使用 Terraform 在 Azure 中建立中樞虛擬網路
Terraform 可讓您定義、預覽和部署雲端基礎結構。 使用 Terraform 時,您可以使用 HCL 語法來建立設定檔。 HCL 語法可讓您指定雲端提供者 (例如 Azure) 和構成雲端基礎結構的元素。 建立設定檔之後,您可以建立執行計畫,讓您先預覽基礎結構變更,之後再部署。 驗證變更之後,您可以套用執行計畫來部署基礎結構。
中樞虛擬網路可作為內部部署網路的連線中心點。 虛擬網路會裝載輪輻虛擬網路中裝載工作負載所取用的共用服務。 為了示範目的,本文不會實作任何共用服務。
在本文中,您將學會如何:
- 在中樞和輪輻拓撲中實作中樞虛擬網路。
- 建立中樞 Jumpbox 虛擬機器。
- 建立中樞虛擬私人網路閘道。
- 建立中樞和內部部署閘道連線。
1.設定您的環境
- Azure 訂用帳戶:如果您沒有 Azure 訂用帳戶,請在開始前建立免費帳戶。
設定 Terraform :如果您尚未這麼做,請使用下列其中一個選項來設定 Terraform:
2.實作 Terraform 程式碼
中樞網路包含下列元件:
- 中樞虛擬網路
- 中樞虛擬網路閘道
- 中樞閘道連線
將本系列第一篇文章中建立的範例目錄設為目前目錄。
在範例目錄中,建立名為
hub-vnet.tf
的檔案。插入下列程式碼:
locals { prefix-hub = "hub" hub-location = "eastus" hub-resource-group = "hub-vnet-rg" shared-key = "4-v3ry-53cr37-1p53c-5h4r3d-k3y" } resource "azurerm_resource_group" "hub-vnet-rg" { name = local.hub-resource-group location = local.hub-location } resource "azurerm_virtual_network" "hub-vnet" { name = "${local.prefix-hub}-vnet" location = azurerm_resource_group.hub-vnet-rg.location resource_group_name = azurerm_resource_group.hub-vnet-rg.name address_space = ["10.0.0.0/16"] tags = { environment = "hub-spoke" } } resource "azurerm_subnet" "hub-gateway-subnet" { name = "GatewaySubnet" resource_group_name = azurerm_resource_group.hub-vnet-rg.name virtual_network_name = azurerm_virtual_network.hub-vnet.name address_prefixes = ["10.0.255.224/27"] } resource "azurerm_subnet" "hub-mgmt" { name = "mgmt" resource_group_name = azurerm_resource_group.hub-vnet-rg.name virtual_network_name = azurerm_virtual_network.hub-vnet.name address_prefixes = ["10.0.0.64/27"] } resource "azurerm_subnet" "hub-dmz" { name = "dmz" resource_group_name = azurerm_resource_group.hub-vnet-rg.name virtual_network_name = azurerm_virtual_network.hub-vnet.name address_prefixes = ["10.0.0.32/27"] } resource "azurerm_network_interface" "hub-nic" { name = "${local.prefix-hub}-nic" location = azurerm_resource_group.hub-vnet-rg.location resource_group_name = azurerm_resource_group.hub-vnet-rg.name enable_ip_forwarding = true ip_configuration { name = local.prefix-hub subnet_id = azurerm_subnet.hub-mgmt.id private_ip_address_allocation = "Dynamic" } tags = { environment = local.prefix-hub } } #Virtual Machine resource "azurerm_virtual_machine" "hub-vm" { name = "${local.prefix-hub}-vm" location = azurerm_resource_group.hub-vnet-rg.location resource_group_name = azurerm_resource_group.hub-vnet-rg.name network_interface_ids = [azurerm_network_interface.hub-nic.id] vm_size = var.vmsize storage_image_reference { publisher = "Canonical" offer = "UbuntuServer" sku = "16.04-LTS" version = "latest" } storage_os_disk { name = "myosdisk1" caching = "ReadWrite" create_option = "FromImage" managed_disk_type = "Standard_LRS" } os_profile { computer_name = "${local.prefix-hub}-vm" admin_username = var.username admin_password = var.password } os_profile_linux_config { disable_password_authentication = false } tags = { environment = local.prefix-hub } } # Virtual Network Gateway resource "azurerm_public_ip" "hub-vpn-gateway1-pip" { name = "hub-vpn-gateway1-pip" location = azurerm_resource_group.hub-vnet-rg.location resource_group_name = azurerm_resource_group.hub-vnet-rg.name allocation_method = "Dynamic" } resource "azurerm_virtual_network_gateway" "hub-vnet-gateway" { name = "hub-vpn-gateway1" location = azurerm_resource_group.hub-vnet-rg.location resource_group_name = azurerm_resource_group.hub-vnet-rg.name type = "Vpn" vpn_type = "RouteBased" active_active = false enable_bgp = false sku = "VpnGw1" ip_configuration { name = "vnetGatewayConfig" public_ip_address_id = azurerm_public_ip.hub-vpn-gateway1-pip.id private_ip_address_allocation = "Dynamic" subnet_id = azurerm_subnet.hub-gateway-subnet.id } depends_on = [azurerm_public_ip.hub-vpn-gateway1-pip] } resource "azurerm_virtual_network_gateway_connection" "hub-onprem-conn" { name = "hub-onprem-conn" location = azurerm_resource_group.hub-vnet-rg.location resource_group_name = azurerm_resource_group.hub-vnet-rg.name type = "Vnet2Vnet" routing_weight = 1 virtual_network_gateway_id = azurerm_virtual_network_gateway.hub-vnet-gateway.id peer_virtual_network_gateway_id = azurerm_virtual_network_gateway.onprem-vpn-gateway.id shared_key = local.shared-key } resource "azurerm_virtual_network_gateway_connection" "onprem-hub-conn" { name = "onprem-hub-conn" location = azurerm_resource_group.onprem-vnet-rg.location resource_group_name = azurerm_resource_group.onprem-vnet-rg.name type = "Vnet2Vnet" routing_weight = 1 virtual_network_gateway_id = azurerm_virtual_network_gateway.onprem-vpn-gateway.id peer_virtual_network_gateway_id = azurerm_virtual_network_gateway.hub-vnet-gateway.id shared_key = local.shared-key }
對 Azure 上的 Terraform 進行疑難排解
針對在 Azure 上使用 Terraform 時的常見問題進行疑難排解
下一步
意見反應
https://aka.ms/ContentUserFeedback。
即將登場:在 2024 年,我們將逐步淘汰 GitHub 問題作為內容的意見反應機制,並將它取代為新的意見反應系統。 如需詳細資訊,請參閱:提交並檢視相關的意見反應