Merge branch 'jamesianberry-master'

azure-py-virtual-data-center/.gitignore

@@ -0,0 +1,3 @@
+*.pyc
+venv/
+__pycache__

azure-py-virtual-data-center/Pulumi.yaml

@@ -0,0 +1,49 @@
+name: azure-py-vdc
+runtime: python
+description: A minimal Azure Virtual Data Center described in Python
+template:
+ config:
+ azure:environment:
+ description: Azure environment to use (`public`, `usgovernment`, `german`, `china`)
+ default: public
+ azure:location:
+ description: Azure region to use (e.g. `australiaeast` or `australiasoutheast`)
+ default: australiasoutheast
+ azure-py-vdc:dmz_ar:
+ description: Address range for hub DMZ subnet (must be within fwz_as)
+ default: 192.168.100.128/25
+ azure-py-vdc:fwm_ar:
+ description: Address range for hub AzureFirewallManagementSubnet (optional - /26 within fwz_as)
+ azure-py-vdc:fws_ar:
+ description: Address range for hub AzureFirewallSubnet (/26 within fwz_as)
+ default: 192.168.100.0/26
+ azure-py-vdc:fwz_as:
+ description: Address space for hub containing dmz_ar, fwm_ar (optional) and fws_ar
+ default: 192.168.100.0/24
+ azure-py-vdc:gws_ar:
+ description: Address range for hub GatewaySubnet (/27 or larger within hub_as)
+ default: 10.100.0.0/26
+ azure-py-vdc:hbs_ar:
+ description: Address range for hub AzureBastionSubnet (optional - /27 within hub_as)
+ azure-py-vdc:hub_ar:
+ description: Address range for starting subnet in the hub (optional - within hub_as)
+ azure-py-vdc:hub_as:
+ description: Address space for hub containing hbs_ar, hub_ar and remaining subnets
+ default: 10.100.0.0/16
+ azure-py-vdc:hub_stem:
+ description: Short name for the hub that will appear in resource names (<4 chars)
+ default: hub
+ azure-py-vdc:org:
+ description: Pulumi organization in which this project resides (from app.pulumi.com)
+ azure-py-vdc:peer:
+ description: Another stack in same organization and project to peer hubs with (optional)
+ azure-py-vdc:sbs_ar:
+ description: Address range for spoke AzureBastionSubnet (optional - /27 within spoke_as)
+ azure-py-vdc:spoke_ar:
+ description: Address range for starting subnet in the spoke (optional - within spoke_as)
+ azure-py-vdc:spoke_as:
+ description: Address space for spoke containing sbs_ar, spoke_ar and remaining subnets
+ default: 10.101.0.0/16
+ azure-py-vdc:spoke_stem:
+ description: Short name for spoke that will appear in resource names (<6 chars)
+ default: spoke

