Skip to content

Commit d9c566d

Browse files
ItsAJ1005ItsAJ1005
committed
Add - Terraform file to use the Redis module with all available features
1 parent d3d2b72 commit d9c566d

File tree

3 files changed

+435
-0
lines changed

3 files changed

+435
-0
lines changed

‎infrastructure/examples/redis/complete/main.tf‎

Lines changed: 335 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,335 @@
1+
# Complete example demonstrating all features of the Redis module
2+
3+
provider "azurerm" {
4+
features {}
5+
}
6+
7+
# Create a resource group
8+
resource "random_id" "this" {
9+
byte_length = 4
10+
}
11+
12+
resource "azurerm_resource_group" "this" {
13+
name = "redis-complete-example-${random_id.this.hex}-rg"
14+
location = var.location
15+
16+
tags = merge(
17+
var.tags,
18+
{
19+
Example = "Complete Redis Configuration"
20+
}
21+
)
22+
}
23+
24+
# Create a virtual network and subnets
25+
resource "azurerm_virtual_network" "this" {
26+
name = "redis-vnet-${random_id.this.hex}"
27+
address_space = ["10.0.0.0/16"]
28+
location = azurerm_resource_group.this.location
29+
resource_group_name = azurerm_resource_group.this.name
30+
31+
tags = var.tags
32+
}
33+
34+
# Subnet for Redis
35+
resource "azurerm_subnet" "redis" {
36+
name = "redis-subnet"
37+
resource_group_name = azurerm_resource_group.this.name
38+
virtual_network_name = azurerm_virtual_network.this.name
39+
address_prefixes = ["10.0.1.0/24"]
40+
41+
enforce_private_link_endpoint_network_policies = true
42+
service_endpoints = ["Microsoft.Storage"]
43+
44+
# Required for Redis
45+
delegation {
46+
name = "redis-delegation"
47+
48+
service_delegation {
49+
name = "Microsoft.Cache/redis"
50+
actions = [
51+
"Microsoft.Network/virtualNetworks/subnets/join/action"
52+
]
53+
}
54+
}
55+
}
56+
57+
# Subnet for private endpoints
58+
resource "azurerm_subnet" "private_endpoints" {
59+
name = "private-endpoints"
60+
resource_group_name = azurerm_resource_group.this.name
61+
virtual_network_name = azurerm_virtual_network.this.name
62+
address_prefixes = ["10.0.2.0/24"]
63+
64+
enforce_private_link_endpoint_network_policies = true
65+
66+
tags = var.tags
67+
}
68+
69+
# Storage account for Redis backups
70+
resource "azurerm_storage_account" "backup" {
71+
name = "redisbackup${random_id.this.hex}"
72+
resource_group_name = azurerm_resource_group.this.name
73+
location = azurerm_resource_group.this.location
74+
account_tier = "Standard"
75+
account_replication_type = "LRS"
76+
77+
network_rules {
78+
default_action = "Deny"
79+
ip_rules = []
80+
virtual_network_subnet_ids = [
81+
azurerm_subnet.redis.id
82+
]
83+
}
84+
85+
tags = var.tags
86+
}
87+
88+
# Log Analytics workspace for diagnostics
89+
resource "azurerm_log_analytics_workspace" "this" {
90+
name = "redis-logs-${random_id.this.hex}"
91+
location = azurerm_resource_group.this.location
92+
resource_group_name = azurerm_resource_group.this.name
93+
sku = "PerGB2018"
94+
retention_in_days = 30
95+
96+
tags = var.tags
97+
}
98+
99+
# Key Vault for customer-managed keys
100+
resource "azurerm_key_vault" "this" {
101+
name = "redis-kv-${random_id.this.hex}"
102+
location = azurerm_resource_group.this.location
103+
resource_group_name = azurerm_resource_group.this.name
104+
enabled_for_disk_encryption = true
105+
tenant_id = data.azurerm_client_config.current.tenant_id
106+
soft_delete_retention_days = 7
107+
purge_protection_enabled = true
108+
109+
sku_name = "standard"
110+
111+
network_acls {
112+
default_action = "Deny"
