Azure Terraform（三）部署 Web 應用程序

一，引言

　　上一節關於 Terraform 的文章講到 Terraform 使用到的一些語法，以及通過演示使用 Terraform 在Azure 上部署資源組，極大的方便了基礎設施實施人員，也提高了基礎設施團隊的工作效率，同時可以利用 IAC 工具來管理雲基礎設施資源。

　　這個時候就有人問到，既然 Terraform 這么強大，那可不可以自動化部署其他Azure 資源，比方我們公司的項目就部署在Azure Web 應用上，用戶訪問的流量通過 Traffic Manager（流量配置分發管理器） 將流量分發到后端的 Web 應用程序，基礎設施架構圖如下圖所示：

 那我們今天就已當前基礎設施架構圖為模板，通過Terraform 實現基礎設施資源的自動化部署

--------------------Azure Terraform 系列--------------------

1，Azure Terraform（一）入門簡介

2，Azure Terraform（二）語法詳解

3，Azure Terraform（三）部署 Web 應用程序

4，Azure Terraform（四）狀態文件存儲

5，Azure Terraform（五）利用Azure DevOps 實現自動化部署基礎資源

6，Azure Terraform（六）Common Module

7，Azure Terraform（七）利用Azure DevOps 實現自動化部署基礎資源（補充）

8，Azure Terraform（八）利用Azure DevOps 實現Infra資源和.NET CORE Web 應用程序的持續集成、持續部署

二，正文

1，Terraform 下的資源架構

1.1 Data Source

這個我們引入一個新的概念，Terraform Data Source

provider "azurerm" {
  version = "~>2.0"
  features {}
}

data "azurerm_resource_group" "cnbate_resource_group" {
  name = "Web_Test_TF_RG"
}

使用 data 標記的資源訪問有關現有資源組的信息，意思就是在Azure 上我們已有一個名為 “Web_Test_TF_RG”，我們直接引用現有的資源組，在此資源組下創建其他雲資源。

1.2 Web 應用程序

注意：根據架構圖所示，兩個 Web 應用程序 

resource "azurerm_app_service_plan" "cnbate_app_service_plan01" {
  name                = "cnbate_appserviceplan01"
  location            = local.location_eastAsia
  resource_group_name = data.azurerm_resource_group.cnbate_resource_group.name

  sku {
    tier = "Standard"
    size = "S1"
  }
}

resource "azurerm_app_service_plan" "cnbate_app_service_plan02" {
  name                = "cnbate_appserviceplan02"
  location            = local.location_southeastAsia
  resource_group_name = data.azurerm_resource_group.cnbate_resource_group.name

  sku {
    tier = "Standard"
    size = "S1"
  }
}

resource "azurerm_app_service" "cnbate_app_service01" {
  name                = "CnBateBlogWeb01"
  location            = local.location_eastAsia
  resource_group_name = data.azurerm_resource_group.cnbate_resource_group.name
  app_service_plan_id = azurerm_app_service_plan.cnbate_app_service_plan01.id

  app_settings = {
    "ASPNETCORE_ENVIRONMENT" = "Production"
  }
}

resource "azurerm_app_service" "cnbate_app_service02" {
  name                = "CnBateBlogWeb02"
  location            = local.location_southeastAsia
  resource_group_name = data.azurerm_resource_group.cnbate_resource_group.name
  app_service_plan_id = azurerm_app_service_plan.cnbate_app_service_plan02.id

  app_settings = {
    "ASPNETCORE_ENVIRONMENT" = "Production"
  }
}

1.3，Traffic Manager Profile（流量管理器配置）

resource "azurerm_traffic_manager_profile" "cnbate_traffic_manager_profile" {
  name                = "cnbateblogweb"
  resource_group_name = data.azurerm_resource_group.cnbate_resource_group.name

  traffic_routing_method = "Geographic"

  dns_config {
    relative_name = "cnbateblogweb"
    ttl           = 60
  }

  monitor_config {
    protocol                     = "http"
    port                         = 80
    path                         = "/"
    interval_in_seconds          = 30
    timeout_in_seconds           = 10
    tolerated_number_of_failures = 3
  }

