure CLI 1.0, which is a cross-platform node.js-based tool that works on Windows and Linux. This is required to generate a certificate for the Puppet module, but it's also a useful way of interacting with Azure. Currently these instructions have not been updated for the CLI 2.0 tool ('az' commands) but this module uses the API.
-
Register the CLI with your Azure account.
To do this, on the command line, enter:
azure account download azure account import <path to your .publishsettings file>
After you've created the account, you can export the PEM certificate file using the following command:
azure account cert export
-
Get a subscription ID using the
azure account list
command:$ azure account list info: Executing command account list data: Name Id Tenant Id Current data: ---------------------- ------------------------------------- --------- ------- data: Pay-As-You-Go xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx undefined true info: account list command OK
To use the Resource Manager API instead, you need a service principal on the Active Directory. A quick way to create one for puppet is pendrica/azure-credentials. Its puppet mode can even create the azure.conf
(see below) for you. Alternatively, the official documentation covers creating this and retrieving the required credentials.
-
Install the required gems with this command on
puppet-agent
1.2 (included in Puppet Enterprise 2015.2.0) or later:/opt/puppetlabs/puppet/bin/gem install retries --no-ri --no-rdoc /opt/puppetlabs/puppet/bin/gem install azure --version='~>0.7.0' --no-ri --no-rdoc /opt/puppetlabs/puppet/bin/gem install azure_mgmt_compute --version='~>0.3.0' --no-ri --no-rdoc /opt/puppetlabs/puppet/bin/gem install azure_mgmt_storage --version='~>0.3.0' --no-ri --no-rdoc /opt/puppetlabs/puppet/bin/gem install azure_mgmt_resources --version='~>0.3.0' --no-ri --no-rdoc /opt/puppetlabs/puppet/bin/gem install azure_mgmt_network --version='~>0.3.0' --no-ri --no-rdoc /opt/puppetlabs/puppet/bin/gem install hocon --version='~>1.1.2' --no-ri --no-rdoc
When installing on Windows, launch the
Start Command Prompt with Puppet
and enter:gem install retries --no-ri --no-rdoc gem install azure --version="~>0.7.0" --no-ri --no-rdoc gem install azure_mgmt_compute --version="~>0.3.0" --no-ri --no-rdoc gem install azure_mgmt_storage --version="~>0.3.0" --no-ri --no-rdoc gem install azure_mgmt_resources --version="~>0.3.0" --no-ri --no-rdoc gem install azure_mgmt_network --version="~>0.3.0" --no-ri --no-rdoc gem install hocon --version="~>1.1.2" --no-ri --no-rdoc
On versions of
puppet agent
older than 1.2 (Puppet Enterprise 2015.2.0), use the older path to thegem
binary:/opt/puppet/bin/gem install retries --no-ri --no-rdoc /opt/puppet/bin/gem install azure --version='~>0.7.0' --no-ri --no-rdoc /opt/puppet/bin/gem install azure_mgmt_compute --version='~>0.3.0' --no-ri --no-rdoc /opt/puppet/bin/gem install azure_mgmt_storage --version='~>0.3.0' --no-ri --no-rdoc /opt/puppet/bin/gem install azure_mgmt_resources --version='~>0.3.0' --no-ri --no-rdoc /opt/puppet/bin/gem install azure_mgmt_network --version='~>0.3.0' --no-ri --no-rdoc /opt/puppet/bin/gem install hocon --version='~>1.1.2' --no-ri --no-rdoc
Note: You must pin Azure gem installs to the correct version detailed in the example above for the azure module to work properly. The example above pins the hocon gem version to prevent possible incompatibilities.
-
Set the following environment variables specific to your Azure installation.