azure-py-virtual-data-center/README.md

@@ -0,0 +1,217 @@
+[![Deploy](https://get.pulumi.com/new/button.svg)](https://app.pulumi.com/new)
+
+# Azure Virtual Data Center (VDC)
+
+This example deploys an Azure Virtual Data Center (VDC) hub-and-spoke network stack in Azure, complete with ExpressRoute and VPN Gateways, Azure Firewall (with provision for forced tunnelling) guarding a DMZ, and provision for Azure Bastion. Shared services may have their own subnets in the hub, and multiple spokes may be managed with subnets for applications and environments.
+
+This all works using custom routing to redirect all traffic to and from Azure VNets, as well as all traffic to, within and from the DMZ, through the firewall (which scales out as a service). Traffic between ordinary subnets in the hub and spokes is not redirected through the firewall, and should instead be controlled using Network Security Groups (not yet implemented). Firewall rules are required to allow traffic through (not yet implemented).
+
+The intention is for matching stacks to be deployed in Azure [paired regions](https://docs.microsoft.com/en-us/azure/best-practices-availability-paired-regions), configured as either Production/Disaster Recovery or High Availability (or both for different applications). Global VNet Peering between the hubs connects the separate stacks into one symmetric network.
+
+Although the VDC pattern is in widespread use, Azure now offers a managed service intended to replace it, comprising Virtual Hub and SD-WAN components, with a [migration plan](https://docs.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology) that illustrates the differences between the two patterns. But if you want or need to manage your own network infrastructure, VDC is still relevant.
+
+This example uses `pulumi.ComponentResource` as described [here](https://www.pulumi.com/docs/intro/concepts/programming-model/#components) which demonstrates how multiple low-level resources can be composed into a higher-level, reusable abstraction. It also demonstrates use of `pulumi.StackReference` as described [here](https://www.pulumi.com/docs/intro/concepts/organizing-stacks-projects/#inter-stack-dependencies) to relate multiple stacks.
+
+## Prerequisites
+
+1. [Install Pulumi](https://www.pulumi.com/docs/get-started/install/)
+1. [Configure Pulumi for Azure](https://www.pulumi.com/docs/intro/cloud-providers/azure/setup/)
+1. [Configure Pulumi for Python](https://www.pulumi.com/docs/intro/languages/python/)
+
+# Running the Example
+
+After cloning this repo, `cd` into the `azure-py-virtual-data-center` directory and run the following commands.
+
+1. (recommended) Create a Python virtualenv, activate it, and install the dependent packages [needed](https://www.pulumi.com/docs/intro/concepts/how-pulumi-works/) for our Pulumi program:
+
+ ```
+ $ python3 -m venv venv
+ $ source venv/bin/activate
+ $ pip3 install -r requirements.txt
+ ```
+
+1. Create a new stack intended for Production (for example's sake):
+
+ ```bash
+ $ pulumi stack init prod
+ ```
+
+ This will appear within your Pulumi organization under the `azure-py-vdc` project (as specified in `Pulumi.yaml`).
+
+1. Set the configuration variables for this stack to suit yourself, following guidance in `Pulumi.yaml`. This will create a new `Pulumi.prod.yaml` file (named after the stack) in which to store them:
+
+ Required:
+ ```bash
+ $ pulumi config set azure:environment public
+ $ pulumi config set azure:location australiasoutheast
+ $ pulumi config set dmz_ar 192.168.100.128/25
+ $ pulumi config set fws_ar 192.168.100.0/26
+ $ pulumi config set fwz_as 192.168.100.0/24
+ $ pulumi config set gws_ar 10.100.0.0/26
+ $ pulumi config set hub_as 10.100.0.0/16
+ $ pulumi config set hub_stem hub
+ $ pulumi config set spoke_as 10.101.0.0/16
+ $ pulumi config set spoke_stem spoke
+ ```
+ Optional:
+ ```bash
+ $ pulumi config set fwm_ar 192.168.100.64/26
+ $ pulumi config set hbs_ar 10.100.0.64/27
+ $ pulumi config set hub_ar 10.100.1.0/24
+ $ pulumi config set sbs_ar 10.101.0.0/27
+ $ pulumi config set spoke_ar 10.101.1.0/24
+ ```
+
+1. Deploy the `prod` stack with the `pulumi up` command. This may take up to an hour to provision all the Azure resources specified, including gateways and firewall:
+
+ ```bash
+ $ pulumi up
+ ```
+
+1. After a while, your Production stack will be ready.
+
+ ```bash
+ Updating (prod):
+ Type Name Status
+ + pulumi:pulumi:Stack azure-py-vdc-prod creating..
+ + ├─ vdc:network:Hub hub creating..
+ + │ ├─ azure:network:VirtualNetwork hub-vn- created
+ + │ ├─ azure:network:PublicIp hub-vpn-gw-pip- created
+ + │ ├─ azure:network:PublicIp hub-er-gw-pip- created
+ + │ ├─ azure:network:PublicIp hub-fw-pip- created
+ + │ ├─ azure:network:Subnet hub-dmz-sn created
+ + │ ├─ azure:network:Subnet hub-fw-sn created
+ + │ ├─ azure:network:Subnet hub-fwm-sn created
+ + │ ├─ azure:network:Subnet hub-ab-sn created
+ + │ ├─ azure:network:Subnet hub-gw-sn created
+ + │ ├─ azure:network:VirtualNetworkGateway hub-vpn-gw- created
+ + │ ├─ azure:network:Firewall hub-fw- created
+ + │ ├─ azure:network:VirtualNetworkGateway hub-er-gw- created
+ + │ ├─ azure:network:RouteTable hub-gw-rt- created
+ + │ ├─ azure:network:RouteTable hub-sn-rt- created
+ + │ ├─ azure:network:RouteTable hub-dmz-rt- created
+ + │ ├─ azure:network:Route gw-gw-r- created