  tags = {
    Environment = "Production"
  }
}

1.4 Traffic Manager Endpoint（流量管理器終結點）

resource "azurerm_traffic_manager_endpoint" "cnbate_traffic_manager_endpoint01" {
  name                = "cnbateblogweb_webapp01_performance"
  resource_group_name = data.azurerm_resource_group.cnbate_resource_group.name
  profile_name        = azurerm_traffic_manager_profile.cnbate_traffic_manager_profile.name
  target_resource_id  = azurerm_app_service.cnbate_app_service01.id
  type                = "azureEndpoints"

  geo_mappings = ["CN"]
}

resource "azurerm_traffic_manager_endpoint" "cnbate_traffic_manager_endpoint02" {
  name                = "cnbateblogweb_webapp02_performance"
  resource_group_name = data.azurerm_resource_group.cnbate_resource_group.name
  profile_name        = azurerm_traffic_manager_profile.cnbate_traffic_manager_profile.name
  target_resource_id  = azurerm_app_service.cnbate_app_service02.id
  type                = "azureEndpoints"

  geo_mappings = ["SG"]
}

完整請查看文章底部 github 鏈接

2，執行 Terraform 部署計划並且驗證部署結果

2.1，使用以下 terraform apply 命令進行部署

PS D:\Core\Terraform\Azure\terraform_cnbate_traffic manager> terraform apply
data.azurerm_resource_group.cnbate_resource_group: Refreshing state...

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:  
  + create

Terraform will perform the following actions:

  # azurerm_app_service.cnbate_app_service01 will be created
  + resource "azurerm_app_service" "cnbate_app_service01" {    
      + app_service_plan_id               = (known after apply)
      + app_settings                      = {
          + "ASPNETCORE_ENVIRONMENT" = "Production"
        }
      + client_affinity_enabled           = false
      + client_cert_enabled               = false
      + custom_domain_verification_id     = (known after apply)
      + default_site_hostname             = (known after apply)
      + enabled                           = true
      + https_only                        = false
      + id                                = (known after apply)
      + location                          = "eastasia"
      + name                              = "CnBateBlogWeb01"  
      + outbound_ip_address_list          = (known after apply)
      + outbound_ip_addresses             = (known after apply)
      + possible_outbound_ip_address_list = (known after apply)
      + possible_outbound_ip_addresses    = (known after apply)
      + resource_group_name               = "Web_Test_TF_RG"   
      + site_credential                   = (known after apply)

      + auth_settings {
          + additional_login_params        = (known after apply)
          + allowed_external_redirect_urls = (known after apply)
          + default_provider               = (known after apply)
          + enabled                        = (known after apply)
          + issuer                         = (known after apply)
          + runtime_version                = (known after apply)
          + token_refresh_extension_hours  = (known after apply)
          + token_store_enabled            = (known after apply)
          + unauthenticated_client_action  = (known after apply)

          + active_directory {
              + allowed_audiences = (known after apply)
              + client_id         = (known after apply)
              + client_secret     = (sensitive value)
            }

          + facebook {
              + app_id       = (known after apply)
              + app_secret   = (sensitive value)
              + oauth_scopes = (known after apply)
            }

          + google {
              + client_id     = (known after apply)
              + client_secret = (sensitive value)
              + oauth_scopes  = (known after apply)
            }

          + microsoft {
              + client_id     = (known after apply)
              + client_secret = (sensitive value)
              + oauth_scopes  = (known after apply)
            }

          + twitter {
              + consumer_key    = (known after apply)
              + consumer_secret = (sensitive value)
            }
        }

      + connection_string {
          + name  = (known after apply)
          + type  = (known after apply)
          + value = (sensitive value)
        }

      + identity {
          + identity_ids = (known after apply)
          + principal_id = (known after apply)
          + tenant_id    = (known after apply)
          + type         = (known after apply)
        }

      + logs {
          + detailed_error_messages_enabled = (known after apply)
          + failed_request_tracing_enabled  = (known after apply)