If using the classic API, provide this information:
export AZURE_MANAGEMENT_CERTIFICATE='/path/to/pem/file' export AZURE_SUBSCRIPTION_ID='your-subscription-id'
At a Windows command prompt, specify the information without quotes around any of the values:
SET AZURE_MANAGEMENT_CERTIFICATE=C:\Path\To\file.pem SET AZURE_SUBSCRIPTION_ID=your-subscription-id
If using the Resource Management API, provide this information:
export AZURE_SUBSCRIPTION_ID='your-subscription-id' export AZURE_TENANT_ID='your-tenant-id' export AZURE_CLIENT_ID='your-client-id' export AZURE_CLIENT_SECRET='your-client-secret'
At a Windows command prompt, specify the information without quotes around any of the values:
SET AZURE_SUBSCRIPTION_ID=your-subscription-id SET AZURE_TENANT_ID=your-tenant-id SET AZURE_CLIENT_ID=your-client-id SET AZURE_CLIENT_SECRET=your-client-secret
If you are working with both Resource Manager and classic virtual machines, provide all of the above credentials.
Alternately, you can provide the information in a configuration file of HOCON format. Store this as
azure.conf
in the relevant confdir:- *nix Systems:
/etc/puppetlabs/puppet
- Windows:
C:\ProgramData\PuppetLabs\puppet\etc
- Non-root users:
~/.puppetlabs/etc/puppet
The file format is:
azure: { subscription_id: "your-subscription-id" management_certificate: "/path/to/pem/file" }
When creating this file on Windows, note that as a JSON-based config file format, paths must be properly escaped:
azure: { subscription_id: "your-subscription-id" management_certificate: "C:\\path\\to\\file.pem" }
Note: Make sure to have at least hocon 1.1.2 installed on windows. With older versions, you have to make sure to make sure that the
azure.conf
is encoded as UTF-8 without a byte order mark (BOM). See HC-82, and HC-83 for technical details. Starting with hocon 1.1.2, UTF-8 with or without BOM works.Or, with the Resource Management API:
azure: { subscription_id: "your-subscription-id" tenant_id: "your-tenant-id" client_id: "your-client-id" client_secret: "your-client-secret" }
You can use either the environment variables or the config file. If both are present, the environment variables are used. You cannot have some settings in environment variables and others in the config file.
- *nix Systems:
-
Finally, install the module with:
puppet module install puppetlabs-azure
Azure has two modes for deployment: Classic and Resource Manager. For more information, see Azure Resource Manager vs. classic deployment: Understand deployment models and the state of your resources. The module supports creating VMs in both deployment modes.
You can create Azure classic virtual machines using the following:
azure_vm_classic { 'virtual-machine-name':
ensure => present,
image => 'b39f27a8b8c64d52b05eac6a62ebad85__Ubuntu-14_04_2-LTS-amd64-server-20150706-en-us-30GB',
location => 'West US',
user => 'username',
size => 'Medium',
private_key_file => '/path/to/private/key',
}
You can create Azure Resource Manager virtual machines using the following:
azure_vm { 'sample':
ensure => present,
location => 'eastus',
image => 'canonical:ubuntuserver:14.04.2-LTS:latest',
user => 'azureuser',
password => 'Password_!',
size => 'Standard_A0',
resource_group => 'testresacc01',
}
You can also add a virtual machine extension to the VM and deploy from a Marketplace product instead of an image:
azure_vm { 'sample':
ensure => present,
location => 'eastus',
user => 'azureuser',
password => 'Password_!',
size => 'Standard_A0',
resource_group => 'testresacc01',
plan => {
'name' => '2016-1',
'product' => 'puppet-enterprise',
'publisher' => 'puppet',
},
extensions => {
'CustomScriptForLinux' => {
'auto_upgrade_minor_version' => false,
'publisher' => 'Microsoft.OSTCExtensions',
'type' => 'CustomScriptForLinux',
'type_handler_version' => '1.4',
'settings' => {
'commandToExecute' => 'sh script.sh',
'fileUris' => ['https://myAzureStorageAccount.blob.core.windows.net/pathToScript']
},
},
},
}
This type also has lots of other properties you can manage:
azure_vm { 'sample':