+ + │ ├─ azure:network:SubnetRouteTableAssociation hub-gw-sn-rta created
+ + │ ├─ azure:network:Route gw-dmz-r- created
+ + │ ├─ azure:network:Route gw-hub-r- created
+ + │ ├─ azure:network:Route sn-dg-r- created
+ + │ ├─ azure:network:Route sn-dmz-r- created
+ + │ ├─ azure:network:Route sn-gw-r- created
+ + │ ├─ azure:network:Subnet hub-example-sn- created
+ + │ ├─ azure:network:SubnetRouteTableAssociation hub-dmz-sn-rta created
+ + │ ├─ azure:network:Route dmz-dg-r- created
+ + │ ├─ azure:network:Route dmz-dmz-r- created
+ + │ ├─ azure:network:Route dmz-hub-r- created
+ + │ └─ azure:network:SubnetRouteTableAssociation hub-example-sn-rta created
+ + ├─ azure:core:ResourceGroup prod-vdc-rg- created
+ + └─ vdc:network:Spoke spoke created
+ + ├─ azure:network:VirtualNetwork spoke-vn- created
+ + ├─ azure:network:Route gw-spoke-r- created
+ + ├─ azure:network:Route sn-spoke-r- created
+ + ├─ azure:network:Route dmz-spoke-r- created
+ + ├─ azure:network:Subnet spoke-ab-sn created
+ + ├─ azure:network:VirtualNetworkPeering spoke-hub-vnp- created
+ + ├─ azure:network:VirtualNetworkPeering hub-spoke-vnp- created
+ + ├─ azure:network:RouteTable spoke-sn-rt- created
+ + ├─ azure:network:Route spoke-dg-r- created
+ + ├─ azure:network:Route spoke-dmz-r- created
+ + ├─ azure:network:Subnet spoke-example-sn- created
+ + ├─ azure:network:Route spoke-hub-r- created
+ + └─ azure:network:SubnetRouteTableAssociation spoke-example-sn-rta created
+
+ Outputs:
+ dmz_ar : "192.168.100.128/25"
+ hub_as : "10.100.0.0/16"
+ hub_fw_ip : "192.168.100.4"
+ hub_id : "/subscriptions/subscription/resourceGroups/prod-vdc-rg-6ecb23ab/providers/Microsoft.Network/virtualNetworks/hub-vn-b007c91b"
+ hub_name : "hub-vn-b007c91b"
+ spoke_id : "/subscriptions/subscription/resourceGroups/prod-vdc-rg-6ecb23ab/providers/Microsoft.Network/virtualNetworks/spoke-vn-d69aa6c4"
+ spoke_name : "spoke-vn-d69aa6c4"
+
+ Resources:
+ + 45 created
+
+ Duration: 48m7s
+
+ Permalink: https://app.pulumi.com/organization/azure-py-vdc/prod/updates/1
+ ```
+
+ Feel free to modify your program, and then run `pulumi up` again. Pulumi automatically detects differences and makes the minimal changes necessary to achieved the desired state. If any changes to resources are made outside of Pulumi, you should first do a `pulumi refresh` so that Pulumi can discover the actual situation, and then `pulumi up` to return to desired state.
+
+ Note that because most resources are [auto-named](https://www.pulumi.com/docs/intro/concepts/programming-model/#autonaming), you see trailing dashes above which will actually be followed by random suffixes that you can see in the Outputs and in Azure.
+
+1. Create another new stack intended for Disaster Recovery (following the example):
+
+ ```bash
+ $ pulumi stack init dr
+ ```
+
+ This will also appear within your Pulumi organization under the `azure-py-vdc` project (as specified in `Pulumi.yaml`).
+
+1. Set the configuration variables for this stack which will be stored in a new `Pulumi.dr.yaml` file (change the values below to suit yourself):
+
+ Required:
+ ```bash
+ $ pulumi config set azure:environment public
+ $ pulumi config set azure:location australiaeast
+ $ pulumi config set dmz_ar 192.168.200.128/25
+ $ pulumi config set fws_ar 192.168.200.0/26
+ $ pulumi config set fwz_as 192.168.200.0/24
+ $ pulumi config set gws_ar 10.200.0.0/26
+ $ pulumi config set hub_as 10.200.0.0/16
+ $ pulumi config set hub_stem hub
+ $ pulumi config set spoke_as 10.201.0.0/16
+ $ pulumi config set spoke_stem spoke
+ ```
+ Optional:
+ ```bash
+ $ pulumi config set fwm_ar 192.168.200.64/26
+ $ pulumi config set hbs_ar 10.200.0.64/27
+ $ pulumi config set hub_ar 10.200.1.0/24
+ $ pulumi config set sbs_ar 10.201.0.0/27
+ $ pulumi config set spoke_ar 10.201.1.0/24
+ ```
+
+1. Deploy the `dr` stack with the `pulumi up` command. Once again, this may take up to an hour to provision all the Azure resources specified, including gateways and firewall:
+
+ ```bash
+ $ pulumi up
+ ```
+
+1. Once you have both Production and Disaster Recovery stacks (ideally in paired regions), you can connect their hubs using Global (if in different regions) VNet Peering:
+
+ ```bash
+ $ pulumi stack select prod
+ $ pulumi config set org <your Pulumi organization>
+ $ pulumi config set peer dr
+ $ pulumi up
+ $ pulumi stack select dr
+ $ pulumi config set org <your Pulumi organization>
+ $ pulumi config set peer prod
+ $ pulumi up
+ ```
+ Note: it isn't yet [possible](https://github.com/pulumi/pulumi/issues/2800) to discover the Pulumi organization from within the program, which is why you need to set the `org` configuration variable for each stack that needs to peer with another stack.
+
+ If you later destroy a stack, you need to remove the corresponding `peer` variable in the other stack and run `pulumi up`. If you want to tear down the peerings, you should remove the `peer` variables in both stacks and run `pulumi up`:
+
+ ```bash
+ $ pulumi stack select prod
+ $ pulumi config rm peer
+ $ pulumi up
+ $ pulumi stack select dr
+ $ pulumi config rm peer
+ $ pulumi up
+ ```
+
+ You need to remove both peerings before you can connect the hubs again.
+
+1. When you are finished experimenting, you can destroy all of the resources, and the stacks:
+
+ ```bash
+ $ pulumi stack select prod
+ $ pulumi destroy
+ $ pulumi stack rm
+ $ pulumi stack select dr
+ $ pulumi destroy
+ $ pulumi stack rm
+ ```

