Add terraform module for azure auto discovery by avatus · Pull Request #62145 · gravitational/teleport

avatus · 2025-12-10T20:45:54Z

This will add a terraform module that will support the automatic discovery of VMs in azure, using an OIDC integration.

Closes #60818

Changelog: Added a terraform module to support automatic discovery of azure resources.

examples/terraform-modules/teleport-azure-discovery/main.tf

Tener · 2025-12-11T12:29:08Z

examples/terraform-modules/teleport-azure-discovery/README.md

+- Azure user-assigned managed identity for Teleport Discovery Service to use.
+- Azure federated identity credential that trusts the Teleport proxy as an issuer.
+- Azure custom role definition and assignment that grant the minimum VM discovery and install permissions.
+- Teleport `discovery_config` cluster resource that configures Teleport for Azure VM discovery.
+- Teleport `integration` cluster resource for Azure OIDC.
+- Teleport `token` cluster resource that allows Teleport nodes to join the cluster using Azure credentials.


I'd add short explanation how each of those resources will be used. For example, we say that we need user-assigned managed identity for Discovery Service, but we are not explaining how will that account be used exactly.

Having the purpose explained helps to ensure proper understanding.

hugoShaka

I'm no Terraform expert but this looks ok.

Can we make sure that:

this code is linted with tf lint and the CI enforces it
there is a clear owner of the module and it is covered by the test plan

We had other TF modules in the past that went unmainted and I had to remove. My main concern is that this does not follow the same path. I'd like us to ensure the same quality/support level as the go code we write.

examples/terraform-modules/teleport-azure-discovery/examples/single-subscription/main.tf

avatus · 2025-12-16T18:35:29Z

@hugoShaka agreed.

this code is linted with tf lint and the CI enforces it

i believe this is enforced with tflint because it was throwing errors already until i fixed them. so we're good there

there is a clear owner of the module and it is covered by the test plan

i like this callout. im happy to be the owner, but im unsure where to specify it. i will update the testplan as well.

This will add a terraform module that will support the automatic discovery of VMs in azure, using an OIDC integration. Closes #60818 Changelog: Added a terraform module to support automatic discovery of azure resources.

- align variable names - conditional creation - remove all inputs from the example

greedy52

any plan to support non-integration discovery?

greedy52 · 2026-01-26T18:55:56Z

integrations/terraform-modules/teleport/discovery/azure/examples/single-subscription/main.tf

+  # optional
+  match_azure_regions         = ["westus", "eastus"] // discover VMs in these US west and east regions.
+  match_azure_resource_groups = ["*"]                // discover VMs in all resource groups
+  match_azure_tags            = { "env" = ["example"] }


nit: add a comment on match_azure_tags.

greedy52 · 2026-01-26T18:56:30Z

integrations/terraform-modules/teleport/discovery/azure/examples/single-subscription/main.tf

+  azure_managed_identity_location = azurerm_resource_group.example.location
+  azure_resource_group_name       = azurerm_resource_group.example.name


nit: not very obvious what these two variables will be used for.

greedy52 · 2026-01-26T18:58:07Z

integrations/terraform-modules/teleport/discovery/azure/azure_role_definition.tf

+# Custom role for discovery permissions
+resource "azurerm_role_definition" "teleport_discovery" {


is this the resource preventing support for multi subscriptions? this is fine for now but i think we will eventually revisit this when working on "org" level discovery for azure.

greedy52 · 2026-01-26T19:03:52Z

integrations/terraform-modules/teleport/discovery/azure/teleport_provision_token.tf

+  spec = {
+    azure = {
+      allow = [{
+        subscription = local.azure_subscription_id


should we set resource group?

I don't think so, because the VMs we discover won't necessarily be in the same resource group as the identity/role for discovery service

how about match_azure_resource_groups?

hmm. I guess we can use that, but it will require a code change because discovery supports wildcard resource group matcher and join tokens do not

greedy52 · 2026-03-06T14:36:42Z

could we provide a manual test plan for this PR? @GavinFrazar do you prefer updating this one or maybe opening a new PR as you?

GavinFrazar · 2026-03-09T18:51:47Z

could we provide a manual test plan for this PR? @GavinFrazar do you prefer updating this one or maybe opening a new PR as you?

I'll provide a manual test plan and keep updating this PR

Remove unsupported argument "resource_group_name".

It's not useful to output this.

