Added cloud-init to the mix

terraform/airgapped terraform enterprise on azure/README.md

@@ -9,11 +9,14 @@ Stateless active/active.
 
 ## Requirements
 
-| Requirement      | Description                                                                                                                                        |
-| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
-| TFE license file | A Terraform Enterprise license file must be provided as a Base64 encoded secret in Azure Key Vault.                                                |
-| TLS certificate  | The TLS certificate and private key files must be PEM-encoded. The TLS certificate file can contain a full chain of TLS certificates if necessary. |
-| Virtual machine  | Must be Linux.                                                                                                                                     |
+| Requirement             | Description                                                                                                                                        |
+| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Passwords               | All passwords must be stored as a Base64 encoded secret in Azure Key Vault and retrieved during runtime.                                           |
+| Replicated license file | A valid Replicated license file (`.rli`) must be stored as a Base64 encoded secret in Azure Key Vault and retrieved during runtime.                |
+| TFE airgap bundle       | The TFE airgap bundle for Replicated must be stored as a Blob in a Storage Account and retrieved by the VM after first boot.                       |
+| TLS certificate         | The TLS certificate and private key files must be PEM-encoded. The TLS certificate file can contain a full chain of TLS certificates if necessary. |
+| Tokens                  | All tokens must be stored as a Base64 encoded secret in Azure Key Vault and retrieved during runtime.                                              |
+| Virtual machine         | Must be a Linux VM.                                                                                                                                |
 
 ![requirements diagram]
 

terraform/airgapped terraform enterprise on azure/data.tf

@@ -0,0 +1,37 @@
+# See:
+# - https://registry.terraform.io/providers/hashicorp/cloudinit/latest/docs
+# - https://github.com/chrusty/terraform-multipart-userdata/blob/master/example/cloudinit.tf
+
+data "cloudinit_config" "user_data" {
+  # Disabled only to make the rendered config readable in the outputs.
+  gzip          = false
+  base64_encode = false
+
+  part {
+    content = templatefile(
+      "${path.module}/templates/cloud-init/docker-ce.yaml.tftpl",
+      {
+        docker_user = "azureuser"
+      }
+    )
+    content_type = "text/cloud-config"
+    filename     = "docker-ce"
+  }
+
+  part {
+    content = templatefile(
+      "${path.module}/templates/cloud-init/tfe.yaml.tftpl",
+      {
+        replicated_config_file_location             = var.replicated_config_file_location
+        replicated_config_file_contents_b64encoded  = base64encode(local.replicated_config_file_contents)
+        replicated_license_file_location            = var.replicated_config_license_file_location
+        replicated_license_file_contents_b64encoded = base64encode("") # FIXME: get from Key Vault
+        tfe_config_file_location                    = var.tfe_config_file_location
+        tfe_config_file_contents_b64encoded         = base64encode(local.tfe_config_file_contents)
+      }
+    )
+    content_type = "text/cloud-config"
+    merge_type   = "dict(recurse_array,no_replace)+list(append)"
+    filename     = "tfe"
+  }
+}

terraform/airgapped terraform enterprise on azure/locals.tf

@@ -1,6 +1,9 @@
 locals {
   # See https://help.replicated.com/docs/native/customer-installations/automating/#configure-replicated-automatically
-  replicated_config = {}
+  replicated_config = {
+    LicenseFileLocation               = var.replicated_config_license_file_location
+    LicenseBootstrapAirgapPackagePath = var.replicated_config_license_bootstrap_airgap_package_path
+  }
 
   # Replicated's settings file is JSON formatted.
   # See https://help.replicated.com/docs/native/customer-installations/automating

terraform/airgapped terraform enterprise on azure/outputs.tf

@@ -1,12 +1,16 @@
 output "replicated_config_file" {
   value = {
     contents = local.replicated_config_file_contents
-    path     = var.replicated_config_file_path
+    location = var.replicated_config_file_location
   }
 }
 output "tfe_config_file" {
   value = {
     contents = local.tfe_config_file_contents
-    path     = var.tfe_config_file_path
+    location = var.tfe_config_file_location
   }
 }
+
+output "cloudinit_config" {
+  value = data.cloudinit_config.user_data.rendered
+}

terraform/airgapped terraform enterprise on azure/templates/cloud-init/docker-ce.yaml.tftpl

@@ -0,0 +1,23 @@
+#cloud-config
+
+# See https://cloudinit.readthedocs.io/en/latest/reference/modules.html#package-update-upgrade-install
+packages:
+  - docker-ce
+
+# See https://cloudinit.readthedocs.io/en/latest/reference/modules.html#runcmd
+runcmd:
+
+  # Give the user permissions to use Docker without `sudo`ing.
+  # The 'users' module overrode *both* the SSH keys *and* group assignments in
+  # previous tests. (┛◉Д◉)┛彡┻━┻
+  - grep -qE '^docker:' /etc/group && usermod -a -G docker ${docker_user} || true
+
+# See https://cloudinit.readthedocs.io/en/latest/reference/modules.html#yum-add-repo
+yum_repos:
+  docker-ce:
+    name: Docker CE Stable - $basearch
+    enabled: true
+    baseurl: https://download.docker.com/linux/rhel/$releasever/$basearch/stable
+    priority: 1
+    gpgcheck: true
+    gpgkey: https://download.docker.com/linux/rhel/gpg

terraform/airgapped terraform enterprise on azure/templates/cloud-init/tfe.yaml.tftpl

@@ -0,0 +1,25 @@
+#cloud-config
+
+# Replicated requires Docker
+# TFE requires Replicated
+
+# See https://cloudinit.readthedocs.io/en/latest/reference/modules.html#write-files
+write_files:
+  - encoding: b64
+    path: ${replicated_config_file_location}
+    content: |
+      ${replicated_config_file_contents_b64encoded}
+    permissions: '0600'
+    defer: true
+  - encoding: b64
+    path: ${replicated_license_file_location}
+    content: |
+      ${replicated_license_file_contents_b64encoded}
+    permissions: '0600'
+    defer: true
+  - encoding: b64
+    path: ${tfe_config_file_location}
+    content: |
+      ${tfe_config_file_contents_b64encoded}
+    permissions: '0600'
+    defer: true

terraform/airgapped terraform enterprise on azure/variables.tf

@@ -1,9 +1,17 @@
-variable "replicated_config_file_path" {
+variable "replicated_config_file_location" {
   type        = string
   default     = "/etc/replicated.conf"
   description = "Only read on initial startup."
 }
-variable "tfe_config_file_path" {
+variable "replicated_config_license_bootstrap_airgap_package_path" {
+  type = string
+}
+variable "replicated_config_license_file_location" {
+  type    = string
+  default = "/etc/license.rli"
+}
+
+variable "tfe_config_file_location" {
   type    = string
   default = "/etc/settings.conf"
 }