azure-py-virtual-data-center/__main__.py

@@ -0,0 +1,58 @@
+from pulumi import Config, get_stack, ResourceOptions, export
+from pulumi.resource import CustomTimeouts
+from pulumi_azure import core
+from hub import HubProps, Hub
+from spoke import SpokeProps, Spoke
+
+# retrieve the configuration data
+config = Config()
+
+# set default tags to be applied to all taggable resources
+stack = get_stack()
+default_tags = {
+ 'environment': stack
+}
+
+# all resources will be created in the Resource Group location
+resource_group = core.ResourceGroup(
+ stack + '-vdc-rg-',
+ tags = default_tags,
+)
+
+# Hub virtual network with gateway, firewall, DMZ and shared services subnets
+hub1 = Hub(
+ config.require('hub_stem'),
+ HubProps(
+ config = config,
+ resource_group = resource_group,
+ tags = default_tags,
+ stack = stack,
+ ),
+ opts=ResourceOptions(custom_timeouts=CustomTimeouts(create='1h', update='1h', delete='1h')),
+)
+
+# Spoke virtual network for application environments
+spoke1 = Spoke(
+ config.require('spoke_stem'),
+ SpokeProps(
+ config = config,
+ resource_group = resource_group,
+ tags = default_tags,
+ hub = hub1,
+ ),
+ opts=ResourceOptions(
+ depends_on=[hub1.hub_vpn_gw, hub1.hub_er_gw, hub1.hub_fw],
+ custom_timeouts=CustomTimeouts(create='1h'),
+ ),
+)
+
+# Exports
+export('dmz_ar', config.require('dmz_ar'))
+export('hub_as', config.require('hub_as'))
+export('hub_fw_ip', hub1.hub_fw_ip)
+export('hub_id', hub1.hub_id)
+export('hub_name', hub1.hub_name)
+export('hub_subnets', hub1.hub_subnets)
+export('spoke_id', spoke1.spoke_id)
+export('spoke_name', spoke1.spoke_name)
+export('spoke_subnets', spoke1.spoke_subnets)