location => 'eastus',
image => 'canonical:ubuntuserver:14.04.2-LTS:latest',
user => 'azureuser',
password => 'Password',
size => 'Standard_A0',
resource_group => 'testresacc01',
storage_account => 'teststoracc01',
storage_account_type => 'Standard_GRS',
os_disk_name => 'osdisk01',
os_disk_caching => 'ReadWrite',
os_disk_create_option => 'fromImage',
os_disk_vhd_container_name => 'conttest1',
os_disk_vhd_name => 'vhdtest1',
dns_domain_name => 'mydomain01',
dns_servers => '10.1.1.1.1 10.1.2.4',
public_ip_allocation_method => 'Dynamic',
public_ip_address_name => 'ip_name_test01pubip',
virtual_network_name => 'vnettest01',
virtual_network_address_space => '10.0.0.0/16',
subnet_name => 'subnet111',
subnet_address_prefix => '10.0.2.0/24',
ip_configuration_name => 'ip_config_test01',
private_ip_allocation_method => 'Dynamic',
network_interface_name => 'nicspec01',
extensions => {
'CustomScriptForLinux' => {
'auto_upgrade_minor_version' => false,
'publisher' => 'Microsoft.OSTCExtensions',
'type' => 'CustomScriptForLinux',
'type_handler_version' => '1.4',
'settings' => {
'commandToExecute' => 'sh script.sh',
'fileUris' => ['https://myAzureStorageAccount.blob.core.windows.net/pathToScript']
},
},
},
}
In addition to describing new machines using the DSL, the module also supports listing and managing machines via puppet resource
:
puppet resource azure_vm_classic
This outputs some information about the machines in your account:
azure_vm_classic { 'virtual-machine-name':
ensure => 'present',
cloud_service => 'cloud-service-uptjy',
deployment => 'cloud-service-uptjy',
hostname => 'garethr',
image => 'b39f27a8b8c64d52b05eac6a62ebad85__Ubuntu-14_04_2-LTS-amd64-server-20150706-en-us-30GB',
ipaddress => 'xxx.xx.xxx.xx',
location => 'West US',
media_link => 'http://xxx.blob.core.windows.net/vhds/disk_2015_08_28_07_49_34_868.vhd',
os_type => 'Linux',
size => 'Medium',
}
Use the same command for Azure Resource Manager:
puppet resource azure_vm
This lists Azure Resource Manager VMs:
azure_vm { 'sample':
location => 'eastus',
image => 'canonical:ubuntuserver:14.04.2-LTS:latest',
user => 'azureuser',
password => 'Password',
size => 'Standard_A0',
resource_group => 'testresacc01',
}
You can create a storage account using the following:
azure_storage_account { 'myStorageAccount':
ensure => present,
resource_group => 'testresacc01',
location => 'eastus',
account_type => 'Standard_GRS',
}
Note: Storage accounts are created with the Azure Resource Manager API only.
You can create a resource group using the following:
azure_resource_group { 'testresacc01':
ensure => present,
location => 'eastus',
}
Note: Resource groups are created with Azure Resource Manager API only.
You can create a resource template deployment using the following:
azure_resource_template { 'My-Network-Security-Group':
ensure => 'present',
resource_group => 'security-testing',
source => 'https://gallery.azure.com/artifact/20151001/Microsoft.NetworkSecurityGroup.1.0.0/DeploymentTemplates/NetworkSecurityGroup.json',
params => {
'location' => 'eastasia',
'networkSecurityGroupName' => 'testing',
},
}
Note: Resource templates are deployed with Azure Resource Manager API only.
azure_vm_classic
: Manages a virtual machine in Microsoft Azure with Classic Service Management API.azure_vm
: Manages a virtual machine in Microsoft Azure with Azure Resource Manager API.azure_storage_account
: Manages a Storage Account with Azure Resource Manager API.azure_resource_group
: Manages a Resource Group with Azure Resource Manager API.azure_resource_template
: Manages a Resource Template with Azure Resource Manager API.
Specifies the basic state of the virtual machine. Valid values are 'present', 'running', stopped', and 'absent'. Defaults to 'present'.
Values have the following effects:
- 'present': Ensure that the VM exists in either the running or stopped state. If the VM doesn't yet exist, a new one is created.
- 'running': Ensures that the VM is up and running. If the VM doesn't yet exist, a new one is created.