          + application_logs {
              + file_system_level = (known after apply)

              + azure_blob_storage {
                  + level             = (known after apply)
                  + retention_in_days = (known after apply)
                  + sas_url           = (sensitive value)
                }
            }

          + http_logs {
              + azure_blob_storage {
                  + retention_in_days = (known after apply)
                  + sas_url           = (sensitive value)
                }

              + file_system {
                  + retention_in_days = (known after apply)
                  + retention_in_mb   = (known after apply)
                }
            }
        }

      + site_config {
          + always_on                   = (known after apply)
          + app_command_line            = (known after apply)
          + auto_swap_slot_name         = (known after apply)
          + default_documents           = (known after apply)
          + dotnet_framework_version    = (known after apply)
          + ftps_state                  = (known after apply)
          + health_check_path           = (known after apply)
          + http2_enabled               = (known after apply)
          + ip_restriction              = (known after apply)
          + java_container              = (known after apply)
          + java_container_version      = (known after apply)
          + java_version                = (known after apply)
          + linux_fx_version            = (known after apply)
          + local_mysql_enabled         = (known after apply)
          + managed_pipeline_mode       = (known after apply)
          + min_tls_version             = (known after apply)
          + php_version                 = (known after apply)
          + python_version              = (known after apply)
          + remote_debugging_enabled    = (known after apply)
          + remote_debugging_version    = (known after apply)
          + scm_ip_restriction          = (known after apply)
          + scm_type                    = (known after apply)
          + scm_use_main_ip_restriction = (known after apply)
          + use_32_bit_worker_process   = (known after apply)
          + websockets_enabled          = (known after apply)
          + windows_fx_version          = (known after apply)

          + cors {
              + allowed_origins     = (known after apply)
              + support_credentials = (known after apply)
            }
        }

      + source_control {
          + branch             = (known after apply)
          + manual_integration = (known after apply)
          + repo_url           = (known after apply)
          + rollback_enabled   = (known after apply)
          + use_mercurial      = (known after apply)
        }

      + storage_account {
          + access_key   = (sensitive value)
          + account_name = (known after apply)
          + mount_path   = (known after apply)
          + name         = (known after apply)
          + share_name   = (known after apply)
          + type         = (known after apply)
        }
    }

  # azurerm_app_service.cnbate_app_service02 will be created
  + resource "azurerm_app_service" "cnbate_app_service02" {
      + app_service_plan_id               = (known after apply)
      + app_settings                      = {
          + "ASPNETCORE_ENVIRONMENT" = "Production"
        }
      + client_affinity_enabled           = false
      + client_cert_enabled               = false
      + custom_domain_verification_id     = (known after apply)
      + default_site_hostname             = (known after apply)
      + enabled                           = true
      + https_only                        = false
      + id                                = (known after apply)
      + location                          = "southeastasia"
      + name                              = "CnBateBlogWeb02"
      + outbound_ip_address_list          = (known after apply)
      + outbound_ip_addresses             = (known after apply)
      + possible_outbound_ip_address_list = (known after apply)
      + possible_outbound_ip_addresses    = (known after apply)
      + resource_group_name               = "Web_Test_TF_RG"
      + site_credential                   = (known after apply)

      + auth_settings {
          + additional_login_params        = (known after apply)
          + allowed_external_redirect_urls = (known after apply)
          + default_provider               = (known after apply)
          + enabled                        = (known after apply)
          + issuer                         = (known after apply)
          + runtime_version                = (known after apply)
          + token_refresh_extension_hours  = (known after apply)
          + token_store_enabled            = (known after apply)
          + unauthenticated_client_action  = (known after apply)

          + active_directory {
              + allowed_audiences = (known after apply)
              + client_id         = (known after apply)
              + client_secret     = (sensitive value)
            }

          + facebook {
              + app_id       = (known after apply)
              + app_secret   = (sensitive value)
              + oauth_scopes = (known after apply)
            }

          + google {
              + client_id     = (known after apply)
              + client_secret = (sensitive value)
              + oauth_scopes  = (known after apply)
            }

