你当前正在访问 Microsoft Azure Global Edition 技术文档网站。如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

快速入门 - 使用 Terraform 创建专用终结点

项目
03/28/2024

在本快速入门中，你将使用 Terraform 创建专用终结点。专用终结点将连接到 Azure SQL 数据库。专用终结点与虚拟网络和专用域名系统 (DNS) 区域相关联。专用 DNS 区域可解析专用终结点 IP 地址。虚拟网络包含的虚拟机可用于测试专用终结点与 SQL 数据库实例之间的连接。

该脚本为 SQL Server 生成了随机密码，并为虚拟机生成了随机 SSH 密钥。运行脚本时，将输出所创建资源的名称。

使用 Terraform 可以定义、预览和部署云基础结构。使用 Terraform 时，请使用 HCL 语法来创建配置文件。利用 HCL 语法，可指定 Azure 这样的云提供程序和构成云基础结构的元素。创建配置文件后，请创建一个执行计划，利用该计划，可在部署基础结构更改之前先预览这些更改。验证了更改后，请应用该执行计划以部署基础结构。

在专用终结点快速入门中创建的资源的示意图。

先决条件

需要一个具有活动订阅的 Azure 帐户。免费创建帐户。
安装和配置 Terraform。

实现 Terraform 代码

注意

本文中的示例代码位于 Azure Terraform GitHub 存储库中。

创建用于测试和运行示例 Terraform 代码的目录，并将其设为当前目录。

创建名为 main.tf 的文件并插入下列代码：

resource "random_pet" "prefix" {
  prefix = var.resource_group_name_prefix
  length = 1
}

# Resource Group
resource "azurerm_resource_group" "rg" {
  location = var.resource_group_location
  name     = "${random_pet.prefix.id}-rg"
}

# Virtual Network
resource "azurerm_virtual_network" "my_terraform_network" {
  name                = "${random_pet.prefix.id}-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
}

# Subnet 1
resource "azurerm_subnet" "my_terraform_subnet_1" {
  name                 = "subnet-1"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.my_terraform_network.name
  address_prefixes     = ["10.0.0.0/24"]
}

# Public IP address for NAT gateway
resource "azurerm_public_ip" "my_public_ip" {
  name                = "public-ip-nat"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  allocation_method   = "Static"
  sku                 = "Standard"
}

# NAT Gateway
resource "azurerm_nat_gateway" "my_nat_gateway" {
  name                = "nat-gateway"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
}

# Associate NAT Gateway with Public IP
resource "azurerm_nat_gateway_public_ip_association" "example" {
  nat_gateway_id       = azurerm_nat_gateway.my_nat_gateway.id
  public_ip_address_id = azurerm_public_ip.my_public_ip.id
}

# Associate NAT Gateway with Subnet
resource "azurerm_subnet_nat_gateway_association" "example" {
  subnet_id      = azurerm_subnet.my_terraform_subnet_1.id
  nat_gateway_id = azurerm_nat_gateway.my_nat_gateway.id
}

# Create public IP for virtual machine
resource "azurerm_public_ip" "my_public_ip_vm" {
  name                = "public-ip-vm"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  allocation_method   = "Static"
  sku                 = "Standard"
}

# Create Network Security Group and rule
resource "azurerm_network_security_group" "my_terraform_nsg" {
  name                = "nsg-1"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name

  security_rule {
    name                       = "SSH"
    priority                   = 1001
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
}

# Create network interface
resource "azurerm_network_interface" "my_terraform_nic" {
  name                = "nic-1"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name

  ip_configuration {
    name                          = "my_nic_configuration"
    subnet_id                     = azurerm_subnet.my_terraform_subnet_1.id
    private_ip_address_allocation = "Dynamic"
    public_ip_address_id          = azurerm_public_ip.my_public_ip_vm.id
  }
}

# Connect the security group to the network interface
resource "azurerm_network_interface_security_group_association" "example" {
  network_interface_id      = azurerm_network_interface.my_terraform_nic.id
  network_security_group_id = azurerm_network_security_group.my_terraform_nsg.id
}

# Generate random text for a unique storage account name
resource "random_id" "random_id" {
  keepers = {
    # Generate a new ID only when a new resource group is defined
    resource_group = azurerm_resource_group.rg.name
  }

  byte_length = 8
}

# Create storage account for boot diagnostics
resource "azurerm_storage_account" "my_storage_account" {
  name                     = "diag${random_id.random_id.hex}"
  location                 = azurerm_resource_group.rg.location
  resource_group_name      = azurerm_resource_group.rg.name
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

