Managing Azure and GCP Infrastructure
1. Using Azure Collection
| Property | Description | Values |
|---|---|---|
| azure_rm_resource_group | Manages Azure resource groups | azure_rm_resource_group |
| azure_rm_virtualmachine | Manages Azure virtual machines | azure_rm_virtualmachine |
| azure_rm_storageaccount | Manages Azure storage accounts | azure_rm_storageaccount |
Example: Create a Resource Group
- name: Create a resource group
azure_rm_resource_group:
name: myResourceGroup
location: eastus
Example: Create a Virtual Machine
- name: Create a virtual machine
azure_rm_virtualmachine:
name: myVM
resource_group: myResourceGroup
vm_size: Standard_B1s
admin_username: azureuser
admin_password: MySecurePassword123!
image:
offer: UbuntuServer
publisher: Canonical
sku: 18.04-LTS
version: latest
Note: Ensure that the Azure credentials are properly configured using
AZURE_CLIENT_ID, AZURE_SECRET, and AZURE_TENANT environment variables or a service principal.
2. Configuring Azure Credentials
| Property | Value | Description |
|---|---|---|
| azure_subscription_id | string |
Subscription ID for the Azure account |
| azure_tenant_id | string |
Tenant ID for the Azure Active Directory |
| azure_client_id | string |
Client ID of the service principal used for authentication |
| azure_client_secret | string |
Secret key for the service principal |
| azure_ad_user | string |
Username for Azure AD user authentication (alternative to service principal) |
| azure_password | string |
Password for Azure AD user authentication (alternative to service principal) |
Example: Setting up Azure credentials in a playbook
- name: "Deploy VM on Azure"
hosts: localhost
vars:
azure_subscription_id: "12345678-1234-1234-1234-123456789012"
azure_tenant_id: "12345678-1234-1234-1234-123456789012"
azure_client_id: "12345678-1234-1234-1234-123456789012"
azure_client_secret: "secret-key-here"
tasks:
- name: "Create Azure VM"
azure_rm_virtualmachine:
resource_group: "myResourceGroup"
name: "ansible-vm"
vm_size: "Standard_B1s"
admin_username: "ansible"
admin_password: "password123"
image:
offer: "UbuntuServer"
publisher: "Canonical"
sku: "18.04-LTS"
version: "latest"
Note: For security, it's recommended to use environment variables or Ansible Vault to store sensitive credential data.
3. Managing Azure VMs
| Property | Description | Example |
|---|---|---|
| azure_rm_virtualmachine | Module to manage Azure Virtual Machines | name: my-vm |
| resource_group | Resource group name where VM is located | resource_group: my-resource-group |
| location | Region where VM is created | location: eastus |
| vm_size | Size of the virtual machine (e.g., Standard_B1s) | vm_size: Standard_B1s |
| admin_username | Admin username for the VM | admin_username: azureuser |
| admin_password | Password for admin user (required for Windows) | admin_password: MySecurePassword123! |
| image | Image reference to use for the VM (e.g., UbuntuLTS, Windows2019) | image: { offer: UbuntuLTS, publisher: Canonical, sku: 18.04-LTS } |
| network_interface | Network interface configuration | network_interface: { name: my-nic, subnet: my-subnet } |
Example: Create an Azure VM
- name: Create Azure VM
azure_rm_virtualmachine:
name: my-vm
resource_group: my-resource-group
location: eastus
vm_size: Standard_B1s
admin_username: azureuser
admin_password: MySecurePassword123!
image:
offer: UbuntuLTS
publisher: Canonical
sku: 18.04-LTS
network_interface:
name: my-nic
subnet: my-subnet
Example: Scale VM Size
- name: Change VM Size
azure_rm_virtualmachine:
name: my-vm
resource_group: my-resource-group
vm_size: Standard_B2s
Example: Start/Stop VM
- name: Stop VM
azure_rm_virtualmachine:
name: my-vm
resource_group: my-resource-group
started: false
- name: Start VM
azure_rm_virtualmachine:
name: my-vm
resource_group: my-resource-group
started: true
Note: Ensure the Azure subscription is configured with proper credentials using
AZURE_SUBSCRIPTION_ID, AZURE_CLIENT_ID, and AZURE_SECRET.
