feat: add azure example

docs/modules/ROOT/pages/tutorials/deploy_aks.adoc

@@ -1,3 +1,66 @@
 = Deployment On Azure AKS
 
-_Work In Progress_
+This tutorial shows how to deploy a DevOps Stack instance on Azure Cloud.
+
+== Prerequisites
+
+* Azure CLI installed (version ~>2)
+* An Azure account with an active subscription.
+* "Application Developer" Azure (Active Directory) AD role assignment on the Azure AD instance the subscription trusts.
+* "Owner" Azure role assignment on the subscription.
+
+== Login to Azure from CLI
+
+[source,bash]
+----
+az login
+az account set --subscription <subscriptionID>
+----
+
+== State file
+
+Throughout this tutorial, Terraform state file will be stored in an Azure Blob container of an Azure storage account. In order to do this, you need to create the remote state store first, so you'll work with a local state at the beginning.
+First, Terraform apply the content of the file state.tf to create the container, the storage account and the resource group the account belongs to.
+Once these resources created, you'll add the following block to terraform.tf and set the values from the previously created resources.
+
+[source,hcl]
+----
+terraform {
+  backend "azurerm" {
+    resource_group_name  = "<resourceGroupName>"
+    storage_account_name = "<storageAccountName>"
+    container_name       = "<containerName>"
+    key                  = "tfstate"
+  }
+  ...
+}
+----
+
+Then, Terraform apply and you'll be prompted to migrate the statefile, type yes.
+
+== DNS
+
+Since Azure can't be used to buy a domain name, you need to create a DNS zone in the suscription for managing DNS records (next step) and have a https://learn.microsoft.com/en-us/azure/dns/dns-domain-delegation[delegation] set up.
+
+== Provisions and cluster
+
+Before deploying the DevOps stack components, create all the resources these components require.
+Comment the content of stack.tf (where DevOps Stack modules are declared) and Terraform apply.
+
+== Stack
+
+Terraform apply stack.tf
+
+== Login to ArgoCD
+
+Use `argocd_url` output to login to ArgoCD UI.
+Before you login using OIDC, make sure you assign yourself ArgoCD App admin role. The following steps allow to do so:
+
+* Login to Azure portal and go to Azure Active Directory
+* In the menu on the left, click `Enterprise applications`
+* Select your application and go to `Users and groups`
+* Add yourself as a user with `ArgoCD Administrator` role
+
+== k9s/kubectl
+
+To use kubectl, you need to login to Azure from CLI and select your subscription.

examples/aks/.terraform-version

@@ -0,0 +1 @@
+1.3.6

examples/aks/application.tf

@@ -0,0 +1,54 @@
+resource "azuread_application" "this" {
+  display_name = format("devops-stack-apps-%s", local.platform_name)
+
+  required_resource_access {
+    resource_app_id = "00000003-0000-0000-c000-000000000000"
+
+    resource_access {
+      id   = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"
+      type = "Scope"
+    }
+  }
+
+  optional_claims {
+    access_token {
+      additional_properties = []
+      essential             = false
+      name                  = "groups"
+    }
+    id_token {
+      additional_properties = []
+      essential             = false
+      name                  = "groups"
+    }
+  }
+
+  web {
+    redirect_uris = [
+      format("https://argocd.apps.%s.%s/auth/callback", local.cluster_name, azurerm_dns_zone.this.name),
+      format("https://grafana.apps.%s.%s/login/generic_oauth", local.cluster_name, azurerm_dns_zone.this.name),
+      format("https://prometheus.apps.%s.%s/oauth2/callback", local.cluster_name, azurerm_dns_zone.this.name),
+      format("https://alertmanager.apps.%s.%s/oauth2/callback", local.cluster_name, azurerm_dns_zone.this.name),
+      format("https://thanos-bucketweb.apps.%s.%s/oauth2/callback", local.cluster_name, azurerm_dns_zone.this.name),
+      format("https://thanos-query.apps.%s.%s/oauth2/callback", local.cluster_name, azurerm_dns_zone.this.name),
+    ]
+  }
+
+  app_role {
+    allowed_member_types = ["User"]
+    description          = "ArgoCD Admins"
+    display_name         = "ArgoCD Administrator"
+    enabled              = true
+    id                   = random_uuid.argocd_app_role_admin.result
+    value                = "argocd-admin"
+  }
+
+  group_membership_claims = ["ApplicationGroup"]
+}
+
+resource "random_uuid" "argocd_app_role_admin" {
+}
+
+resource "azuread_application_password" "this" {
+  application_object_id = azuread_application.this.object_id
+}

