Skip to main content

Managing Azure and GCP Infrastructure

1. Using Azure Collection

Property Description Values
azure_rm_resource_group Manages Azure resource groups azure_rm_resource_group
azure_rm_virtualmachine Manages Azure virtual machines azure_rm_virtualmachine
azure_rm_storageaccount Manages Azure storage accounts azure_rm_storageaccount

Example: Create a Resource Group

- name: Create a resource group
  azure_rm_resource_group:
    name: myResourceGroup
    location: eastus

Example: Create a Virtual Machine

- name: Create a virtual machine
  azure_rm_virtualmachine:
    name: myVM
    resource_group: myResourceGroup
    vm_size: Standard_B1s
    admin_username: azureuser
    admin_password: MySecurePassword123!
    image:
      offer: UbuntuServer
      publisher: Canonical
      sku: 18.04-LTS
      version: latest
Note: Ensure that the Azure credentials are properly configured using AZURE_CLIENT_ID, AZURE_SECRET, and AZURE_TENANT environment variables or a service principal.

2. Configuring Azure Credentials

Property Value Description
azure_subscription_id string Subscription ID for the Azure account
azure_tenant_id string Tenant ID for the Azure Active Directory
azure_client_id string Client ID of the service principal used for authentication
azure_client_secret string Secret key for the service principal
azure_ad_user string Username for Azure AD user authentication (alternative to service principal)
azure_password string Password for Azure AD user authentication (alternative to service principal)

Example: Setting up Azure credentials in a playbook

- name: "Deploy VM on Azure"
  hosts: localhost
  vars:
    azure_subscription_id: "12345678-1234-1234-1234-123456789012"
    azure_tenant_id: "12345678-1234-1234-1234-123456789012"
    azure_client_id: "12345678-1234-1234-1234-123456789012"
    azure_client_secret: "secret-key-here"
  tasks:
    - name: "Create Azure VM"
      azure_rm_virtualmachine:
        resource_group: "myResourceGroup"
        name: "ansible-vm"
        vm_size: "Standard_B1s"
        admin_username: "ansible"
        admin_password: "password123"
        image:
          offer: "UbuntuServer"
          publisher: "Canonical"
          sku: "18.04-LTS"
          version: "latest"
Note: For security, it's recommended to use environment variables or Ansible Vault to store sensitive credential data.

3. Managing Azure VMs

Property Description Example
azure_rm_virtualmachine Module to manage Azure Virtual Machines name: my-vm
resource_group Resource group name where VM is located resource_group: my-resource-group
location Region where VM is created location: eastus
vm_size Size of the virtual machine (e.g., Standard_B1s) vm_size: Standard_B1s
admin_username Admin username for the VM admin_username: azureuser
admin_password Password for admin user (required for Windows) admin_password: MySecurePassword123!
image Image reference to use for the VM (e.g., UbuntuLTS, Windows2019) image: { offer: UbuntuLTS, publisher: Canonical, sku: 18.04-LTS }
network_interface Network interface configuration network_interface: { name: my-nic, subnet: my-subnet }

Example: Create an Azure VM

- name: Create Azure VM
  azure_rm_virtualmachine:
    name: my-vm
    resource_group: my-resource-group
    location: eastus
    vm_size: Standard_B1s
    admin_username: azureuser
    admin_password: MySecurePassword123!
    image:
      offer: UbuntuLTS
      publisher: Canonical
      sku: 18.04-LTS
    network_interface:
      name: my-nic
      subnet: my-subnet

Example: Scale VM Size

- name: Change VM Size
  azure_rm_virtualmachine:
    name: my-vm
    resource_group: my-resource-group
    vm_size: Standard_B2s

Example: Start/Stop VM

- name: Stop VM
  azure_rm_virtualmachine:
    name: my-vm
    resource_group: my-resource-group
    started: false

- name: Start VM
  azure_rm_virtualmachine:
    name: my-vm
    resource_group: my-resource-group
    started: true
Note: Ensure the Azure subscription is configured with proper credentials using AZURE_SUBSCRIPTION_ID, AZURE_CLIENT_ID, and AZURE_SECRET.

