Create a BYOVNet Cluster on Azure

terraform {
  required_providers {
    redpanda = {
      source  = "redpanda-data/redpanda"
      version = ">= 2.5.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 5.5"
    }
  }
}

provider "azurerm" {
  features {}
  subscription_id = local.azure_subscription_id

  # The module disables shared-key access on its storage accounts.
  # Without this setting, the provider's post-create data-plane check
  # fails with KeyBasedAuthenticationNotPermitted.
  storage_use_azuread = true
}

# Reads REDPANDA_CLIENT_ID and REDPANDA_CLIENT_SECRET from the environment.
provider "redpanda" {
  # The Redpanda provider does not read the subscription from the Azure
  # CLI. It needs the subscription ID to run the agent bootstrap.
  azure_subscription_id = local.azure_subscription_id
}

locals {
  azure_subscription_id = "<azure-subscription-id>"
  azure_tenant_id       = "<azure-tenant-id>"

  # Use a region and zones from BYOC supported regions (Azure tab).
  region = "eastus"
  zones  = ["eastus-az1", "eastus-az2", "eastus-az3"]

  # Prefix added to every Azure resource name that the module creates.
  # Storage account names use it with dashes removed, and must fit
  # the 24-character storage account limit, so keep it short.
  resource_name_prefix = "rp-"

  # Prefix added to every resource group name that the module creates.
  resource_group_name_prefix = "rp-"

  # The module reserves this CIDR for AKS services inside the VNet, and
  # the cluster declares the same value, so one local feeds both.
  aks_service_cidr = "10.0.15.0/24"

  tags = {
    "environment" = "dev"
    "managed-by"  = "terraform"
  }
}

module "redpanda_byovnet" {
  source  = "redpanda-data/redpanda-byovnet/azure"
  version = "~> 2.0"

  region                = local.region
  zones                 = local.zones
  azure_tenant_id       = local.azure_tenant_id
  azure_subscription_id = local.azure_subscription_id

  resource_name_prefix       = local.resource_name_prefix
  resource_group_name_prefix = local.resource_group_name_prefix
  reserved_subnet_cidrs      = { "k8s-service" = local.aks_service_cidr }

  # The Redpanda agent bootstrap keeps its Terraform state in the
  # management storage account, which allows only Microsoft Entra ID
  # authentication. This grants the identity that runs Terraform the
  # Storage Blob Data Contributor role on that storage account.
  grant_caller_management_storage_access = true

  tags = local.tags
}

locals {
  # A Redpanda Cloud resource group, not an Azure resource group.
  redpanda_cloud_resource_group_name = "byovnet"
  throughput_tier                    = "tier-1-azure-v3-x86"
}

resource "redpanda_resource_group" "byovnet" {
  name = local.redpanda_cloud_resource_group_name
}

resource "redpanda_network" "network" {
  name              = "${local.resource_name_prefix}network"
  resource_group_id = redpanda_resource_group.byovnet.id
  cloud_provider    = "azure"
  region            = local.region
  cluster_type      = "byoc"

  customer_managed_resources = {
    azure = {
      management_bucket = {
        storage_account_name   = module.redpanda_byovnet.management_bucket_storage_account_name
        storage_container_name = module.redpanda_byovnet.management_bucket_storage_container_name
        resource_group         = { name = module.redpanda_byovnet.redpanda_resource_group_name }
      }
      vnet = {
        name           = module.redpanda_byovnet.vnet_name
        resource_group = { name = module.redpanda_byovnet.network_resource_group_name }
      }
      subnets = {
        rp_agent           = { name = module.redpanda_byovnet.agent_private_subnet_name }
        rp_0_pods          = { name = module.redpanda_byovnet.rp_0_pods_subnet_name }
        rp_0_vnet          = { name = module.redpanda_byovnet.rp_0_vnet_subnet_name }
        rp_1_pods          = { name = module.redpanda_byovnet.rp_1_pods_subnet_name }
        rp_1_vnet          = { name = module.redpanda_byovnet.rp_1_vnet_subnet_name }
        rp_2_pods          = { name = module.redpanda_byovnet.rp_2_pods_subnet_name }
        rp_2_vnet          = { name = module.redpanda_byovnet.rp_2_vnet_subnet_name }
        rp_connect_pods    = { name = module.redpanda_byovnet.rp_connect_pods_subnet_name }
        rp_connect_vnet    = { name = module.redpanda_byovnet.rp_connect_vnet_subnet_name }
        kafka_connect_pods = { name = module.redpanda_byovnet.kafka_connect_pods_subnet_name }
        kafka_connect_vnet = { name = module.redpanda_byovnet.kafka_connect_vnet_subnet_name }
        sys_pods           = { name = module.redpanda_byovnet.system_pods_subnet_name }
        sys_vnet           = { name = module.redpanda_byovnet.system_vnet_subnet_name }
        rp_egress_vnet     = { name = module.redpanda_byovnet.egress_subnet_name }
      }
    }
  }
  depends_on = [module.redpanda_byovnet]
}