- 'stopped': Ensures that the VM is created, but is not running. This can be used to shut down running VMs, as well as for creating VMs without having them running immediately.
- 'absent': Ensures that the VM doesn't exist on Azure.
Required The name of the virtual machine.
Name of the image to use to create the virtual machine. This can be either a VM Image or an OS Image. When specifying a VM Image, user
, password
, and private_key_file
are not used.
Required The location where the virtual machine will be created. Details of available values can be found on the Azure regions documentation. Location is read-only after the VM has been created.
The name of the user to be created on the virtual machine. Required for Linux guests.
The password for the above mentioned user on the virtual machine.
Path to the private key file for accessing a Linux guest as the above user.
The name of the storage account to create for the virtual machine. Note that if the source image is a 'user' image, the storage account for the user image is used instead of the one provided here. The storage account must be between 3-24 characters, containing only numeric and/or lower case letters.
The name of the associated cloud service.
The name for the deployment.
The size of the virtual machine instance. See the Azure documentation for a full list of sizes.
The affinity group to be used for any created cloud service and storage accounts. Use affinity groups to influence colocation of compute and storage for improved performance.
An existing virtual network to which the virtual machine should be connected.
An existing subnet in the specified virtual network to which the virtual machine should be associated.
The availability set for the virtual machine. These are used to ensure related machines are not all restarted or paused during routine maintenance.
The name of the reserved IP to associate with the virtual machine.
The size of the data disk for this virtual machine, specified in gigabytes. Over the life cycle of a disk, this size can only grow. If this value is not set, Puppet does not touch the data disks for this virtual machine.
Whether or not the attached data disk should be deleted when the VM is deleted. Defaults to false.
A block of data to be affiliated with a host upon launch. On Linux hosts, this can be a script to be executed on launch by cloud-init. On such Linux hosts, this can either be a single-line command (for example touch /tmp/some-file
) which will be run under bash, or a multi-line file (for instance from a template) which can be any format supported by cloud-init.
Windows images (and Linux images without cloud-init) need to provide their own mechanism to execute or act on the provided data.
A list of endpoints to associate with the virtual machine. Supply an array of hashes describing the endpoints. Available keys are:
name
: Required. The name of this endpoint.public_port
: Required. The public port to access this endpoint.local_port
: Required. The internal port on which the virtual machine is listening.protocol
: Required.TCP
orUDP
.direct_server_return
: enable direct server return on the endpoint.load_balancer_name
: If the endpoint should be added to a load balancer set, specify a name here. If the set does not exist yet, it is created automatically.load_balancer
: A hash of the properties to add this endpoint to a load balancer configuration.port
: Required. The internal port on which the virtual machine is listening.protocol
: Required. The protocol to use for the availability probe.interval
: The interval for the availability probe in seconds.path
: a relative path used by the availability probe.
The most often used endpoints are SSH for Linux and WinRM for Windows. Usually they are configured for direct pass-through like this:
endpoints => [{
name => 'ssh',
local_port => 22,
public_port => 22,
protocol => 'TCP',
},]
or
endpoints => [{
name => 'WinRm-HTTP',
local_port => 5985,
public_port => 5985,
protocol => 'TCP',
},{
name => 'PowerShell',
local_port => 5986,
public_port => 5986,
protocol => 'TCP',
},]
Note: If you want to manually configure one of the ssh, WinRm-HTTP, or PowerShell endpoints, take care to use those endpoint names verbatim. This is required to override Azure's defaults without creating a resource conflict.
Read Only. The operating system type for the virtual machine.
Read Only. The IP address assigned to the virtual machine.
Read Only. The hostname of the running virtual machine.
Read Only. The link to the underlying disk image for the virtual machine.
Specifies the basic state of the virtual machine. Valid values are 'present', 'running', stopped', and 'absent'. Defaults to 'present'.
Values have the following effects:
- 'present': Ensure that the VM exists in either the running or stopped state. If the VM doesn't yet exist, a new one is created.
- 'running': Ensures that the VM is up and running. If the VM doesn't yet exist, a new one is created.
