Actualiser 01 - Pré-requis
@@ -4,3 +4,180 @@ Il faut notamment installer :
|
|||||||
|
|
||||||
- AzureCLI
|
- AzureCLI
|
||||||
- la collection Ansible lié à Azure
|
- la collection Ansible lié à Azure
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Connexion à Azure
|
||||||
|
az login
|
||||||
|
[OPTIONNEL]
|
||||||
|
a- Créer un Service Principal dans Azure :
|
||||||
|
az ad sp create-for-rbac --name "AnsibleServicePrincipal" --role="Contributor" --scopes="/subscriptions/<subscription_id>"
|
||||||
|
Option Description
|
||||||
|
az ad sp create-for-rbac Crée un Service Principal avec un rôle basé sur RBAC (Role-Based Access Control).
|
||||||
|
--name "AnsibleServicePrincipal" Donne un nom au Service Principal (ici, AnsibleServicePrincipal). Tu peux le remplacer par un autre nom si besoin.
|
||||||
|
--role "Contributor" Attribue le rôle Contributor au Service Principal. Ce rôle lui permet de gérer toutes les ressources dans la portée définie, sans pouvoir modifier les
|
||||||
|
autorisations d’accès.
|
||||||
|
--scopes
|
||||||
|
"/subscriptions/<subscription_id>"
|
||||||
|
Définit la portée des permissions. Ici, on applique le rôle à tout l’abonnement Azure. Tu dois remplacer <subscription_id> par l’ID de ton abonnement.
|
||||||
|
{
|
||||||
|
"appId": "212debe2-a0fa-47bd-9aa5-97f7524036cf",
|
||||||
|
"displayName": "AnsibleServicePrincipal",
|
||||||
|
"password": "LALALALALALAL",
|
||||||
|
"tenant": "LETENANT"
|
||||||
|
}
|
||||||
|
b- Configurer Ansible pour utiliser le Service Principal
|
||||||
|
On utilise un fichier de configuration :
|
||||||
|
Créer un fichier ~/.azure/credentials et ajouter :
|
||||||
|
[default]
|
||||||
|
subscription_id=12345678-90ab-cdef-1234-567890abcdef
|
||||||
|
client_id=11111111-2222-3333-4444-555555555555
|
||||||
|
secret=your-secret-password
|
||||||
|
tenant=66666666-7777-8888-9999-000000000000
|
||||||
|
Clé Signification
|
||||||
|
appId Client ID → Identifiant unique de ton Service Principal dans Azure AD.
|
||||||
|
password Client Secret → Mot de passe généré pour authentifier le Service Principal.
|
||||||
|
tenant Tenant ID → Identifiant de ton Azure Active Directory (AAD).
|
||||||
|
subscriptionId Identifiant de ton abonnement Azure.
|
||||||
|
A ajouter dans le fichier yml :
|
||||||
|
- name: Configurer l'authentification Azure via fichier credentials
|
||||||
|
copy:
|
||||||
|
dest: "/root/.azure/credentials"
|
||||||
|
content: |
|
||||||
|
[default]
|
||||||
|
subscription_id={{ lookup('env', 'AZURE_SUBSCRIPTION_ID') }}
|
||||||
|
client_id={{ lookup('env', 'AZURE_CLIENT_ID') }}
|
||||||
|
secret={{ lookup('env', 'AZURE_SECRET') }}
|
||||||
|
tenant={{ lookup('env', 'AZURE_TENANT') }}
|
||||||
|
mode: '0600'
|
||||||
|
- name: Vérifier la connexion à Azure
|
||||||
|
command: az account show
|
||||||
|
register: azure_account
|
||||||
|
changed_when: false
|
||||||
|
- name: Afficher les informations du compte Azure
|
||||||
|
debug:
|
||||||
|
ANSIBLE Page 2
|
||||||
|
debug:
|
||||||
|
msg: "{{ azure_account.stdout }}"
|
||||||
|
2- Déploiement via Ansible
|
||||||
|
Créer le mot de passe sécurisé :
|
||||||
|
ansible-vault create secrets.yml
|
||||||
|
MDP : Le mot de passe!
