IaC基础设施即代码：使用Terraform 连接 azure 并创建后端Blob

目录

 一、实验

1.环境

2.azure创建用户

3.Windows使用Terraform 连接 azure

4.Windows给Terraform项目添加azure 后端存储 （实现代码与资源分离）

二、问题

1. az登录失败

2.Azure有哪些冗余类型

---

 一、实验

1.环境

（1）主机

表1-1 主机

主机	系统	软件	工具	备注
jia	Windows	Terraform 1.6.6	Azure CLI、VS Code、 PowerShell、 Chocolatey

2.azure创建用户

（1）Windows 上安装 Azure CLI

安装适用于 Windows 的 Azure CLI | Microsoft Learn

（2）下载

（3）安装

（4）完成

（5）在 PowerShell 中启用 Tab 自动补全

创建或编辑存储在变量 $PROFILE 中的配置文件

notepad $PROFILE

新建

将以下代码添加到 PowerShell 配置文件

Register-ArgumentCompleter -Native -CommandName az -ScriptBlock {
    param($commandName, $wordToComplete, $cursorPosition)
    $completion_file = New-TemporaryFile
    $env:ARGCOMPLETE_USE_TEMPFILES = 1
    $env:_ARGCOMPLETE_STDOUT_FILENAME = $completion_file
    $env:COMP_LINE = $wordToComplete
    $env:COMP_POINT = $cursorPosition
    $env:_ARGCOMPLETE = 1
    $env:_ARGCOMPLETE_SUPPRESS_SPACE = 0
    $env:_ARGCOMPLETE_IFS = "`n"
    $env:_ARGCOMPLETE_SHELL = 'powershell'
    az 2>&1 | Out-Null
    Get-Content $completion_file | Sort-Object | ForEach-Object {
        [System.Management.Automation.CompletionResult]::new($_, $_, "ParameterValue", $_)
    }
    Remove-Item $completion_file, Env:\_ARGCOMPLETE_STDOUT_FILENAME, Env:\ARGCOMPLETE_USE_TEMPFILES, Env:\COMP_LINE, Env:\COMP_POINT, Env:\_ARGCOMPLETE, Env:\_ARGCOMPLETE_SUPPRESS_SPACE, Env:\_ARGCOMPLETE_IFS, Env:\_ARGCOMPLETE_SHELL
}

（7）查看版本

az version

（8）用户登录

az login

输入账户

输入密码

弹出提示页面

返回注册信息

（9）查看azure provider 示例

Terraform Registry

USE PROVIDER  示例

terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "3.89.0"
    }
  }
}

provider "azurerm" {
  # Configuration options
}

Example Usage  示例

# We strongly recommend using the required_providers block to set the
# Azure Provider source and version being used
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "=3.0.0"
    }
  }
}

# Configure the Microsoft Azure Provider
provider "azurerm" {
  skip_provider_registration = true # This is only required when the User, Service Principal, or Identity running Terraform lacks the permissions to register Azure Resource Providers.
  features {}
}

# Create a resource group
resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

# Create a virtual network within the resource group
resource "azurerm_virtual_network" "example" {
  name                = "example-network"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  address_space       = ["10.0.0.0/16"]
}

（10）下载软件包

https://github.com/hashicorp/terraform-provider-azurerm/releases

(11) azure查询地域和可用区

https://azure.microsoft.com/zh-cn/explore/global-infrastructure/geographies/#overview

3.Windows使用Terraform 连接 azure

（1）验证版本

terraform -v 或 terraform --version

（2）创建主配置文件

main.tf

resource "azurerm_resource_group" "tfdemo" {
  name     = "terraform-demo"
  location = "East US"
}

(3) 创建版本配置文件

versions.tf

terraform {
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "3.89.0"
    }
  }
}

provider "azurerm" {
  features {}  
}

(5) 初始化

terraform init

（7）格式化代码

terraform fmt

（8）验证代码

terraform validate 

(9) 计划与预览

 terraform plan

(10) 申请资源

terraform apply

yes

(11) 登录azure系统查看

已新增资源组

4.Windows给Terraform项目添加azure 后端存储 （实现代码与资源分离）

（1）修改主配置文件

main.tf ,添加如下代码

resource "azurerm_storage_account" "tfstate" {
  name                     = "tfstateadmin777"
  resource_group_name      = azurerm_resource_group.tfdemo.name
  location                 = azurerm_resource_group.tfdemo.location
  account_tier             = "Standard"
  account_replication_type = "LRS"

  tags = {
    environment = "dev"
  }
}

（2）计划与预览

 terraform plan

(7) 申请资源

terraform apply

yes

 

（8）展示资源

terraform show

 （9）azure查看

已新增存储账户

（10）创建后端存储容器

修改主配置文件 main.tf ,添加如下代码

resource "azurerm_storage_container" "tfstate" {
  name                  = "tfstate"
  storage_account_name  = azurerm_storage_account.tfstate.name
  container_access_type = "private"
  depends_on = [
    azurerm_storage_account.tfstate
  ]
}

（12）  计划与预览

 terraform plan

（13） 申请资源

terraform apply

yes

（14）登录azure系统查看

①查看容器

已新增

（15）创建后端存储配置文件

backend.tf

terraform {
  backend "azurerm" {
    resource_group_name  = "terraform-demo"
    storage_account_name = "tfstateadmin777"
    container_name       = "tfstate"
    key                  = "global/backend/terraform-backend.tfstate"
  }
}

(16) 初始化

terraform init

yes,系统上传配置文件到azure 的Blob

(17) 登录azure系统查看

①查看存储

配置文件已上传

（18）查看项目目录

（19）删除项目配置文件

（20）再次查看项目目录

（21）查看版本

多了provider的仓库地址

terraform version

terraform -v

二、问题

1. az登录失败

（1）报错

A web browser has been opened at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize. Please continue the login in the web browser. If no web browser is available or if the web browser fails to open, use device code flow with `az login --use-device-code`.
AADSTS90123: The token can't be issued because the identity or claim issuance provider denied the request. Response code: access_denied. Trace ID: fdba16c1-0d47-4f1f-94c4-59d3698b3e00 Correlation ID: 09c23179-da09-4c29-8f7e-5a299615964c Timestamp: 2024-01-26 01:27:07Z
Interactive authentication is needed. Please run:
az login

A web browser has been opened at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize. Please continue the login in the web browser. If no web browser is available or if the web browser fails to open, use device code flow with `az login --use-device-code`.
No subscriptions found for [email protected].

（2）原因分析

azure账户未订阅相关信息。

（3）解决方法

azure订阅信息并清空登录信息，然后重新登录。

az account clear

 az login

成功返回订阅信息

2.Azure有哪些冗余类型

（1）类型