4. Managing Azure Resources

Resource Description Module Notes
azure_rm_resourcegroup Manage Azure resource groups azure.azcollection.azure_rm_resourcegroup Required for all other Azure resources
azure_rm_virtualmachine Create or manage Azure virtual machines azure.azcollection.azure_rm_virtualmachine Supports Windows and Linux VMs
azure_rm_networkinterface Manage Azure network interfaces azure.azcollection.azure_rm_networkinterface Used with VMs and load balancers
azure_rm_storageaccount Manage Azure storage accounts azure.azcollection.azure_rm_storageaccount Supports blob, file, queue, and table storage
azure_rm_virtualnetwork Manage Azure virtual networks azure.azcollection.azure_rm_virtualnetwork Used for networking between VMs

Example: Create an Azure Resource Group

- name: Create a resource group
  azure.azcollection.azure_rm_resourcegroup:
    name: my-resource-group
    location: eastus

Example: Create an Azure Virtual Machine

- name: Create a virtual machine
  azure.azcollection.azure_rm_virtualmachine:
    name: my-vm
    resource_group: my-resource-group
    location: eastus
    vm_size: Standard_B1s
    admin_username: azureuser
    admin_password: MySecurePassword123!
    image:
      offer: UbuntuServer
      publisher: Canonical
      sku: 18.04-LTS
      version: latest

Example: Create an Azure Storage Account

- name: Create a storage account
  azure.azcollection.azure_rm_storageaccount:
    name: mystorageaccount
    resource_group: my-resource-group
    location: eastus
    account_type: Standard_LRS
Note: Ensure that the Azure CLI or service principal is configured with appropriate permissions to manage resources in the specified subscription.

5. Using Azure Dynamic Inventory

Parameter Description Default Value Notes
plugin Specifies the inventory plugin to use azure_rm Required for Azure dynamic inventory
auth_source Authentication method to use auto Options: auto, cli, msi, service_principal
subscription_id Azure subscription ID None Required if not using managed identity or CLI auth
tenant_id Azure tenant ID None Required for service principal authentication
client_id Client ID for service principal auth None Required for service principal authentication
client_secret Client secret for service principal auth None Required for service principal authentication

Example: Basic Azure Dynamic Inventory Configuration

plugin: azure_rm
auth_source: auto
subscription_id: "your-subscription-id"
tenant_id: "your-tenant-id"
client_id: "your-client-id"
client_secret: "your-client-secret"

Example: Using Azure CLI Authentication

plugin: azure_rm
auth_source: cli

Example: Using Managed Identity Authentication

plugin: azure_rm
auth_source: msi
Note: Ensure that the required Azure CLI or service principal credentials are properly configured before using this inventory plugin.

6. Using GCP Collection

The google.cloud collection provides modules for managing Google Cloud Platform (GCP) resources in Ansible. It supports a wide range of GCP services including Compute Engine, Storage, and Cloud SQL.

Module Description Documentation
google.cloud.gcp_compute_instance Manages Compute Engine instances Module Docs
google.cloud.gcp_storage_bucket Manages Cloud Storage buckets Module Docs
google.cloud.gcp_sql_database_instance Manages Cloud SQL instances Module Docs

Example: Creating a GCP Compute Instance

- name: Create a GCP Compute Instance
  google.cloud.gcp_compute_instance:
    name: my-instance
    machine_type: n1-standard-1
    network_interfaces:
      - network: default
    disks:
      - boot: true
        initialize_params:
          source_image: debian-cloud/debian-11
    zone: us-central1-a
    project: my-project-id
    auth_kind: serviceaccount
    service_account_file: /path/to/service-account.json

Example: Creating a GCP Storage Bucket

- name: Create a GCP Storage Bucket
  google.cloud.gcp_storage_bucket:
    name: my-bucket
    project: my-project-id
    auth_kind: serviceaccount
    service_account_file: /path/to/service-account.json
Note: Ensure that the service account used has appropriate permissions to manage GCP resources.
Warning: Be cautious when deleting GCP resources as they may not be recoverable.

7. Configuring GCP Credentials

Option Values Notes
gcp_project my-gcp-project Project ID in GCP Console
gcp_service_account_file /path/to/service-account.json Path to JSON key file for service account
gcp_scopes https://www.googleapis.com/auth/cloud-platform OAuth scopes required for API access

Example: Setting GCP Credentials via Environment Variables

export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"
export GCP_PROJECT="my-gcp-project"

Example: Using GCP Credentials in Ansible Playbook

- name: Configure GCP credentials
  hosts: localhost
  vars:
    gcp_project: "my-gcp-project"
    gcp_service_account_file: "/path/to/service-account.json"
  tasks:
    - name: Ensure GCP service account is configured
      debug:
        msg: "Using project {{ gcp_project }} with key file {{ gcp_service_account_file }}"
Note: Ensure the service account has appropriate roles assigned in GCP IAM for the resources you intend to manage.

