6/11/2018 2:07 PM BRK2199 Infrastructure as Code: Leverage Ansible and Terraform on Microsoft Azure Hariharan Jayaraman Principal Program Manager © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Virtual machines Physical hardware Traditional Infrastructure …

Infrastructure as Code? 6/11/2018 2:07 PM Infrastructure as Code? © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Infrastructure as code ! Cloud is software defined ! And code defines it

Cloud deployment patterns Mutable Infrastructure Immutable Infrastructure Capable of change Install the infrastructure and all updates are in place What you and most of us are used to Legacy software will be managed by this pattern Not capable or susceptible of change Deploy infrastructure as per specification , change is a new infra deployment Newer pattern, cloud native Works best with new application patterns

Mutable Infra Demo

Immutable Infra Demo

General Industry Trend and Multi cloud tools

191% of respondents planning to deploy to cloud 6/11/2018 2:07 PM 177% planning to deploy to multiple cloud 191% of respondents planning to deploy to cloud Explosion in multi-cloud OSS tools 270% of enterprises to have multi cloud strategy by 2019 Dimensional Research study Gartner Study of Future of Datacenter in Cloud Era © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Provision Any Infrastructure For Any Application Why Terraform Terraform is a product to provision infrastructure and application resources across private cloud, public cloud, and external services using a common workflow Multi cloud Easy to describe json like format call HCF Supports for both on-prem and clouds Provision Any Infrastructure For Any Application

Terraform on Azure 6/11/2018 2:07 PM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Terraform Resource Support Containers Load balancers Automation WebApps Database cdns Network DNS VMSS VMs Events Storage Expressroute … Traffic mgr Grid ACI

Terraform Customer example

What's coming next Additional resource support Azure stack support Terraform enterprise integrations

What is Ansible? Modular Agent-less SSH-based 6/11/2018 2:07 PM What is Ansible? Modular Many built-in modules, or you can write your own Agent-less Your Ansible controller will connect to hosts to run the tasks SSH-based Connect to your hosts with SSH Keys (recommended), passwords, or Kerberos (Windows is supported) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

POWERFUL SIMPLE AGENTLESS 6/11/2018 2:07 PM POWERFUL App deployment Configuration management Workflow orchestration Orchestrate the app lifecycle SIMPLE Human readable automation No special coding skills needed Tasks executed in order Get productive quickly AGENTLESS Agentless architecture Uses OpenSSH & WinRM No Agents to exploit or udpate More efficient and more secure © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

ANSIBLE’S AUTOMATION ENGINE How Ansible Works ANSIBLE’S AUTOMATION ENGINE ANSIBLE PLAYBOOK PUBLIC / PRIVATE CLOUD CMDB USERS INVENTORY HOSTS NETWORKING PLUGINS API MODULES

Azure… via Ansible? Why? Use your favorite tooling? 6/11/2018 2:07 PM Azure… via Ansible? Why? Use your favorite tooling? You shouldn’t have to worry about the “nooks and crannies” of Azure Immutable CI/CD One Ring to Rule Them All © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Python Dependencies Install dependencies `pip install ansible[azure]` 6/11/2018 2:07 PM Python Dependencies Install dependencies `pip install ansible[azure]` … or from source `pip install .[azure]` (root of the ansible git repository) But… what packages are these instead? Take a look! `pip freeze | grep azure` `cat packaging/requirements/requirements-azure.txt` (root of the ansible repo) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Authentication/Authorization 6/11/2018 2:07 PM Authentication/Authorization Environment variables AZURE_CLIENT_ID AZURE_SECRET AZURE_SUBSCRIPTION_ID AZURE_TENANT Task parameters client_id secret subscription_id tenant Note: create the service principal through the Azure CLI (https://aka.ms/InstallAzureCli) or from the Azure portal © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Matt Davis Sr. Principal Software Engineer, Ansible Core / Red Hat Ansible with Azure Matt Davis Sr. Principal Software Engineer, Ansible Core / Red Hat

Ansible Demo

Ansible Azure Module support Availability sets DNS Function App Load balancer Managed disk Network PublicIP Security Group Storage Virtual Machines Virtual Machine Scale Sets VNET …

What is coming next … Device login Additional Azure modules Azure Stack support

Summary Infrastructure as code is the future ! Multi cloud tools like Terraform and Ansible help make this easier There will be a mix of mutable and immutable deployments

Please evaluate this session Tech Ready 15 6/11/2018 Please evaluate this session From your Please expand notes window at bottom of slide and read. Then Delete this text box. PC or tablet: visit MyIgnite https://myignite.microsoft.com/evaluations Phone: download and use the Microsoft Ignite mobile app https://aka.ms/ignite.mobileapp Your input is important! © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6/11/2018 2:07 PM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

VM Provisioning – Creating the Resource Group - name: create a resource group azure_rm_resourcegroup: name: ansible-rg location: eastus

VM Provisioning – Creating the Virtual Network - name: create virtual network azure_rm_virtualnetwork: resource_group: ansible-rg name: ansiblevnet address_prefixes_cidr: - “11.1.0.0/16”

VM Provisioning – Creating the Subnet - name: create subnet azure_rm_subnet: name: ansiblesubnet resource_group: ansible-rg virtual_network: ansiblevnet address_prefix_cidr: “11.1.0.0/16”

VM Provisioning – Creating the Network Security Group - name: create nsg azure_rm_securitygroup: resource_group: ansible-rg name: ansiblefinalnsg rules: - name: allowssh protocol: Tcp destination_port_range: 22 access: Allow priority: 100 direction: Inbound

VM Provisioning – Creating the Public IP Address - name: create pip azure_rm_publicipaddress: name: ansiblepip resource_group: ansible-rg

VM Provisioning – Creating the Network Interface - name: create nic azure_rm_networkinterface: name: ansiblefinalnic resource_group: ansible-rg public_ip_address: ansiblepip subnet: ansiblesubnet virtual_network: ansiblevnet security_group: ansiblensg

VM Provisioning – Creating the Storage Account - name: create storage account azure_rm_storageaccount: name: ansiblestor resource_group: ansible-rg account_type: Standard_LRS

VM Provisioning – Retrieve your SSH Public Key - name: get ssh key command: cat ~/.ssh/id_rsa.pub register: sshkey

VM Provisioning – Create the Virtual Machine - name: create vm azure_rm_virtualmachine: resource_group: ansible-rg name: ansiblevm vm_size: Standard_D1 storage_account: ansiblestor admin_username: adminUser ssh_password_enabled: false ssh_public_keys: - path: /home/adminUser/.ssh/authorized_keys key_data: '{{ sshkey.stdout }}' network_interfaces: ansiblenic image: offer: CentOS publisher: OpenLogic sku: '7.3' version: latest