4. Managing Azure Resources
| Resource | Description | Module | Notes |
|---|---|---|---|
| azure_rm_resourcegroup | Manage Azure resource groups | azure.azcollection.azure_rm_resourcegroup |
Required for all other Azure resources |
| azure_rm_virtualmachine | Create or manage Azure virtual machines | azure.azcollection.azure_rm_virtualmachine |
Supports Windows and Linux VMs |
| azure_rm_networkinterface | Manage Azure network interfaces | azure.azcollection.azure_rm_networkinterface |
Used with VMs and load balancers |
| azure_rm_storageaccount | Manage Azure storage accounts | azure.azcollection.azure_rm_storageaccount |
Supports blob, file, queue, and table storage |
| azure_rm_virtualnetwork | Manage Azure virtual networks | azure.azcollection.azure_rm_virtualnetwork |
Used for networking between VMs |
Example: Create an Azure Resource Group
- name: Create a resource group
azure.azcollection.azure_rm_resourcegroup:
name: my-resource-group
location: eastus
Example: Create an Azure Virtual Machine
- name: Create a virtual machine
azure.azcollection.azure_rm_virtualmachine:
name: my-vm
resource_group: my-resource-group
location: eastus
vm_size: Standard_B1s
admin_username: azureuser
admin_password: MySecurePassword123!
image:
offer: UbuntuServer
publisher: Canonical
sku: 18.04-LTS
version: latest
Example: Create an Azure Storage Account
- name: Create a storage account
azure.azcollection.azure_rm_storageaccount:
name: mystorageaccount
resource_group: my-resource-group
location: eastus
account_type: Standard_LRS
Note: Ensure that the Azure CLI or service principal is configured with appropriate permissions to manage resources in the specified subscription.
5. Using Azure Dynamic Inventory
| Parameter | Description | Default Value | Notes |
|---|---|---|---|
| plugin | Specifies the inventory plugin to use | azure_rm |
Required for Azure dynamic inventory |
| auth_source | Authentication method to use | auto |
Options: auto, cli, msi, service_principal |
| subscription_id | Azure subscription ID | None | Required if not using managed identity or CLI auth |
| tenant_id | Azure tenant ID | None | Required for service principal authentication |
| client_id | Client ID for service principal auth | None | Required for service principal authentication |
| client_secret | Client secret for service principal auth | None | Required for service principal authentication |
Example: Basic Azure Dynamic Inventory Configuration
plugin: azure_rm
auth_source: auto
subscription_id: "your-subscription-id"
tenant_id: "your-tenant-id"
client_id: "your-client-id"
client_secret: "your-client-secret"
Note: Ensure that the required Azure CLI or service principal credentials are properly configured before using this inventory plugin.
6. Using GCP Collection
The google.cloud collection provides modules for managing Google Cloud Platform (GCP) resources in Ansible. It supports a wide range of GCP services including Compute Engine, Storage, and Cloud SQL.
| Module | Description | Documentation |
|---|---|---|
| google.cloud.gcp_compute_instance | Manages Compute Engine instances | Module Docs |
| google.cloud.gcp_storage_bucket | Manages Cloud Storage buckets | Module Docs |
| google.cloud.gcp_sql_database_instance | Manages Cloud SQL instances | Module Docs |
Example: Creating a GCP Compute Instance
- name: Create a GCP Compute Instance
google.cloud.gcp_compute_instance:
name: my-instance
machine_type: n1-standard-1
network_interfaces:
- network: default
disks:
- boot: true
initialize_params:
source_image: debian-cloud/debian-11
zone: us-central1-a
project: my-project-id
auth_kind: serviceaccount
service_account_file: /path/to/service-account.json
Example: Creating a GCP Storage Bucket
- name: Create a GCP Storage Bucket
google.cloud.gcp_storage_bucket:
name: my-bucket
project: my-project-id
auth_kind: serviceaccount
service_account_file: /path/to/service-account.json
Note: Ensure that the service account used has appropriate permissions to manage GCP resources.
Warning: Be cautious when deleting GCP resources as they may not be recoverable.
7. Configuring GCP Credentials
| Option | Values | Notes |
|---|---|---|
| gcp_project | my-gcp-project |
Project ID in GCP Console |
| gcp_service_account_file | /path/to/service-account.json |
Path to JSON key file for service account |
| gcp_scopes | https://www.googleapis.com/auth/cloud-platform |
OAuth scopes required for API access |
Example: Setting GCP Credentials via Environment Variables
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"
export GCP_PROJECT="my-gcp-project"
Example: Using GCP Credentials in Ansible Playbook
- name: Configure GCP credentials
hosts: localhost
vars:
gcp_project: "my-gcp-project"
gcp_service_account_file: "/path/to/service-account.json"
tasks:
- name: Ensure GCP service account is configured
debug:
msg: "Using project {{ gcp_project }} with key file {{ gcp_service_account_file }}"
Note: Ensure the service account has appropriate roles assigned in GCP IAM for the resources you intend to manage.