8. Managing GCE Instances

Property Description Example
name Name of the instance my-gce-instance
machine_type Machine type to use for the instance n1-standard-1
zone Zone where the instance is located us-central1-a
image Base image for the instance debian-11
network Network to attach the instance to default
subnetwork Subnetwork to attach the instance to default
service_account Service account to use for the instance my-service-account@project.iam.gserviceaccount.com
tags Network tags to apply to the instance ["web", "http"]

Example: Create GCE Instance

- name: Create GCE instance
  gcp_compute_instance:
    name: my-gce-instance
    machine_type: n1-standard-1
    zone: us-central1-a
    image: debian-11
    network: default
    subnetwork: default
    service_account: my-service-account@project.iam.gserviceaccount.com
    tags:
      - web
      - http
    state: present

Example: Delete GCE Instance

- name: Delete GCE instance
  gcp_compute_instance:
    name: my-gce-instance
    zone: us-central1-a
    state: absent
Note: Ensure that the gcp_compute_instance module is installed and configured with appropriate credentials to interact with GCP.

9. Managing GCP Resources

Resource Module Description Notes
google.cloud.compute_instance google.cloud.compute_instance Manages a Compute Engine instance Supports various configurations like disks, networks, and metadata
google.cloud.storage_bucket google.cloud.storage_bucket Manages a Cloud Storage bucket Supports lifecycle rules, versioning, and IAM policies
google.cloud.sql_database_instance google.cloud.sql_database_instance Manages a Cloud SQL instance Supports MySQL, PostgreSQL, and SQL Server engines
google.cloud.container_cluster google.cloud.container_cluster Manages a GKE cluster Supports node pools, addons, and network configurations

Example: Create a GCP Compute Instance

---
- name: Create GCP Compute Instance
  hosts: localhost
  tasks:
    - name: Create instance
      google.cloud.compute_instance:
        name: my-instance
        machine_type: e2-medium
        zone: us-central1-a
        image: debian-cloud/debian-11
        network_interfaces:
          - network: default
        service_account:
          email: my-service-account@my-project.iam.gserviceaccount.com
          scopes:
            - https://www.googleapis.com/auth/cloud-platform
        state: present

Example: Create a GCP Storage Bucket

---
- name: Create GCP Storage Bucket
  hosts: localhost
  tasks:
    - name: Create bucket
      google.cloud.storage_bucket:
        name: my-bucket
        project: my-project
        storage_class: STANDARD
        versioning:
          enabled: true
        lifecycle_rules:
          - action:
              type: Delete
            condition:
              age: 30
        state: present

Example: Create a GCP SQL Instance

---
- name: Create GCP SQL Instance
  hosts: localhost
  tasks:
    - name: Create instance
      google.cloud.sql_database_instance:
        name: my-db-instance
        database_version: MYSQL_8_0
        region: us-central1
        settings:
          tier: db-f1-micro
          backup_configuration:
            enabled: true
            start_time: 23:00
        state: present

Example: Create a GKE Cluster

---
- name: Create GKE Cluster
  hosts: localhost
  tasks:
    - name: Create cluster
      google.cloud.container_cluster:
        name: my-gke-cluster
        location: us-central1
        node_pools:
          - name: default-pool
            initial_node_count: 1
            machine_type: e2-medium
        network: default
        subnetwork: default
        state: present
Note: Ensure that the google.cloud collection is installed and configured with appropriate credentials for GCP access.
Warning: Be cautious with resource deletion; GCP resources may incur costs even when not in use.

10. Using GCP Dynamic Inventory

Example: GCP Dynamic Inventory Configuration

plugin: gcp_compute
projects:
  - my-gcp-project-123456
filters:
  - name = "ansible-*"
auth_kind: serviceaccount
credentials_file: /path/to/service-account-key.json
Option Values Description
plugin gcp_compute Inventory plugin for GCP Compute Engine
projects list List of GCP project IDs to query
filters list Optional GCP compute filters (e.g., name = "ansible-*")
auth_kind serviceaccount, application_default Authentication method to use (serviceaccount or application default)
credentials_file string Path to service account key file (required for serviceaccount)
Note: Ensure the service account has compute.instances.list and compute.instances.get permissions.
Warning: GCP dynamic inventory does not support gcp_compute plugin in Ansible 2.10 or earlier.

Key Features

  • Automatically discovers GCP instances based on filters
  • Supports multiple projects
  • Uses GCP service account for authentication
  • Provides host variables like gcp_machine_type, gcp_network

Was this article helpful?