examples/aks/base.tf

@@ -0,0 +1,10 @@
+data "azuread_client_config" "current" {
+}
+
+data "azurerm_client_config" "current" {
+}
+
+resource "azurerm_resource_group" "default" {
+  name     = "devops-stack"
+  location = "France Central"
+}

examples/aks/cluster.tf

@@ -0,0 +1,26 @@
+module "cluster" {
+  source  = "Azure/aks/azurerm"
+  version = "~> 6.0"
+
+  kubernetes_version                = 1.25
+  orchestrator_version              = 1.25
+  prefix                            = local.cluster_name
+  vnet_subnet_id                    = azurerm_subnet.this.id
+  resource_group_name               = azurerm_resource_group.default.name
+  azure_policy_enabled              = true
+  network_plugin                    = "azure"
+  private_cluster_enabled           = false
+  rbac_aad_managed                  = true
+  role_based_access_control_enabled = true
+  log_analytics_workspace_enabled   = false
+  sku_tier                          = "Free"
+  agents_pool_name                  = "default"
+  agents_labels                     = { "devops-stack/nodepool" : "default" }
+  agents_count                      = 1
+  agents_size                       = "Standard_D4s_v3"
+  agents_max_pods                   = 150
+  os_disk_size_gb                   = 128
+  oidc_issuer_enabled               = true
+}
+
+# TODO add cluster admin role assignment

examples/aks/dns.tf

@@ -0,0 +1,12 @@
+resource "azurerm_dns_zone" "this" {
+  name                = "hello-ds.camptocamp.com"
+  resource_group_name = azurerm_resource_group.default.name
+}
+
+resource "azurerm_dns_cname_record" "wildcard" {
+  name                = "*.apps"
+  zone_name           = azurerm_dns_zone.this.name
+  resource_group_name = azurerm_resource_group.default.name
+  ttl                 = 300
+  record              = format("%s-%s.%s.cloudapp.azure.com.", local.cluster_name, replace(azurerm_dns_zone.this.name, ".", "-"), azurerm_resource_group.default.location)
+}

examples/aks/locals.tf

@@ -0,0 +1,14 @@
+locals {
+  platform_name = "example"
+  cluster_name  = "blue"
+
+  oidc = {
+    issuer_url              = format("https://login.microsoftonline.com/%s/v2.0", data.azurerm_client_config.current.tenant_id)
+    oauth_url               = format("https://login.microsoftonline.com/%s/oauth2/authorize", data.azurerm_client_config.current.tenant_id)
+    token_url               = format("https://login.microsoftonline.com/%s/oauth2/token", data.azurerm_client_config.current.tenant_id)
+    api_url                 = format("https://graph.microsoft.com/oidc/userinfo")
+    client_id               = azuread_application.this.application_id
+    client_secret           = azuread_application_password.this.value
+    oauth2_proxy_extra_args = []
+  }
+}

examples/aks/network.tf

@@ -0,0 +1,13 @@
+resource "azurerm_virtual_network" "this" {
+  name                = "devops-stack-vnet"
+  resource_group_name = azurerm_resource_group.default.name
+  location            = azurerm_resource_group.default.location
+  address_space       = ["10.1.0.0/16"]
+}
+
+resource "azurerm_subnet" "this" {
+  name                 = local.cluster_name
+  resource_group_name  = azurerm_resource_group.default.name
+  address_prefixes     = ["10.1.0.0/20"]
+  virtual_network_name = azurerm_virtual_network.this.name
+}

examples/aks/outputs.tf

@@ -0,0 +1,3 @@
+output "argocd_url" {
+  value = format("https://argocd.apps.%s.%s", local.cluster_name, azurerm_dns_zone.this.name)
+}

examples/aks/providers.tf

@@ -0,0 +1,6 @@
+provider "azurerm" {
+  features {}
+}
+
+provider "azuread" {
+}