          + microsoft {
              + client_id     = (known after apply)
              + client_secret = (sensitive value)
              + oauth_scopes  = (known after apply)
            }

          + twitter {
              + consumer_key    = (known after apply)
              + consumer_secret = (sensitive value)
            }
        }

      + connection_string {
          + name  = (known after apply)
          + type  = (known after apply)
          + value = (sensitive value)
        }

      + identity {
          + identity_ids = (known after apply)
          + principal_id = (known after apply)
          + tenant_id    = (known after apply)
          + type         = (known after apply)
        }

      + logs {
          + detailed_error_messages_enabled = (known after apply)
          + failed_request_tracing_enabled  = (known after apply)

          + application_logs {
              + file_system_level = (known after apply)

              + azure_blob_storage {
                  + level             = (known after apply)
                  + retention_in_days = (known after apply)
                  + sas_url           = (sensitive value)
                }
            }

          + http_logs {
              + azure_blob_storage {
                  + retention_in_days = (known after apply)
                  + sas_url           = (sensitive value)
                }

              + file_system {
                  + retention_in_days = (known after apply)
                  + retention_in_mb   = (known after apply)
                }
            }
        }

      + site_config {
          + always_on                   = (known after apply)
          + app_command_line            = (known after apply)
          + auto_swap_slot_name         = (known after apply)
          + default_documents           = (known after apply)
          + dotnet_framework_version    = (known after apply)
          + ftps_state                  = (known after apply)
          + health_check_path           = (known after apply)
          + http2_enabled               = (known after apply)
          + ip_restriction              = (known after apply)
          + java_container              = (known after apply)
          + java_container_version      = (known after apply)
          + java_version                = (known after apply)
          + linux_fx_version            = (known after apply)
          + local_mysql_enabled         = (known after apply)
          + managed_pipeline_mode       = (known after apply)
          + min_tls_version             = (known after apply)
          + php_version                 = (known after apply)
          + python_version              = (known after apply)
          + remote_debugging_enabled    = (known after apply)
          + remote_debugging_version    = (known after apply)
          + scm_ip_restriction          = (known after apply)
          + scm_type                    = (known after apply)
          + scm_use_main_ip_restriction = (known after apply)
          + use_32_bit_worker_process   = (known after apply)
          + websockets_enabled          = (known after apply)
          + windows_fx_version          = (known after apply)

          + cors {
              + allowed_origins     = (known after apply)
              + support_credentials = (known after apply)
            }
        }

      + source_control {
          + branch             = (known after apply)
          + manual_integration = (known after apply)
          + repo_url           = (known after apply)
          + rollback_enabled   = (known after apply)
          + use_mercurial      = (known after apply)
        }

      + storage_account {
          + access_key   = (sensitive value)
          + account_name = (known after apply)
          + mount_path   = (known after apply)
          + name         = (known after apply)
          + share_name   = (known after apply)
          + type         = (known after apply)
        }
    }

  # azurerm_app_service_plan.cnbate_app_service_plan01 will be created
  + resource "azurerm_app_service_plan" "cnbate_app_service_plan01" {
      + id                           = (known after apply)
      + kind                         = "Windows"
      + location                     = "eastasia"
      + maximum_elastic_worker_count = (known after apply)
      + maximum_number_of_workers    = (known after apply)
      + name                         = "cnbate_appserviceplan01"
      + resource_group_name          = "Web_Test_TF_RG"

      + sku {
          + capacity = (known after apply)
          + size     = "S1"
          + tier     = "Standard"
        }
    }

  # azurerm_app_service_plan.cnbate_app_service_plan02 will be created
  + resource "azurerm_app_service_plan" "cnbate_app_service_plan02" {
      + id                           = (known after apply)
      + kind                         = "Windows"
      + location                     = "southeastasia"
      + maximum_elastic_worker_count = (known after apply)
      + maximum_number_of_workers    = (known after apply)
      + name                         = "cnbate_appserviceplan02"
      + resource_group_name          = "Web_Test_TF_RG"