- 'stopped': Ensures that the VM is created, but is not running. This can be used to shut down running VMs, as well as for creating VMs without having them running immediately.
- 'absent': Ensures that the VM doesn't exist on Azure.
Required The name of the virtual machine. The name may have at most 64 characters. Some images may have more restrictive requirements.
Name of the image to use to create the virtual machine. Required if no Marketplace plan
is provided. This must be in the ARM image_refence format: Azure image reference
canonical:ubuntuserver:14.04.2-LTS:latest
Required The location where the virtual machine will be created. Details of available values can be found on the Azure regions documentation. Location is read-only once the VM has been created.
Required The name of the user to be created on the virtual machine. Required for Linux guests.
Required The password for the above mentioned user on the virtual machine.
Required The size of the virtual machine instance. See the Azure documentation for a full list of sizes. ARM requires that the "classic" size be prefixed with Standard; for example, A0 with ARM is Standard_A0. D-Series sizes are already prefixed.
Required The resource group for the new virtual machine. See Resource Groups.
The storage account name for the subscription id. Storage account name rules are defined in Storage accounts.
The type of storage account to be associated with the virtual machine. See Valid account types. Defaults to Standard_GRS
.
The name of the disk that is to be attached to the virtual machine.
The caching type for the attached disk. Caching. Defaults to ReadWrite
.
Create options are listed at Options. Defaults to FromImage
.
The vhd container name is used to create the vhd uri of the virtual machine.
This transposes with storage_account and the os_disk_vhd_name to become the URI of your virtual hard disk image.
https://#{storage_account}.blob.core.windows.net/#{os_disk_vhd_container_name}/#{os_disk_vhd_name}.vhd
The name of the vhd that forms the vhd URI for the virtual machine.
The DNS domain name that to be associated with the virtual machine.
The DNS servers to be setup on the virtual machine. Defaults to 10.1.1.1 10.1.2.4
The public ip allocation method. Valid values are Static, Dynamic, None. Defaults to Dynamic
.
The key name of the public ip address.
The key name of the virtual network for the virtual machine. See Virtual Network setup
The ip range for the private virtual network. See Virtual Network setup. Defaults to 10.0.0.0/16
. May be a string or array of strings.
The private subnet name for the virtual network. See Virtual Network setup.
Details of the prefix are availabe at Virtual Network setup. Defaults to 10.0.2.0/24
.
The key name of the ip configuration for the VM.
The private ip allocation method. Valid values are Static, Dynamic. Defaults to Dynamic
.
The Network Interface Controller (nic) name for the virtual machine.
A block of data to be affiliated with a host upon launch. On Linux hosts, this can be a script to be executed on launch by cloud-init. On such Linux hosts, this can either be a single-line command (for example touch /tmp/some-file
) which will be run under bash, or a multi-line file (for instance from a template) which can be any format supported by cloud-init.
Windows images (and Linux images without cloud-init) need to provide their own mechanism to execute or act on the provided data.
Manages one or more data disks attached to an Azure VM. This parameter expects a hash where the key is the name of the data disk and the value is a hash of data disk properties.
Azure VM data_disks support the following parameters:
Optional. Specifies the caching behavior of data disk.
Possible values are:
- None
- ReadOnly
- ReadWrite
The default value is None.
Specifies the create option for the disk image. Valid values: 'FromImage', 'Empty', 'Attach'.
Specifies the size, in GB, of an empty disk to be attached to the Virtual Machine.
Specifies the Logical Unit Number (LUN) for the disk. The LUN specifies the slot in which the data drive appears when mounted for usage by the Virtual Machine. Valid LUN values are 0 through 31.
Specifies the location of the blob in storage where the vhd file for the disk is located. The storage account where the vhd is located must be associated with the specified subscription.
Example:
http://example.blob.core.windows.net/disks/mydisk.vhd
Deploys the VM from an Azure Software Marketplace product (called a "plan"). Required if no image
is specified. The value must be a hash with three required keys: name
, product
, and publisher
. promotion_code
is an optional forth key that may be passed.