This permission will be used by: 1. discovery service to perform wildcard subscription discovery 2. auth service to perform wildcard subscription VM join validation

It's so cheap to read the data source that we don't need to make it conditional and it improves the terraform plan.

In order to discover VMs in all subscriptions, the module must allow the user to configure the role and role assignment scopes. Additionally, the module must allow the user to specify the subscription(s) which should be discovered.

avatus requested review from GavinFrazar, Tener and hugoShaka December 10, 2025 20:45

github-actions bot added the size/md label Dec 10, 2025

github-actions bot requested review from espadolini and flyinghermit December 10, 2025 20:46

avatus requested review from greedy52 and removed request for espadolini and flyinghermit December 10, 2025 20:46

avatus force-pushed the avatus/azuremodule branch from 3f101f4 to 082b786 Compare December 10, 2025 23:28

Tener reviewed Dec 11, 2025

View reviewed changes

avatus force-pushed the avatus/azuremodule branch from 082b786 to c91ce19 Compare December 15, 2025 21:47

r0mant mentioned this pull request Dec 15, 2025

Docs for Azure discovery with terraform #62277

Open

avatus requested a review from Tener December 15, 2025 22:20

hugoShaka reviewed Dec 16, 2025

View reviewed changes

greedy52 reviewed Dec 16, 2025

View reviewed changes

examples/terraform-modules/teleport-azure-discovery/examples/single-subscription/main.tf Outdated Show resolved Hide resolved

examples/terraform-modules/teleport-azure-discovery/examples/single-subscription/main.tf Outdated Show resolved Hide resolved

avatus mentioned this pull request Dec 29, 2025

Add IaC label and usertasks to integration stats #62518

Merged

GavinFrazar self-assigned this Jan 23, 2026

Add terraform module for azure auto discovery

1788737

This will add a terraform module that will support the automatic discovery of VMs in azure, using an OIDC integration. Closes #60818 Changelog: Added a terraform module to support automatic discovery of azure resources.

GavinFrazar force-pushed the avatus/azuremodule branch from b7cc782 to fe94eda Compare January 23, 2026 03:52

GavinFrazar added 3 commits January 22, 2026 19:56

Move Azure module into published TF modules dir

1fbef08

Add license

80f0358

Refactor module

94961ae

- align variable names - conditional creation - remove all inputs from the example

GavinFrazar force-pushed the avatus/azuremodule branch from fe94eda to 94961ae Compare January 23, 2026 03:56

greedy52 added the terraform-modules Terraform modules published to Teleport's registry label Jan 26, 2026

greedy52 approved these changes Jan 26, 2026

View reviewed changes

GavinFrazar added backport/branch/v18 azure discovery labels Feb 4, 2026

greedy52 requested review from greedy52 and hugoShaka March 6, 2026 14:26

r0mant assigned alexhemard and unassigned GavinFrazar Mar 12, 2026

GavinFrazar added 7 commits March 12, 2026 18:19

Fix azurerm_federated_identity_credential

cd29995

Remove unsupported argument "resource_group_name".

Remove role assignment output

910352d

It's not useful to output this.

Sort role definition permissions

e94f2d9

Add subscriptions/read permission to oidc role

c944d90

This permission will be used by: 1. discovery service to perform wildcard subscription discovery 2. auth service to perform wildcard subscription VM join validation

Simplify client config data source

11b7706

It's so cheap to read the data source that we don't need to make it conditional and it improves the terraform plan.

Add support to match wildcard Azure subscriptions

09296f6

In order to discover VMs in all subscriptions, the module must allow the user to configure the role and role assignment scopes. Additionally, the module must allow the user to specify the subscription(s) which should be discovered.

make docs

43c493f

		azure_managed_identity_location = azurerm_resource_group.example.location
		azure_resource_group_name = azurerm_resource_group.example.name

		# Custom role for discovery permissions
		resource "azurerm_role_definition" "teleport_discovery" {

Conversation

avatus commented Dec 10, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Tener Dec 11, 2025

Choose a reason for hiding this comment

Uh oh!

hugoShaka left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

avatus commented Dec 16, 2025

Uh oh!

greedy52 left a comment

Choose a reason for hiding this comment

Uh oh!

greedy52 Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

greedy52 Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

greedy52 Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

greedy52 Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

GavinFrazar Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

greedy52 Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

GavinFrazar Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

greedy52 commented Mar 6, 2026

Uh oh!

GavinFrazar commented Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

greedy52 Jan 26, 2026 •

edited

Loading

GavinFrazar Jan 26, 2026 •

edited

Loading