ToddandDan Heath
277f0a0035
* Add new host discovery documentation layout Co-authored-by: Dan Heath <76443935+Dan-Heath@users.noreply.github.com>
115 lines
3.8 KiB
Plaintext
115 lines
3.8 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Azure dynamic host catalogs
|
|
description: |-
|
|
An overview of Azure host discovery in Boundary
|
|
---
|
|
# Azure dynamic host catalogs
|
|
Boundary uses dynamic host catalogs to automatically discover Azure resources available through Azure Resource Manager (ARM) and add them as hosts.
|
|
|
|
## Create a host catalog to connect with Azure
|
|
Boundary uses plugins to integrate with a variety of providers. To use a
|
|
dynamic host catalog to integrate with Azure, you create a host catalog of the
|
|
`plugin` type and set the `plugin-name` value to `azure`. You must also provide the
|
|
specific fields needed for Boundary to authenticate with Azure.
|
|
|
|
<Tabs>
|
|
<Tab heading="CLI">
|
|
|
|
```shell-session
|
|
$ boundary host-catalogs create plugin \
|
|
-scope-id $PROJECT_ID \
|
|
-plugin-name azure \
|
|
-attr disable_credential_rotation=true \
|
|
-attr tenant_id=env://ARM_TENANT_ID \
|
|
-attr subscription_id=env://ARM_SUBSCRIPTION_ID \
|
|
-attr client_id=env://ARM_CLIENT_ID \
|
|
-secret secret_value=env://ARM_CLIENT_SECRET
|
|
```
|
|
|
|
</Tab>
|
|
<Tab heading="Terraform">
|
|
|
|
```hcl
|
|
resource "boundary_host_catalog_plugin" "azure_host_catalog" {
|
|
name = "Azure Catalog"
|
|
description = "Azure Host Catalog"
|
|
scope_id = boundary_scope.project.id
|
|
plugin_name = "azure"
|
|
|
|
attributes_json = jsonencode({
|
|
"tenant_id" = "ARM_TENANT_ID",
|
|
"subscription_id" = "ARM_SUBSCRIPTION_ID"
|
|
"client_id" = "ARM_CLIENT_ID"
|
|
"disable_credential_rotation" = true })
|
|
secrets_json = jsonencode({
|
|
"secret_value" = "ARM_CLIENT_SECRET"})
|
|
}
|
|
```
|
|
|
|
</Tab>
|
|
</Tabs>
|
|
|
|
The `scope-id` and `plugin-name` fields are required when you create a
|
|
dynamic host catalog.
|
|
|
|
The fields following the `attr` and `secret` flags are specific to Azure and are required by
|
|
Boundary for authentication.
|
|
|
|
- `disable_credential_rotation`: When set to `true`, Boundary will not rotate the credentials automatically.
|
|
- `tenant_id`: The ARM Tenant(Directory) ID
|
|
- `subscription_id`: The ARM Subscription ID
|
|
- `client_id`: The ARM Client (Application) ID
|
|
- `secret_value`: The ARM Client Secret
|
|
|
|
Refer to [the domain model documentation](/boundary/docs/concepts/domain-model/host-catalogs) for additional fields that you can use when you create host catalogs.
|
|
|
|
## Create a host set to connect with Azure
|
|
[Host sets](/boundary/docs/concepts/domain-model/host-sets) specify which Azure
|
|
Resource Manager (ARM) filters should be used to identify the discovered hosts that should be added as members.
|
|
|
|
Create a host set using the following command:
|
|
|
|
|
|
|
|
<Tabs>
|
|
<Tab heading="CLI" group="cli">
|
|
|
|
```shell-session
|
|
$ boundary host-sets create plugin \
|
|
-name database \
|
|
-host-catalog-id $HOST_CATALOG_ID \
|
|
-attr filter="tagName eq 'service-type' and tagValue eq 'database'"
|
|
```
|
|
|
|
</Tab>
|
|
<Tab heading="Terraform" group="terraform">
|
|
|
|
```hcl
|
|
resource "boundary_host_set_plugin" "azure_host_set" {
|
|
name = "Azure Set"
|
|
description = "Azure Host Set"
|
|
host_catalog_id = boundary_scope.azure_host_catalog.id
|
|
attributes_json = jsonencode({
|
|
"filter" = "tagName eq 'service-type' and tagValue eq 'database'" })
|
|
}
|
|
```
|
|
|
|
</Tab>
|
|
</Tabs>
|
|
|
|
The `host-catalog-id` value is a required field that specifies in which host catalog to
|
|
create this host set.
|
|
|
|
The fields following the `attr` flag are specific to Azure.
|
|
|
|
The `filter` field represents the ARM filter used to select resources that should be a part of
|
|
this host set. There are some limitations with the filtering syntax.
|
|
Specifically, when you use tags, other types of filters (such as on resource
|
|
type) are not allowed. As a result, it is generally useful to filter
|
|
directly on tag names or values as in the following examples:
|
|
- `tagName eq 'application'`
|
|
- `tagName eq 'application' and tagValue eq 'app2'`
|
|
|
|
Refer to [the domain model documentation](/boundary/docs/concepts/domain-model/host-catalogs) for additional fields that you can use when you create host catalogs.
|