# Create virtual machine
resource "azurerm_linux_virtual_machine" "my_terraform_vm" {
  name                  = "vm-1"
  location              = azurerm_resource_group.rg.location
  resource_group_name   = azurerm_resource_group.rg.name
  network_interface_ids = [azurerm_network_interface.my_terraform_nic.id]
  size                  = "Standard_DS1_v2"

  os_disk {
    name                 = "myOsDisk"
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts-gen2"
    version   = "latest"
  }

  computer_name  = "hostname"
  admin_username = var.username

  admin_ssh_key {
    username   = var.username
    public_key = jsondecode(azapi_resource_action.ssh_public_key_gen.output).publicKey
  }

  boot_diagnostics {
    storage_account_uri = azurerm_storage_account.my_storage_account.primary_blob_endpoint
  }
}

# Create SQL server name
resource "random_pet" "azurerm_mssql_server_name" {
  prefix = "sql"
}

# Random password for SQL server
resource "random_password" "admin_password" {
  count       = var.admin_password == null ? 1 : 0
  length      = 20
  special     = true
  min_numeric = 1
  min_upper   = 1
  min_lower   = 1
  min_special = 1
}

locals {
  admin_password = try(random_password.admin_password[0].result, var.admin_password)
}

# Create SQL server
resource "azurerm_mssql_server" "server" {
  name                         = random_pet.azurerm_mssql_server_name.id
  resource_group_name          = azurerm_resource_group.rg.name
  location                     = azurerm_resource_group.rg.location
  administrator_login          = var.admin_username
  administrator_login_password = local.admin_password
  version                      = "12.0"
}

# Create SQL database
resource "azurerm_mssql_database" "db" {
  name      = var.sql_db_name
  server_id = azurerm_mssql_server.server.id
}

# Create private endpoint for SQL server
resource "azurerm_private_endpoint" "my_terraform_endpoint" {
  name                = "private-endpoint-sql"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  subnet_id           = azurerm_subnet.my_terraform_subnet_1.id

  private_service_connection {
    name                           = "private-serviceconnection"
    private_connection_resource_id = azurerm_mssql_server.server.id
    subresource_names              = ["sqlServer"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "dns-zone-group"
    private_dns_zone_ids = [azurerm_private_dns_zone.my_terraform_dns_zone.id]
  }
}

# Create private DNS zone
resource "azurerm_private_dns_zone" "my_terraform_dns_zone" {
  name                = "privatelink.database.windows.net"
  resource_group_name = azurerm_resource_group.rg.name
}

# Create virtual network link
resource "azurerm_private_dns_zone_virtual_network_link" "my_terraform_vnet_link" {
  name                  = "vnet-link"
  resource_group_name   = azurerm_resource_group.rg.name
  private_dns_zone_name = azurerm_private_dns_zone.my_terraform_dns_zone.name
  virtual_network_id    = azurerm_virtual_network.my_terraform_network.id
}

创建名为 outputs.tf 的文件并插入下列代码：

output "resource_group_name" {
  description = "The name of the created resource group."
  value       = azurerm_resource_group.rg.name
}

output "virtual_network_name" {
  description = "The name of the created virtual network."
  value       = azurerm_virtual_network.my_terraform_network.name
}

output "subnet_name_1" {
  description = "The name of the created subnet 1."
  value       = azurerm_subnet.my_terraform_subnet_1.name
}

output "nat_gateway_name" {
  description = "The name of the created NAT gateway."
  value       = azurerm_nat_gateway.my_nat_gateway.name
}

output "sql_server_name" {
  value = azurerm_mssql_server.server.name
}

output "admin_password" {
  sensitive = true
  value     = local.admin_password
}

创建名为 provider.tf 的文件并插入下列代码：

terraform {
  required_providers {
    azapi = {
      source  = "azure/azapi"
      version = "~>1.5"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~>3.0"
    }
    random = {
      source  = "hashicorp/random"
      version = "~>3.0"
    }
  }
}

provider "azurerm" {
  features {
    resource_group {
      prevent_deletion_if_contains_resources = false
    }
  }
}