      + sku {
          + capacity = (known after apply)
          + size     = "S1"
          + tier     = "Standard"
        }
    }

  # azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint01 will be created
  + resource "azurerm_traffic_manager_endpoint" "cnbate_traffic_manager_endpoint01" {
      + endpoint_location       = (known after apply)
      + endpoint_monitor_status = (known after apply)
      + endpoint_status         = (known after apply)
      + geo_mappings            = [
          + "CN",
        ]
      + id                      = (known after apply)
      + name                    = "cnbateblogweb_webapp01_performance"
      + priority                = (known after apply)
      + profile_name            = "cnbateblogweb"
      + resource_group_name     = "Web_Test_TF_RG"
      + target                  = (known after apply)
      + target_resource_id      = (known after apply)
      + type                    = "azureEndpoints"
      + weight                  = (known after apply)
    }

  # azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint02 will be created
  + resource "azurerm_traffic_manager_endpoint" "cnbate_traffic_manager_endpoint02" {
      + endpoint_location       = (known after apply)
      + endpoint_monitor_status = (known after apply)
      + endpoint_status         = (known after apply)
      + geo_mappings            = [
          + "SG",
        ]
      + id                      = (known after apply)
      + name                    = "cnbateblogweb_webapp02_performance"
      + priority                = (known after apply)
      + profile_name            = "cnbateblogweb"
      + resource_group_name     = "Web_Test_TF_RG"
      + target                  = (known after apply)
      + target_resource_id      = (known after apply)
      + type                    = "azureEndpoints"
      + weight                  = (known after apply)
    }

  # azurerm_traffic_manager_profile.cnbate_traffic_manager_profile will be created
  + resource "azurerm_traffic_manager_profile" "cnbate_traffic_manager_profile" {
      + fqdn                   = (known after apply)
      + id                     = (known after apply)
      + name                   = "cnbateblogweb"
      + profile_status         = (known after apply)
      + resource_group_name    = "Web_Test_TF_RG"
      + tags                   = {
          + "Environment" = "Production"
        }
      + traffic_routing_method = "Geographic"

      + dns_config {
          + relative_name = "cnbateblogweb"
          + ttl           = 60
        }

      + monitor_config {
          + interval_in_seconds          = 30
          + path                         = "/"
          + port                         = 80
          + protocol                     = "http"
          + timeout_in_seconds           = 10
          + tolerated_number_of_failures = 3
        }
    }

Plan: 7 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

azurerm_app_service_plan.cnbate_app_service_plan02: Creating...
azurerm_app_service_plan.cnbate_app_service_plan01: Creating...
azurerm_traffic_manager_profile.cnbate_traffic_manager_profile: Creating...
azurerm_traffic_manager_profile.cnbate_traffic_manager_profile: Creation complete after 5s [id=/subscriptions/c4206323-2bc4-4732-a41e-df2f392c0afc/resourceGroups/Web_Test_TF_RG/providers/Microsoft.Network/trafficManagerProfiles/cnbateblogweb]
azurerm_app_service_plan.cnbate_app_service_plan01: Creation complete after 7s [id=/subscriptions/c4206323-2bc4-4732-a41e-df2f392c0afc/resourceGroups/Web_Test_TF_RG/providers/Microsoft.Web/serverfarms/cnbate_appserviceplan01]
azurerm_app_service.cnbate_app_service01: Creating...
azurerm_app_service_plan.cnbate_app_service_plan02: Creation complete after 8s [id=/subscriptions/c4206323-2bc4-4732-a41e-df2f392c0afc/resourceGroups/Web_Test_TF_RG/providers/Microsoft.Web/serverfarms/cnbate_appserviceplan02]
azurerm_app_service.cnbate_app_service02: Creating...
azurerm_app_service.cnbate_app_service01: Still creating... [10s elapsed]
azurerm_app_service.cnbate_app_service02: Still creating... [10s elapsed]
azurerm_app_service.cnbate_app_service01: Still creating... [20s elapsed]
azurerm_app_service.cnbate_app_service02: Still creating... [20s elapsed]
azurerm_app_service.cnbate_app_service01: Still creating... [30s elapsed]
azurerm_app_service.cnbate_app_service02: Still creating... [30s elapsed]
azurerm_app_service.cnbate_app_service01: Creation complete after 33s [id=/subscriptions/c4206323-2bc4-4732-a41e-df2f392c0afc/resourceGroups/Web_Test_TF_RG/providers/Microsoft.Web/sites/CnBateBlogWeb01]
azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint01: Creating...
azurerm_app_service.cnbate_app_service02: Creation complete after 33s [id=/subscriptions/c4206323-2bc4-4732-a41e-df2f392c0afc/resourceGroups/Web_Test_TF_RG/providers/Microsoft.Web/sites/CnBateBlogWeb02]
azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint02: Creating...
azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint01: Still creating... [10s elapsed]
azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint01: Creation complete after 10s [id=/subscriptions/c4206323-2bc4-4732-a41e-df2f392c0afc/resourceGroups/Web_Test_TF_RG/providers/Microsoft.Network/trafficManagerProfiles/cnbateblogweb/azureEndpoints/cnbateblogweb_webapp01_performance]
azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint02: Still creating... [10s elapsed]
azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint02: Still creating... [20s elapsed]
azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint02: Creation complete after 21s [id=/subscriptions/c4206323-2bc4-4732-a41e-df2f392c0afc/resourceGroups/Web_Test_TF_RG/providers/Microsoft.Network/trafficManagerProfiles/cnbateblogweb/azureEndpoints/cnbateblogweb_webapp02_performance]