8. Managing GCE Instances
| Property | Description | Example |
|---|---|---|
| name | Name of the instance | my-gce-instance |
| machine_type | Machine type to use for the instance | n1-standard-1 |
| zone | Zone where the instance is located | us-central1-a |
| image | Base image for the instance | debian-11 |
| network | Network to attach the instance to | default |
| subnetwork | Subnetwork to attach the instance to | default |
| service_account | Service account to use for the instance | my-service-account@project.iam.gserviceaccount.com |
| tags | Network tags to apply to the instance | ["web", "http"] |
Example: Create GCE Instance
- name: Create GCE instance
gcp_compute_instance:
name: my-gce-instance
machine_type: n1-standard-1
zone: us-central1-a
image: debian-11
network: default
subnetwork: default
service_account: my-service-account@project.iam.gserviceaccount.com
tags:
- web
- http
state: present
Example: Delete GCE Instance
- name: Delete GCE instance
gcp_compute_instance:
name: my-gce-instance
zone: us-central1-a
state: absent
Note: Ensure that the
gcp_compute_instance module is installed and configured with appropriate credentials to interact with GCP.
9. Managing GCP Resources
| Resource | Module | Description | Notes |
|---|---|---|---|
| google.cloud.compute_instance | google.cloud.compute_instance |
Manages a Compute Engine instance | Supports various configurations like disks, networks, and metadata |
| google.cloud.storage_bucket | google.cloud.storage_bucket |
Manages a Cloud Storage bucket | Supports lifecycle rules, versioning, and IAM policies |
| google.cloud.sql_database_instance | google.cloud.sql_database_instance |
Manages a Cloud SQL instance | Supports MySQL, PostgreSQL, and SQL Server engines |
| google.cloud.container_cluster | google.cloud.container_cluster |
Manages a GKE cluster | Supports node pools, addons, and network configurations |
Example: Create a GCP Compute Instance
---
- name: Create GCP Compute Instance
hosts: localhost
tasks:
- name: Create instance
google.cloud.compute_instance:
name: my-instance
machine_type: e2-medium
zone: us-central1-a
image: debian-cloud/debian-11
network_interfaces:
- network: default
service_account:
email: my-service-account@my-project.iam.gserviceaccount.com
scopes:
- https://www.googleapis.com/auth/cloud-platform
state: present
Example: Create a GCP Storage Bucket
---
- name: Create GCP Storage Bucket
hosts: localhost
tasks:
- name: Create bucket
google.cloud.storage_bucket:
name: my-bucket
project: my-project
storage_class: STANDARD
versioning:
enabled: true
lifecycle_rules:
- action:
type: Delete
condition:
age: 30
state: present
Example: Create a GCP SQL Instance
---
- name: Create GCP SQL Instance
hosts: localhost
tasks:
- name: Create instance
google.cloud.sql_database_instance:
name: my-db-instance
database_version: MYSQL_8_0
region: us-central1
settings:
tier: db-f1-micro
backup_configuration:
enabled: true
start_time: 23:00
state: present
Example: Create a GKE Cluster
---
- name: Create GKE Cluster
hosts: localhost
tasks:
- name: Create cluster
google.cloud.container_cluster:
name: my-gke-cluster
location: us-central1
node_pools:
- name: default-pool
initial_node_count: 1
machine_type: e2-medium
network: default
subnetwork: default
state: present
Note: Ensure that the
google.cloud collection is installed and configured with appropriate credentials for GCP access.
Warning: Be cautious with resource deletion; GCP resources may incur costs even when not in use.
10. Using GCP Dynamic Inventory
Example: GCP Dynamic Inventory Configuration
plugin: gcp_compute
projects:
- my-gcp-project-123456
filters:
- name = "ansible-*"
auth_kind: serviceaccount
credentials_file: /path/to/service-account-key.json
| Option | Values | Description |
|---|---|---|
| plugin | gcp_compute |
Inventory plugin for GCP Compute Engine |
| projects | list |
List of GCP project IDs to query |
| filters | list |
Optional GCP compute filters (e.g., name = "ansible-*") |
| auth_kind | serviceaccount, application_default |
Authentication method to use (serviceaccount or application default) |
| credentials_file | string |
Path to service account key file (required for serviceaccount) |
Note: Ensure the service account has
compute.instances.list and compute.instances.get permissions.Warning: GCP dynamic inventory does not support
gcp_compute plugin in Ansible 2.10 or earlier.