In this lesson, you will connect your Ansible container with Azure. Following are the steps to connect to Azure:

  1. Sign in with Azure CLI.
  2. Create a Service Principal.
  3. Assign a role to the Service Principal.
  4. Create Environment Variables.
  5. Install the Azure Python module.

Prerequisites

You need to create an account on Azure. You can subscribe to Azure here.

Sign in with Azure CLI

You will use Azure CLI to create a service principal for Azure. Before you can do that, you will need a few tools to be installed and updated first. To set up Azure CLI in your development container, run the following command:

Press + to interact
curl -sL https://aka.ms/InstallAzureCLIDeb | bash

Docker Setup
All the software packages are already installed. You can verify this by executing the az --version command in the terminal.

Once installed, run the following command:

Press + to interact
# Verify Installation
az --version

Sign in

You will need to sign in using the Azure CLI. Sign in to Azure using the az login cmdlet. Run the following command:

Press + to interact
# Sign in to Azure
# Replace <username> and <password> with your actual username and password
az login -u <username> -p <password>
# Or to sign in interactively
az login

Create an Azure service principal

Ansible uses a service principal to authenticate to Azure. You can use Azure CLI to create a password-based account and assign permissions to the account. You can do that by running the following command:

Press + to interact
# Replace the <ServicePrincipalName> with a name of your own choice
az ad sp create-for-rbac --name ServicePrincipalName

Replace the ServicePrincipalName with the name of your choice.

Copy the contents of the output and save it on your machine. You will use them in the upcoming chapters. The output will look like the one below:

Press + to interact
{
  “appId”: “<App-ID>”,
  “displayName”: “<ServicePrincipalName>”,
  “name”: “http://<ServicePrincipalName>”,
  “password”: “<Password>,
  “tenant”: “<Tenant-ID>"
}

Let’s look at the code output and try to make sense of it.

az ad sp create-for-rbac: We first create the password-based service principal by specifying the following:

  • ad: Active Directory
  • sp: Service Principal

Output: The output consists of:

  • password: Auto-generated by Azure.
  • appId and tenant keys: Used in service principal authentication.
Breaking down the code.

Assign a role to the service principal

You use the az role assignment to assign Contributor to the service principal in your subscription.

The az role assignment requires two parameters:

  • Assignee
  • RoleDefinitionName

Let’s look at how you can store them and assign the Contributor role by reviewing the code snippet below:

Press + to interact
# Replace the APP_ID with the output appId of the create-for-rbac command. 
az role assignment create --assignee APP_ID --role Contributor

Assignee

Use the appId you got as an output from the create-for-rbac command.

Role

Use the Contributor role.

You can modify the scope and role definition to be more restrictive.

Verify that the role has been assigned by executing the following command:

Press + to interact
# Replace the APP_ID with the output appId of the create-for-rbac command. 
az role assignment list --assignee APP_ID

Create the environment variable

Ansible uses the following environment variables for its configuration to authenticate to Azure:

  • AZURE_SUBSCRIPTION_ID
  • AZURE_CLIENT_ID
  • AZURE_SECRET
  • AZURE_TENANT

Getting the Azure information

Use the az to populate bash variables exported as environment variables later.

Run the following commands in the terminal one by one:

Press + to interact
# Azure Subscription Id
 subscriptionid=$(az account show --query id --output tsv)
# Azure Client Id
# Replace <appId> with the actual App Id
clientid=<appId>
# Azure Secret. 
# Replace <Password> with the auto-generated password for service principal.
secret=<password>
# Azure Tenant Id
# Replace <tenant> with the actual tenant Id
tenantid=<tenant>
export AZURE_SUBSCRIPTION_ID=$subscriptionid; 
export AZURE_CLIENT_ID=$clientid;
export AZURE_SECRET=$secret;
export AZURE_TENANT=$tenantid;

Your Ansible environment is now connected to Azure.

Echo the variables and copy and store these variables as well; you will use them in the upcoming chapters.