|
||||||
|
Contenu du fichier secrets.yml
|
||||||
|
admin_password: "{{ lookup('password', '/dev/null length=20 chars=ascii_letters,digits,special') }}"
|
||||||
|
ssh_public_key: "{{ lookup('file', '~/.ssh/id_rsa.pub') }}"
|
||||||
|
Créer le fichier infra_azure.yml :
|
||||||
|
- name: Déployer une infrastructure Azure complète
|
||||||
|
hosts: localhost
|
||||||
|
gather_facts: no
|
||||||
|
vars:
|
||||||
|
location: "eastus"
|
||||||
|
resource_group: "ResourceGroup_Genthon_Fayard"
|
||||||
|
virtual_network: "VNet_Genthon_Fayard"
|
||||||
|
subnet: "Subnet_Genthon_Fayard"
|
||||||
|
IP_publique: "PublicIP_Genthon_Fayard"
|
||||||
|
NSG: "NSG_Genthon_Fayard"
|
||||||
|
VM: "UbuntuVMGenthonFayard"
|
||||||
|
network_interface: "VMNic_Genthon_Fayard"
|
||||||
|
vm_size: "Standard_DS1_v2"
|
||||||
|
os_type: "Linux"
|
||||||
|
offer: "UbuntuServer"
|
||||||
|
publisher: "Canonical"
|
||||||
|
sku: "18.04-LTS"
|
||||||
|
version: "latest"
|
||||||
|
admin_username: "azureuser"
|
||||||
|
admin_password: "{{ lookup('community.general.random_string', length=20, special=True) }}"
|
||||||
|
vars_files:
|
||||||
|
- secrets.yml # Charger le fichier Vault contenant les variables sensibles
|
||||||
|
tasks:
|
||||||
|
# Créer un Resource Group
|
||||||
|
- name: Créer un Resource Group
|
||||||
|
azure.azcollection.azure_rm_resourcegroup:
|
||||||
|
name: "{{ resource_group }}"
|
||||||
|
location: "{{ location }}"
|
||||||
|
# Créer un Virtual Network
|
||||||
|
- name: Créer un Virtual Network
|
||||||
|
azure.azcollection.azure_rm_virtualnetwork:
|
||||||
|
name: "{{ virtual_network }}"
|
||||||
|
resource_group: "{{ resource_group }}"
|
||||||
|
location: "{{ location }}"
|
||||||
|
address_prefixes:
|
||||||
|
- "10.0.0.0/16"
|
||||||
|
# Créer un Subnet
|
||||||
|
- name: Créer un Subnet
|
||||||
|
azure.azcollection.azure_rm_subnet:
|
||||||
|
name: "{{ subnet }}"
|
||||||
|
resource_group: "{{ resource_group }}"
|
||||||
|
virtual_network: "{{ virtual_network }}"
|
||||||
|
address_prefix: "10.0.1.0/24"
|
||||||
|
# Créer une IP publique
|
||||||
|
- name: Créer une IP publique
|
||||||
|
azure.azcollection.azure_rm_publicipaddress:
|
||||||
|
name: "{{ IP_publique }}"
|
||||||
|
resource_group: "{{ resource_group }}"
|
||||||
|
allocation_method: Static
|
||||||
|
location: "{{ location }}"
|
||||||
|
# Créer un Network Security Group
|
||||||
|
- name: Créer un Network Security Group (NSG)
|
||||||
|
azure.azcollection.azure_rm_securitygroup:
|
||||||
|
name: "{{ NSG }}"
|
||||||
|
resource_group: "{{ resource_group }}"
|
||||||
|
location: "{{ location }}"
|
||||||
|
rules:
|
||||||
|
- name: Allow-SSH
|
||||||
|
protocol: Tcp
|
||||||
|
destination_port_range: 22
|
||||||
|
access: Allow
|
||||||
|
direction: Inbound
|
||||||
|
priority: 100
|
||||||
|
source_address_prefix: '*'
|
||||||
|
destination_address_prefix: '*'
|
||||||
|
- name: Allow-RDP
|
||||||
|
protocol: Tcp
|
||||||
|
destination_port_range: 3389
|
||||||
|
access: Allow
|
||||||
|
direction: Inbound
|
||||||
|
priority: 110
|
||||||
|
source_address_prefix: '*'
|
||||||
|
destination_address_prefix: '*'
|
||||||
|
- name: AllowICMP
|
||||||
|
priority: 1002
|
||||||
|
direction: Inbound
|
||||||
|
access: Allow
|
||||||
|
protocol: ICMP
|
||||||
|
source_port_range: '*'
|
||||||
|
destination_port_range: '*'
|
||||||
|
source_address_prefix: '*'
|
||||||
|
destination_address_prefix: '*'
|
||||||
|
# Créer une interface réseau (NIC)
|
||||||
|
- name: Créer une interface réseau pour la VM
|
||||||
|
azure.azcollection.azure_rm_networkinterface:
|
||||||
|
name: "{{ network_interface }}"
|
||||||
|
resource_group: "{{ resource_group }}"
|
||||||
|
ANSIBLE Page 3
|
||||||
|
resource_group: "{{ resource_group }}"
|
||||||
|
location: "{{ location }}"
|
||||||
|
security_group: "{{ NSG }}"
|
||||||
|
virtual_network: "{{ virtual_network }}"
|
||||||
|
subnet_name: "{{ subnet }}"
|
||||||
|
ip_configurations:
|
||||||
|
- name: "ipconfig"
|
||||||
|
public_ip_address_name: "{{ IP_publique }}"
|
||||||
|
# Créer une VM Linux (exemple avec Ubuntu)
|
||||||
|
- name: Créer une VM Linux Ubuntu
|
||||||
|
azure.azcollection.azure_rm_virtualmachine:
|
||||||
|
name: "{{ VM }}"
|
||||||
|
resource_group: "{{ resource_group }}"
|
||||||
|
location: "{{ location }}"
|
||||||
|
vm_size: "{{ vm_size }}"
|
||||||
|
admin_username: "{{ admin_username }}"
|
||||||
|
admin_password: "{{ admin_password }}"
|
||||||
|
network_interfaces: "{{ network_interface }}"
|
||||||
|
os_type: "{{ os_type }}"
|
||||||
|
image:
|
||||||
|
offer: "{{ offer }}"
|
||||||
|
publisher: "{{ publisher }}"
|
||||||
|
sku: "{{ sku }}"
|
||||||
|
version: "{{ version }}"
|
||||||
|
Exécuter le playbook :
|
||||||
|
ansible-playbook --ask-vault-pass playbook.yml > Indiquer le mot de passe de la vault
|
||||||
Reference in New Issue
Block a user