You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: integrations/terraform-modules/teleport/discovery/azure/README.md
+44-32Lines changed: 44 additions & 32 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
3
3
This Terraform module creates the Azure and Teleport cluster resources necessary for a Teleport cluster to discover Azure virtual machines:
4
4
5
-
-**Azure user-assigned managed identity**: Used by the Teleport Discovery Service to authenticate to Azure APIs for scanning and managing VMs in the specified resource groups.
5
+
-**Azure user-assigned managed identity**: Used by the Teleport Discovery Service to authenticate to Azure APIs for scanning and managing VMs in matching Azure resource groups.
6
6
-**Azure federated identity credential**: Establishes trust between Azure and your Teleport cluster by allowing the managed identity to authenticate using OIDC tokens issued by your Teleport proxy.
7
7
-**Azure custom role definition and assignment**: Grants the managed identity the minimum required permissions to discover VMs and run installation commands on them.
8
8
-**Teleport `discovery_config` cluster resource**: Configures the discovery parameters (subscriptions, resource groups, tags) that determine which Azure VMs will be discovered and enrolled.
@@ -12,7 +12,7 @@ This Terraform module creates the Azure and Teleport cluster resources necessary
-Every Azure VM to be discovered must have a managed identity assigned to it with at least the Microsoft.Compute/virtualMachines/read permission. [Read more](https://goteleport.com/docs/enroll-resources/auto-discovery/servers/azure-discovery/#step-35-set-up-managed-identities-for-discovered-nodes)
15
+
- Every Azure VM to be discovered must have a managed identity assigned to it with at least the Microsoft.Compute/virtualMachines/read permission. [Read more](https://goteleport.com/docs/enroll-resources/auto-discovery/servers/azure-discovery/#step-35-set-up-managed-identities-for-discovered-nodes)
16
16
17
17
## Examples
18
18
@@ -29,16 +29,18 @@ For bugs related to this code, please [open an issue](https://github.com/gravita
| <aname="input_discovery_group_name"></a> [discovery_group_name](#input_discovery_group_name)| Teleport discovery group name. |`string`|`"cloud-discovery-group"`| no |
64
-
| <aname="input_discovery_resource_group_names"></a> [discovery_resource_group_names](#input_discovery_resource_group_names)| Resource groups to scan for VMs. |`list(string)`| n/a | yes |
65
-
| <aname="input_discovery_tags"></a> [discovery_tags](#input_discovery_tags)| Tag filters for VM discovery; matches VMs with these tags. |`map(list(string))`| <pre>{<br/> "*": [<br/> "*"<br/> ]<br/>}</pre> | no |
66
-
| <aname="input_identity_resource_group_name"></a> [identity_resource_group_name](#input_identity_resource_group_name)| Resource group to place identity resources; defaults to first discovery RG when empty. |`string`|`""`| no |
67
-
| <aname="input_integration_name_override"></a> [integration_name_override](#input_integration_name_override)| Override for Teleport integration name; empty to derive from prefix. |`string`|`""`| no |
68
-
| <aname="input_installer_script_name"></a> [installer_script_name](#input_installer_script_name)| Name of the Teleport installer script to use. |`string`|`"default-installer"`| no |
69
-
| <aname="input_prefix"></a> [prefix](#input_prefix)| Name prefix for created resources. |`string`|`"teleport"`| no |
| <aname="input_token_name_override"></a> [token_name_override](#input_token_name_override)| Override for Teleport provision token name; empty to derive from prefix. |`string`|`""`| no |
67
+
| <aname="input_apply_azure_tags"></a> [apply\_azure\_tags](#input\_apply\_azure\_tags)| Additional Azure tags to apply to all created Azure resources. |`map(string)`|`{}`| no |
68
+
| <aname="input_apply_teleport_resource_labels"></a> [apply\_teleport\_resource\_labels](#input\_apply\_teleport\_resource\_labels)| Additional Teleport resource labels to apply to all created Teleport resources. |`map(string)`|`{}`| no |
69
+
| <aname="input_azure_federated_identity_credential_name"></a> [azure\_federated\_identity\_credential\_name](#input\_azure\_federated\_identity\_credential\_name)| Name of the Azure federated identity credential created for workload identity federation. |`string`|`"teleport-federation"`| no |
70
+
| <aname="input_azure_managed_identity_location"></a> [azure\_managed\_identity\_location](#input\_azure\_managed\_identity\_location)| Azure region (location) where the managed identity will be created (e.g., "westus"). |`string`| n/a | yes |
71
+
| <aname="input_azure_managed_identity_name"></a> [azure\_managed\_identity\_name](#input\_azure\_managed\_identity\_name)| Name of the Azure user-assigned managed identity created for Teleport Discovery. |`string`|`"discovery-identity"`| no |
72
+
| <aname="input_azure_resource_group_name"></a> [azure\_resource\_group\_name](#input\_azure\_resource\_group\_name)| Name of an existing Azure Resource Group where Azure resources will be created. |`string`| n/a | yes |
73
+
| <aname="input_azure_role_definition_name"></a> [azure\_role\_definition\_name](#input\_azure\_role\_definition\_name)| Name for the Azure custom role definition created for Teleport Discovery. |`string`|`"teleport-discovery"`| no |
74
+
| <aname="input_create"></a> [create](#input\_create)| Toggle creation of all resources. |`bool`|`true`| no |
75
+
| <aname="input_match_azure_regions"></a> [match\_azure\_regions](#input\_match\_azure\_regions)| Azure regions to discover. Defaults to ["*"] which matches all regions. Region names should be the programmatic region name, e.g., "westus". |`list(string)`| <pre>[<br/> "*"<br/>]</pre> | no |