Example:
plan => {
'name' => '2016-1',
'product' => 'puppet-enterprise',
'publisher' => 'puppet',
},
The extension to configure on the VM. Azure VM Extensions implement behaviors or features that either help other programs work on Azure VMs. You can optionally configure this parameter to include an extension.
This parameter can be either a single hash (single extension) or multiple hashes (multiple extensions). Setting the extension parameter to absent
deletes the extension from the VM.
Example:
extensions => {
'CustomScriptForLinux' => {
'auto_upgrade_minor_version' => false,
'publisher' => 'Microsoft.OSTCExtensions',
'type' => 'CustomScriptForLinux',
'type_handler_version' => '1.4',
'settings' => {
'commandToExecute' => 'sh script.sh',
'fileUris' => ['https://myAzureStorageAccount.blob.core.windows.net/pathToScript']
},
},
},
To install the Puppet agent as an extension on a Windows VM:
extensions => {
'PuppetExtension' => {
'auto_upgrade_minor_version' => true,
'publisher' => 'Puppet',
'type' => 'PuppetAgent',
'type_handler_version' => '1.5',
'protected_settings' => {
'PUPPET_MASTER_SERVER': 'mypuppetmaster.com'
},
},
},
For more information on VM Extensions, see About virtual machine extensions and features. For information on how to configure a particular extension, see Azure Windows VM Extension Configuration Samples.
Azure VM Extensions support the following parameters:
The name of the publisher of the extension.
The type of the extension (e.g. CustomScriptExtension).
The version of the extension to use.
The settings specific to an extension (e.g. CommandsToExecute).
The settings specific to an extension that are encrypted before passing to the VM.
Indicates whether extension should automatically upgrade to latest minor version.
Specifies the basic state of the storage account. Valid values are 'present' and 'absent'. Defaults to 'present'.
Required The name of the storage account. Must be globally unique.
Required The location where the storage account will be created. Details of available values can be found on the Azure regions documentation. Location is read-only after the Storage Account has been created.
Required The resource group for the new storage account. See Resource Groups.
The type of storage account. This indicates the performance level and replication mechanism of the storage account. See Valid account types. Defaults to Standard_GRS
.
The kind of storage account. This indicates whether the storage account is general Storage
or BlobStorage
. Defaults to Storage
.
Specifies the basic state of the resource group. Valid values are 'present' and 'absent'. Defaults to 'present'.
Required The name of the resource group. Must be no longer than 80 characters long. It can contain only alphanumeric characters, dash, underscore, opening parenthesis, closing parenthesis, and period. The name cannot end with a period.
Required The location where the resource group will be created. Details of available values can be found on the Azure regions documentation.
Specifies the basic state of the resource group. Valid values are 'present' and 'absent'. Defaults to 'present'.
Required The name of the template deployment. Must be no longer than 80 characters long. It can contain only alphanumeric characters, dash, underscore, opening parenthesis, closing parenthesis, and period. The name cannot end with a period.
Required The resource group for the new template deployment. See Resource Groups.
The URI of a template. May be http:// or https:// . Must not be specified when content
is specified.
The text of an Azure Resource Template. Must not be specified when source
is specified.
The params that are required by the azure resource template. Follows the form of { 'key_one' => 'value_one', 'key_two' => 'value_two'}
. Note that this format is specific to puppet. Must not be specified when params_source
is specified.
The URI of a file containing the params in Azure Resource Model standard format. Note that the format of this file differs from the format accepted by the params
attribute above. Must not be specified when params
is specified.
For the azure module to work, all azure gems must be installed successfully. There is a known issue where these gems fail to install if nokogiri failed to install.
Due to a Ruby Azure SDK dependency on the nokogiri gem, running the module on a Windows Agent is supported only with puppet-agent 1.3.0 (a part of Puppet Enterprise 2015.3) and newer. In these versions, the correct version of nokogiri is installed when you run the gem install azure
command mentioned in Installing the Azure module.
If you run into an issue with this module, or if you would like to request a feature, please file a ticket.
If you have problems getting this module up and running, please contact Support.