github.com/rahart/packer@v0.12.2-0.20161229105310-282bb6ad370f/website/source/docs/builders/azure-setup.html.md

github.com/rahart/packer@v0.12.2-0.20161229105310-282bb6ad370f/website/source/docs/builders/azure-setup.html.md (about)

1 ---
2 description: |
3
4 layout: docs
5 page_title: Authorizing Packer Builds in Azure
6 ...
7
8 # Authorizing Packer Builds in Azure
9
10 In order to build VMs in Azure Packer needs 6 configuration options to be specified:
11
12 - `subscription_id` - UUID identifying your Azure subscription (where billing is handled)
13 - `client_id` - UUID identifying the Active Directory service principal that will run your Packer builds
14 - `client_secret` - service principal secret / password
15 - `resource_group_name` - name of the resource group where your VHD(s) will be stored
16 - `storage_account` - name of the storage account where your VHD(s) will be stored
17
18 -> Behind the scenes Packer uses the OAuth protocol to authenticate against Azure Active Directory and authorize requests to the Azure Service Management API. These topics are unnecessarily complicated so we will try to ignore them for the rest of this document.<br /><br />You do not need to understand how OAuth works in order to use Packer with Azure, though the Active Directory terms "service principal" and "role" will be useful for understanding Azure's access policies.
19
20 In order to get all of the items above, you will need a username and password for your Azure account.
21
22 ## Device Login
23
24 Device login is an alternative way to authorize in Azure Packer. Device login only requires you to know your
25 Subscription ID. (Device login is only supported for Linux based VMs.) Device login is intended for those who are first
26 time users, and just want to ''kick the tires.'' We recommend the SPN approach if you intend to automate Packer, or for
27 deploying Windows VMs.
28
29 > Device login is for **interactive** builds, and SPN is **automated** builds.
30
31 There are three pieces of information you must provide to enable device login mode.
32
33 1. SubscriptionID
34 1. Resource Group - parent resource group that Packer uses to build an image.
35 1. Storage Account - storage account where the image will be placed.
36
37 > Device login mode is enabled by not setting client_id and client_secret.
38
39 The device login flow asks that you open a web browser, navigate to http://aka.ms/devicelogin, and input the supplied
40 code. This authorizes the Packer for Azure application to act on your behalf. An OAuth token will be created, and stored
41 in the user's home directory (~/.azure/packer/oauth-TenantID.json). This token is used if the token file exists, and it
42 is refreshed as necessary. The token file prevents the need to continually execute the device login flow.
43
44 ## Install the Azure CLI
45
46 To get the credentials above, we will need to install the Azure CLI. Please refer to Microsoft's official [installation guide](https://azure.microsoft.com/en-us/documentation/articles/xplat-cli-install/).
47
48 -> The guides below also use a tool called [`jq`](https://stedolan.github.io/jq/) to simplify the output from the Azure CLI, though this is optional. If you use homebrew you can simply `brew install node jq`.
49
50 If you already have node.js installed you can use `npm` to install `azure-cli`:
51
52 npm install -g azure-cli --no-progress
53
54 ## Guided Setup
55
56 The Packer project includes a [setup script](https://github.com/mitchellh/packer/blob/master/contrib/azure-setup.sh) that can help you setup your account. It uses an interactive bash script to log you into Azure, name your resources, and export your Packer configuration.
57
58 ## Manual Setup
59
60 If you want more control or the script does not work for you, you can also use the manual instructions below to setup your Azure account. You will need to manually keep track of the various account identifiers, resource names, and your service principal password.
61
62 ### Identify Your Tenant and Subscription IDs
63
64 Login using the Azure CLI
65
66 azure config mode arm
67 azure login -u USERNAME
68
69 Get your account information
70
71 azure account list --json | jq '.[].name'
72 azure account set ACCOUNTNAME
73 azure account show --json | jq ".[] | .id"
74
75 -> Throughout this document when you see a command pipe to `jq` you may instead omit `--json` and everything after it, but the output will be more verbose. For example you can simply run `azure account list` instead.
76
77 This will print out one line that look like this:
78
79 "4f562e88-8caf-421a-b4da-e3f6786c52ec"
80
81 This is your `subscription_id`. Note it for later.
82
83 ### Create a Resource Group
84
85 A [resource group](https://azure.microsoft.com/en-us/documentation/articles/resource-group-overview/#resource-groups) is used to organize related resources. Resource groups and storage accounts are tied to a location. To see available locations, run:
86
87 azure location list
88 ...
89 azure group create -n GROUPNAME -l LOCATION
90
91 Your storage account (below) will need to use the same `GROUPNAME` and `LOCATION`.
92
93 ### Create a Storage Account
94
95 We will need to create a storage account where your Packer artifacts will be stored. We will create a `LRS` storage account which is the least expensive price/GB at the time of writing.
96
97 azure storage account create -g GROUPNAME \
98 -l LOCATION --sku-name LRS --kind storage STORAGENAME
99
100 -> `LRS` is meant as a literal "LRS" and not as a variable.
101
102 Make sure that `GROUPNAME` and `LOCATION` are the same as above.
103
104 ### Create an Application
105
106 An application represents a way to authorize access to the Azure API. Note that you will need to specify a URL for your application (this is intended to be used for OAuth callbacks) but these do not actually need to be valid URLs.
107
108 azure ad app create -n APPNAME -i APPURL --home-page APPURL -p PASSWORD
109
110 Password is your `client_secret` and can be anything you like. I recommend using `openssl rand -base64 24`.
111
112 ### Create a Service Principal
113
114 You cannot directly grant permissions to an application. Instead, you create a service principal associated with the application and assign permissions to the service principal.
115
116 First, get the `APPID` for the application we just created.
117
118 azure ad app list --json | \
119 jq '.[] | select(.displayName | contains("APPNAME")) | .appId'
120 azure ad sp create --applicationId APPID
121
122 ### Grant Permissions to Your Application
123
124 Finally, we will associate the proper permissions with our application's service principal. We're going to assign the `Owner` role to our Packer application and change the scope to manage our whole subscription. (The `Owner` role can be scoped to a specific resource group to further reduce the scope of the account.) This allows Packer to create temporary resource groups for each build.
125
126 azure role assignment create --spn APPURL -o "Owner" \
127 -c /subscriptions/SUBSCRIPTIONID
128
129 There are a lot of pre-defined roles and you can define your own with more granular permissions, though this is out of scope. You can see a list of pre-configured roles via:
130
131 azure role list --json | \
132 jq ".[] | {name:.Name, description:.Description}"
133
134
135 ### Configuring Packer
136
137 Now (finally) everything has been setup in Azure. Let's get our configuration keys together:
138
139 Get `subscription_id`:
140
141 azure account show --json | jq ".[] | .id"
142
143 Get `client_id`
144
145 azure ad app list --json | \
146 jq '.[] | select(.displayName | contains("APPNAME")) | .appId'
147
148 Get `client_secret`
149
150 This cannot be retrieved. If you forgot this, you will have to delete and re-create your service principal and the associated permissions.
151
152 Get `resource_group_name`
153
154 azure group list
155
156 Get `storage_account`
157
158 azure storage account list