76
+
| <aname="input_match_azure_resource_groups"></a> [match\_azure\_resource\_groups](#input\_match\_azure\_resource\_groups)| Azure resource groups to scan for VMs. Defaults to ["*"] which matches all resource groups. |`list(string)`| <pre>[<br/> "*"<br/>]</pre> | no |
77
+
| <aname="input_match_azure_tags"></a> [match\_azure\_tags](#input\_match\_azure\_tags)| Tag filters for VM discovery; matches VMs with these tags. Defaults to {"*" = ["*"]} which matches all tags. |`map(list(string))`| <pre>{<br/> "*": [<br/> "*"<br/> ]<br/>}</pre> | no |
78
+
| <aname="input_teleport_discovery_config_name"></a> [teleport\_discovery\_config\_name](#input\_teleport\_discovery\_config\_name)| Name for the `teleport_discovery_config` resource. |`string`|`"discovery"`| no |
79
+
| <aname="input_teleport_discovery_config_use_name_prefix"></a> [teleport\_discovery\_config\_use\_name\_prefix](#input\_teleport\_discovery\_config\_use\_name\_prefix)| Whether `teleport_discovery_config_name` is used as a name prefix (true) or as the exact name (false). |`bool`|`true`| no |
80
+
| <aname="input_teleport_discovery_group_name"></a> [teleport\_discovery\_group\_name](#input\_teleport\_discovery\_group\_name)| Teleport discovery group to use. For discovery configuration to apply, this name must match at least one Teleport Discovery Service instance's configured `discovery_group`. For Teleport Cloud clusters, use "cloud-discovery-group". |`string`| n/a | yes |
81
+
| <aname="input_teleport_installer_script_name"></a> [teleport\_installer\_script\_name](#input\_teleport\_installer\_script\_name)| Name of an existing Teleport installer script to use. |`string`|`"default-installer"`| no |
82
+
| <aname="input_teleport_integration_name"></a> [teleport\_integration\_name](#input\_teleport\_integration\_name)| Name for the `teleport_integration` resource. |`string`|`"discovery"`| no |
83
+
| <aname="input_teleport_integration_use_name_prefix"></a> [teleport\_integration\_use\_name\_prefix](#input\_teleport\_integration\_use\_name\_prefix)| Whether `teleport_integration_name` is used as a name prefix (true) or as the exact name (false). |`bool`|`true`| no |
84
+
| <aname="input_teleport_provision_token_name"></a> [teleport\_provision\_token\_name](#input\_teleport\_provision\_token\_name)| Name for the `teleport_provision_token` resource. |`string`|`"discovery"`| no |
85
+
| <aname="input_teleport_provision_token_use_name_prefix"></a> [teleport\_provision\_token\_use\_name\_prefix](#input\_teleport\_provision\_token\_use\_name\_prefix)| Whether `teleport_provision_token_name` is used as a name prefix (true) or as the exact name (false). |`bool`|`true`| no |
86
+
| <aname="input_teleport_proxy_public_addr"></a> [teleport\_proxy\_public\_addr](#input\_teleport\_proxy\_public\_addr)| Teleport cluster proxy public address in the form <host:port> (no URL scheme). |`string`| n/a | yes |
76
87
77
88
## Outputs
78
89
79
90
| Name | Description |
80
91
|------|-------------|
81
-
| <aname="output_client_id"></a> [client_id](#output_client_id)| Client ID used by the Teleport Azure OIDC integration. |
| <aname="output_principal_id"></a> [principal_id](#output_principal_id)| Principal ID used for role assignment. |
85
-
| <aname="output_role_assignment_id"></a> [role_assignment_id](#output_role_assignment_id)| ID of the role assignment granting discovery permissions. |
86
-
| <aname="output_role_definition_id"></a> [role_definition_id](#output_role_definition_id)| ID of the custom role definition. |
| <aname="output_azure_managed_identity_client_id"></a> [azure\_managed\_identity\_client\_id](#output\_azure\_managed\_identity\_client\_id)| Client ID used by the Teleport Azure OIDC integration. |
| <aname="output_azure_managed_identity_principal_id"></a> [azure\_managed\_identity\_principal\_id](#output\_azure\_managed\_identity\_principal\_id)| Principal ID used for role assignment. |
95
+
| <aname="output_azure_role_assignment_id"></a> [azure\_role\_assignment\_id](#output\_azure\_role\_assignment\_id)| ID of the role assignment granting discovery permissions. |
96
+
| <aname="output_azure_role_definition_id"></a> [azure\_role\_definition\_id](#output\_azure\_role\_definition\_id)| ID of the discovery role definition. |
97
+
| <aname="output_teleport_discovery_config_name"></a> [teleport\_discovery\_config\_name](#output\_teleport\_discovery\_config\_name)| Name of the Teleport dynamic `discovery_config`. Configuration details can be viewed with `tctl get discovery_config/<name>`. Teleport Discovery Service instances will use this `discovery_config` if they are in the same discovery group as the `discovery_config`. |
98
+
| <aname="output_teleport_integration_name"></a> [teleport\_integration\_name](#output\_teleport\_integration\_name)| Name of the Teleport `integration` resource. The integration resource configures Teleport Discovery Service instances to assume an Azure managed identity for discovery using Azure OIDC federation. Integration details can be viewed with `tctl get integrations/<name>` or by visiting the Teleport web UI under 'Zero Trust Access' > 'Integrations'. |
99
+
| <aname="output_teleport_provision_token_name"></a> [teleport\_provision\_token\_name](#output\_teleport\_provision\_token\_name)| Name of the Teleport provision `token` that allows Teleport nodes to join the Teleport cluster using Azure credentials. Token details can be viewed with `tctl get token/<name>`. |
0 commit comments