Apply complete! Resources: 7 added, 0 changed, 0 destroyed.
PS D:\Core\Terraform\Azure\terraform_cnbate_traffic manager>

登錄 Azure Portal 中，查看剛剛部署完成的資源

Traffic Manager profile (流量管理配置) 終結點配置

來自 “亞洲=》中國” 的流量轉發到 “CnBateBlogWeb01”

來自 ”亞洲=》新加坡“ 的流量轉發到 “CnBateBlogWeb02”

3，部署 Web 應用程序

發布 CnBateBlogWeb01

選擇 Web_Test_TF_RG 資源組下的 ”CnBateBlogWeb01“ Web 應用程序

 點擊 ”發布“，進行發布操作

發布成功后，點擊 ”Browse“ 再瀏覽器中訪問。

顯示OK，沒有任何問題，為了兩個Web App 部署做區分，我這里在 ”CnBateBlogWeb01“ 上顯示 ”This is China“

同樣，我們發布項目到 ”CnBateBlogWeb02“，同樣的也為了區分，頁面顯示 ”This is Singapore"

發布項目完成后，就開始測試 Azure Traffic Manager profile（流量管理配置）是否可以將用戶通過 Traffic Manager 來的請求是否能能夠正常的轉發后對於的終結點

測試區域 ”亞洲=》中國“

訪問ok，成功的將來自 ”china“ 的流量轉發到后端 ”CnBateBlogWeb01“

測試區域 ”亞洲=》新加坡“

訪問ok，成功的將來自 ”Singapore“ 的流量轉發到后端 ”CnBateBlogWeb02“

溫馨提示，大家記得 ”terraform destroy“ 刪除所有的資源

三，結尾

　　今天的內容其實很簡單，回歸了一下 Azure Traffic Manger 的相關知識點，通過設置 ”Geograhpic“ （基於地理位置的路由策略），當用戶訪問 Traffic Manger ，它在不同的地理位置上部署服務器以就近響應用戶的請求。同時利用 Terraform 快速實現雲基礎設置資源的搭建，提高了整個團隊在雲資源構建方面的能力。

參考資料：Terraform 官方，azurerm 文檔

Terraform_Cnbate_Traffic_Manager github：https://github.com/yunqian44/Terraform_Cnbate_Traffic_Manager

CnBateBlogWeb github：https://github.com/yunqian44/CnBateBlogWeb

作者：Allen 

版權：轉載請在文章明顯位置注明作者及出處。如發現錯誤，歡迎批評指正。