创建名为 ssh.tf 的文件并插入下列代码：

resource "random_pet" "ssh_key_name" {
  prefix    = "ssh"
  separator = ""
}

resource "azapi_resource_action" "ssh_public_key_gen" {
  type        = "Microsoft.Compute/sshPublicKeys@2022-11-01"
  resource_id = azapi_resource.ssh_public_key.id
  action      = "generateKeyPair"
  method      = "POST"

  response_export_values = ["publicKey", "privateKey"]
}

resource "azapi_resource" "ssh_public_key" {
  type      = "Microsoft.Compute/sshPublicKeys@2022-11-01"
  name      = random_pet.ssh_key_name.id
  location  = azurerm_resource_group.rg.location
  parent_id = azurerm_resource_group.rg.id
}

output "key_data" {
  value = jsondecode(azapi_resource_action.ssh_public_key_gen.output).publicKey
}

创建名为 variables.tf 的文件并插入下列代码：

variable "resource_group_location" {
  type        = string
  default     = "eastus"
  description = "Location of the resource group."
}

variable "resource_group_name_prefix" {
  type        = string
  default     = "rg"
  description = "Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription."
}

variable "username" {
  type        = string
  description = "The username for the local account that will be created on the new VM."
  default     = "azureuser"
}

variable "sql_db_name" {
  type        = string
  description = "The name of the SQL Database."
  default     = "SampleDB"
}

variable "admin_username" {
  type        = string
  description = "The administrator username of the SQL logical server."
  default     = "azureadmin"
}

variable "admin_password" {
  type        = string
  description = "The administrator password of the SQL logical server."
  sensitive   = true
  default     = null
}

初始化 Terraform

运行 terraform init，将 Terraform 部署进行初始化。此命令将下载管理 Azure 资源所需的 Azure 提供程序。

terraform init -upgrade

要点：

参数 -upgrade 可将必要的提供程序插件升级到符合配置版本约束的最新版本。

创建 Terraform 执行计划

运行 terraform plan 以创建执行计划。

terraform plan -out main.tfplan

要点：

terraform plan 命令将创建一个执行计划，但不会执行它。它会确定创建配置文件中指定的配置需要执行哪些操作。此模式允许你在对实际资源进行任何更改之前验证执行计划是否符合预期。
使用可选 -out 参数可以为计划指定输出文件。使用 -out 参数可以确保所查看的计划与所应用的计划完全一致。

应用 Terraform 执行计划

运行 terraform apply，将执行计划应用到云基础结构。

terraform apply main.tfplan

要点：

示例 terraform apply 命令假设你先前运行了 terraform plan -out main.tfplan。
如果为 -out 参数指定了不同的文件名，请在对 terraform apply 的调用中使用该相同文件名。
如果未使用 -out 参数，请调用不带任何参数的 terraform apply。

获取 Azure 资源组名称。

resource_group_name=$(terraform output -raw resource_group_name)

获取 SQL Server 名称。

sql_server=$(terraform output -raw sql_server)

运行 az sql server show 以显示有关 SQL Server 专用终结点的详细信息。

az sql server show \
    --resource-group $resource_group_name \
    --name $sql_server --query privateEndpointConnections \
    --output tsv

获取 Azure 资源组名称。

$resource_group_name=$(terraform output -raw resource_group_name)

获取 SQL Server 名称。

$sql_server=$(terraform output -raw sql_server_name)

运行 Get-AzPrivateEndpoint 以显示有关 SQL Server 专用终结点的详细信息。
```
$sql = @{
ResourceGroupName = $resource_group_name
}
Get-AzPrivateEndpoint @sql
```

清理资源

不再需要通过 Terraform 创建的资源时，请执行以下步骤：

运行 terraform plan 并指定 destroy 标志。
```
terraform plan -destroy -out main.destroy.tfplan
```
要点：
- terraform plan 命令将创建一个执行计划，但不会执行它。它会确定创建配置文件中指定的配置需要执行哪些操作。此模式允许你在对实际资源进行任何更改之前验证执行计划是否符合预期。
- 使用可选 -out 参数可以为计划指定输出文件。使用 -out 参数可以确保所查看的计划与所应用的计划完全一致。
运行 terraform apply 以应用执行计划。
```
terraform apply main.destroy.tfplan
```

Azure 上的 Terraform 故障排除

排查在 Azure 上使用 Terraform 时遇到的常见问题。

后续步骤

详细了解如何在 Azure 中使用 Terraform

Share via

快速入门 - 使用 Terraform 创建专用终结点

先决条件

实现 Terraform 代码

初始化 Terraform

创建 Terraform 执行计划

应用 Terraform 执行计划

验证结果

清理资源

Azure 上的 Terraform 故障排除

后续步骤

其他资源