resource "redpanda_cluster" "cluster" {
  name              = "${local.resource_name_prefix}cluster"
  resource_group_id = redpanda_resource_group.byovnet.id
  network_id        = redpanda_network.network.id
  cloud_provider    = "azure"
  region            = redpanda_network.network.region
  zones             = local.zones
  cluster_type      = "byoc"
  connection_type   = "private"
  throughput_tier   = local.throughput_tier
  allow_deletion    = false
  tags              = local.tags

  customer_managed_resources = {
    azure = {
      resource_groups = {
        redpanda_resource_group = { name = module.redpanda_byovnet.redpanda_resource_group_name }
        storage_resource_group  = { name = module.redpanda_byovnet.storage_resource_group_name }
        iam_resource_group      = { name = module.redpanda_byovnet.iam_resource_group_name }
      }
      user_assigned_identities = {
        agent_user_assigned_identity           = { name = module.redpanda_byovnet.agent_user_assigned_identity_name }
        aks_user_assigned_identity             = { name = module.redpanda_byovnet.aks_user_assigned_identity_name }
        redpanda_cluster_assigned_identity     = { name = module.redpanda_byovnet.cluster_user_assigned_identity_name }
        cert_manager_assigned_identity         = { name = module.redpanda_byovnet.cert_manager_user_assigned_identity_name }
        external_dns_assigned_identity         = { name = module.redpanda_byovnet.external_dns_user_assigned_identity_name }
        redpanda_console_assigned_identity     = { name = module.redpanda_byovnet.console_user_assigned_identity_name }
        kafka_connect_assigned_identity        = { name = module.redpanda_byovnet.kafka_connect_user_assigned_identity_name }
        redpanda_connect_assigned_identity     = { name = module.redpanda_byovnet.redpanda_connect_user_assigned_identity_name }
        redpanda_connect_api_assigned_identity = { name = module.redpanda_byovnet.redpanda_connect_api_user_assigned_identity_name }
        redpanda_operator_assigned_identity    = { name = module.redpanda_byovnet.redpanda_operator_user_assigned_identity_name }
      }
      tiered_cloud_storage = {
        storage_account_name   = module.redpanda_byovnet.tiered_storage_account_name
        storage_container_name = module.redpanda_byovnet.tiered_storage_container_name
        resource_group         = { name = module.redpanda_byovnet.storage_resource_group_name }
      }
      key_vaults = {
        management_vault = { name = module.redpanda_byovnet.management_key_vault_name }
        console_vault    = { name = module.redpanda_byovnet.console_key_vault_name }
      }
      security_groups = {
        redpanda_security_group = { name = module.redpanda_byovnet.redpanda_security_group_name }
      }
      cidrs = {
        aks_service_cidr = local.aks_service_cidr
      }
    }
  }

  # Azure cluster creation and deletion can outlast the default timeouts.
  timeouts = {
    create = "150m"
    delete = "150m"
  }

  depends_on = [redpanda_network.network]
}

output "byovnet" {
  description = "Names of the Azure resources that the Redpanda BYOVNet module created"
  value       = { for k, v in module.redpanda_byovnet : k => v if endswith(k, "_name") }
}

terraform init &&
terraform plan &&
terraform apply

terraform destroy

variable "cluster_id" {
  type = string
}

action "redpanda_byoc_agent_apply" "cluster" {
  config {
    cluster_id = var.cluster_id
  }
}

terraform apply -invoke=action.redpanda_byoc_agent_apply.cluster
terraform apply