Press + to interact
# echo variables and save them for later use.
echo $AZURE_SUBSCRIPTION_ID
echo $AZURE_CLIENT_ID
echo $AZURE_SECRET
echo $AZURE_TENANT

Create an Azure resource group with Ansible

Use the Ansible azure_rm_resourcegroup command to create a resource group in Azure.

You will learn more about Ansible commands in an upcoming chapter.

Run the following command in the terminal:

Press + to interact
ansible localhost -m azure_rm_resourcegroup -a "name=ansible location=eastus"

Re-execute the azure_rm_resourcegroup command below in the terminal:

Press + to interact
ansible localhost -m azure_rm_resourcegroup -a "name=ansible location=eastus"

Verify

Trust but verify. Double-check that the resource is created by either logging into the Azure Portal or using the az group list cmdlet. Run the following command in the terminal:

Press + to interact
az group list

Practice all the commands covered in this lesson one be one in the terminal. We have provided a summarized view of the commands below:

Press + to interact
# Launch PowerShell
az --version
# Sign in to the Azure Account
# Replace <username> and <password> with your actual username and password
az login -u <username> -p <password>
# Or to sign in interactively
az login
# Create a service principal
# Replace the <ServicePrincipalName> with a name of your own choice
az ad sp create-for-rbac --name ServicePrincipalName
## Assign the 'Contributor' role
# Replace the APP_ID with the output appId of the create-for-rbac command. 
az role assignment create --assignee APP_ID --role Contributor
## Verify Role Assignment
# Replace the APP_ID with the output appId of the create-for-rbac command. 
az role assignment list --assignee APP_ID
## Create Environment Variables
# Azure Subscription Id
 subscriptionid=$(az account show --query id --output tsv)
# Azure Client Id
# Replace <appId> with the actual App Id
clientid=<appId>
# Azure Secret. 
# Replace <Password> with the auto-generated password for service principal.
secret=<password>
# Azure Tenant Id
# Replace <tenant> with the actual tenant Id
tenantid=<tenant>
# Environment Variables
export AZURE_SUBSCRIPTION_ID=$subscriptionid; 
export AZURE_CLIENT_ID=$clientid;
export AZURE_SECRET=$secret;
export AZURE_TENANT=$tenantid;
# echo variables and save them for later use.
echo $AZURE_SUBSCRIPTION_ID
echo $AZURE_CLIENT_ID
echo $AZURE_SECRET
echo $AZURE_TENANT
# Create a resource
ansible localhost -m azure_rm_resourcegroup -a "name=ansible location=eastus"
## In case of error,
# Failed to import the required Python library (packaging)
pip3 install ansible[azure]
# re-run - Create a resource
ansible localhost -m azure_rm_resourcegroup -a "name=ansible location=eastus"
## End - Error
# Verify the creation
az group list
Terminal 1
Terminal
Loading...

Troubleshooting tips

Missing ansible[azure] module
You might come across the following message.
“Failed to import the required Python library (packaging) on 5fbb354c4e23 Python /usr/bin/python2. Please read the module documentation and install it in the appropriate location. If the required library is installed, but Ansible uses the wrong Python interpreter, please consult the documentation on ansible_python_interpreter.”

You require the ansible[azure] python module to run the Azure Ansible modules.

Install the Azure Python module

You can install the ansible[azure] module by executing the following command:

Press + to interact
pip3 install ansible[azure]

Update Dockerfile

You made some changes inside your container. If that container is deleted, all the changes will be lost. You can save your changes by updating the Dockerfile and rebuilding the image.

FROM ubuntu:latest
RUN apt-get update; \
    apt install openssh-client; \
    apt-get install -y wget curl apt-transport-https; \
    curl -sL https://aka.ms/InstallAzureCLIDeb | bash; \
    apt install -y python3-pip
   
RUN pip3 install --upgrade pip; \
    pip3 install "ansible==2.9.12"; \
    pip3 install ansible[azure]
Dockerfile

In this lesson, we introduced azure cli modules for sign in, created a service principal, and assigned permissions. Once connected, you created a resource group in Azure.

Get hands-on with 1300+ tech skills courses.