Reference for the teleport-agent-azure Terraform module
This page lists the input fields and output values of the teleport-agent-azure Terraform module.
Teleport Agent Deployment on Azure Container Instances
This module deploys a Teleport Agent Service to Azure Container Instances (ACI).
It is not intended to deploy a Teleport cluster or its Auth Service and Proxy Service control plane. This module does not provision the persistent backend and audit event storage, load balancing, DNS, or TLS certificates required to operate a self-hosted Teleport cluster.
Currently, only the Teleport Kubernetes Service can be deployed.
Prerequisites
- An existing Teleport cluster with Auth Service and Proxy Service
- A reachable Teleport Proxy Service endpoint
- An existing Azure resource group for the agent resources.
- A Teleport cluster supporting Generic OIDC joining (v18.11.0 or later), and an agent supporting
teleport.join_params.generic_oidc.http_request(v18.11.2 or later).
Examples
Refer to the examples for example usage of this module.
How to get help
If you're having trouble, check out our GitHub Discussions.
For bugs related to this code, please open an issue.
Requirements
| Name | Version |
|---|---|
| terraform | >= 1.5.7 |
| azurerm | >= 5.0 |
| http | >= 3.0 |
| random | >= 3.0 |
| teleport | >= 18.11.0 |
Providers
| Name | Version |
|---|---|
| azurerm | >= 5.0 |
| http | >= 3.0 |
| random | >= 3.0 |
| teleport | >= 18.11.0 |
Modules
No modules.
Resources
| Name | Type |
|---|---|
| azurerm_container_group.teleport_agent | resource |
| azurerm_log_analytics_workspace.this | resource |
| azurerm_role_assignment.teleport_agent | resource |
| azurerm_role_definition.teleport_agent | resource |
| azurerm_user_assigned_identity.teleport_agent | resource |
| random_string.name_suffix | resource |
| teleport_provision_token.agent | resource |
| azurerm_client_config.this | data source |
| http_http.managed_updates | data source |
Inputs
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| apply_azure_tags | Additional Azure tags to apply to all created Azure resources. | map(string) | {} | no |
| container_group_cpu | The required number of CPU cores of the containers. | number | 2 | no |
| container_group_desired_count | Desired number of Teleport container groups to run. | number | 2 | no |
| container_group_memory | The required memory of the containers in GB. | number | 4 | no |
| container_group_name | Name for the container group where the agent runs. | string | "teleport-agent" | no |
| container_group_use_name_prefix | Determines whether var.container_group_name is used as a prefix of the container group name. The revision and replica index are always appended to container group names. | bool | true | no |
| create | Toggle creation of all resources. | bool | true | no |
| environment_vars | Environment variables to set on the Teleport Azure Container Instance. | map(string) | {} | no |
| kubernetes_service | Configuration for running this agent as a Kubernetes Service. resource_matcher_labels is required and contains the label selectors to match and proxy Kubernetes resources. | object({ enabled = optional(bool, true) resource_matcher_labels = optional(map(list(string)), {}) }) | n/a | yes |
| location | Azure location for the agent. Example: eastus, westus. | string | n/a | yes |
| log_analytics_workspace_name | Name of the Log Analytics workspace for the Teleport containers. | string | "teleport" | no |
| log_analytics_workspace_retention_days | Retention of container logs in the created Log Analytics workspace. | number | 30 | no |
| log_analytics_workspace_use_name_prefix | Determines whether log_analytics_workspace_name is used as a prefix of the Log Analytics workspace name. | bool | true | no |
| managed_identity_role | Custom role for the agent's managed identity. Defaults to permissions for the configured service, scoped to the provider's subscription. Override actions, data_actions, or scopes as needed; set to null to disable role creation and assignments. | object({ actions = optional(list(string)) data_actions = optional(list(string)) scope = optional(string) }) | {} | no |
| managed_updates_enabled | Whether to resolve the Teleport version from the configured Managed Updates endpoint when applying this module. | bool | true | no |
| managed_updates_group | Update group to query through the v2 Managed Updates endpoint. | string | "default" | no |
| resource_group_name | Resource group where the resources will be created. Must already exist. | string | n/a | yes |
| teleport_container_image | Container image used for Teleport Azure Container Instance tasks. | string | "public.ecr.aws/gravitational/teleport-ent-distroless" | no |
| teleport_discovery_group_name | If specified, this is added as part of the resource_matcher_labels, to match the resources discovered in that discovery group. | string | "" | no |
| teleport_proxy_public_addr | Teleport cluster proxy public address host:port. | string | n/a | yes |
| teleport_version_override | teleport_version_override is intended for development and MUST NOT be used to control the Teleport version in a typical deployment. This module is designed to run a specific Teleport version. You will face compatibility issues trying to run a different Teleport version with it. If you want to run Teleport version X.Y.Z, you should adjust the module version to X.Y.Z instead. | string | null | no |
Outputs
| Name | Description |
|---|---|
| container_group_ids | Resource IDs of the deployed agents, one per replica. |
| container_group_names | Names of the deployed agents, one per replica. |
| container_group_urls | Azure portal URLs for the deployment status and container logs of each deployed agent. |
| container_logs_follow_command | The command to follow the logs of the deployed agents' containers. |
| log_analytics_workspace_id | Resource ID of the Log Analytics workspace that collects agent logs. |
| log_analytics_workspace_name | Name of the Log Analytics workspace that collects agent logs. |
| managed_identity | The user-assigned managed identity used by the deployed agents. |
Source Code
Was this page helpful?