113+
bypass = "AzureServices"
114+
ip_rules = []
115+
virtual_network_subnet_ids = [
116+
azurerm_subnet.redis.id
117+
]
118+
}
119+
120+
tags = var.tags
121+
}
122+
123+
# Key Vault access policy for current user
124+
resource "azurerm_key_vault_access_policy" "current_user" {
125+
key_vault_id = azurerm_key_vault.this.id
126+
tenant_id = data.azurerm_client_config.current.tenant_id
127+
object_id = data.azurerm_client_config.current.object_id
128+
129+
key_permissions = [
130+
"Create",
131+
"Get",
132+
"List",
133+
"Update",
134+
"Delete",
135+
"Recover",
136+
"Purge",
137+
"GetRotationPolicy",
138+
"SetRotationPolicy"
139+
]
140+
141+
secret_permissions = [
142+
"Set",
143+
"Get",
144+
"List",
145+
"Delete",
146+
"Purge",
147+
"Recover"
148+
]
149+
}
150+
151+
# Create a key for Redis encryption
152+
resource "azurerm_key_vault_key" "redis" {
153+
name = "redis-encryption-key"
154+
key_vault_id = azurerm_key_vault.this.id
155+
key_type = "RSA"
156+
key_size = 2048
157+
158+
key_opts = [
159+
"decrypt",
160+
"encrypt",
161+
"sign",
162+
"unwrapKey",
163+
"verify",
164+
"wrapKey",
165+
]
166+
167+
depends_on = [
168+
azurerm_key_vault_access_policy.current_user
169+
]
170+
171+
tags = var.tags
172+
}
173+
174+
# Create a user-assigned managed identity for Redis
175+
resource "azurerm_user_assigned_identity" "redis" {
176+
name = "redis-identity-${random_id.this.hex}"
177+
resource_group_name = azurerm_resource_group.this.name
178+
location = azurerm_resource_group.this.location
179+
180+
tags = var.tags
181+
}
182+
183+
# Grant the managed identity access to the Key Vault key
184+
resource "azurerm_key_vault_access_policy" "redis_identity" {
185+
key_vault_id = azurerm_key_vault.this.id
186+
tenant_id = data.azurerm_client_config.current.tenant_id
187+
object_id = azurerm_user_assigned_identity.redis.principal_id
188+
189+
key_permissions = [
190+
"Get",
191+
"UnwrapKey",
192+
"WrapKey"
193+
]
194+
195+
depends_on = [
196+
azurerm_user_assigned_identity.redis
197+
]
198+
}
199+
200+
# Deploy Redis with all features enabled
201+
module "redis" {
202+
source = "../../" # Adjust the path to the module source
203+
204+
project_name = "complete-example"
205+
environment = var.environment
206+
location = azurerm_resource_group.this.location
207+
resource_group_name = azurerm_resource_group.this.name
208+
209+
# High availability configuration
210+
sku_name = "Premium"
211+
sku_capacity = 1 # P1
212+
family = "P"
213+
shard_count = 2
214+
replicas_per_master = 1
215+
zones = ["1", "2", "3"]
216+
217+
# Security
218+
enable_non_ssl_port = false
219+
minimum_tls_version = "1.2"
220+
public_network_access_enabled = false
221+
222+
# Network
223+
subnet_id = azurerm_subnet.redis.id
224+
private_static_ip_address = "10.0.1.10"
225+
enable_private_endpoint = true
226+
private_endpoint_subnet_id = azurerm_subnet.private_endpoints.id
227+
228+
# Redis configuration
229+
redis_configuration = {
230+
maxmemory_policy = "allkeys-lru"
231+
maxmemory_reserved = 4
232+
maxfragmentationmemory_reserved = 4
233+
maxmemory_delta = 4
234+
notify_keyspace_events = "KExg"
235+
236+
# Backup configuration
237+
rdb_backup_enabled = true
238+
rdb_backup_frequency = 60
239+
rdb_backup_max_snapshot_count = 3
240+
rdb_storage_connection_string = azurerm_storage_account.backup.primary_blob_connection_string
241+
242+
# AOF persistence (Premium only)
243+
aof_backup_enabled = true
244+
aof_storage_connection_string_0 = azurerm_storage_account.backup.primary_blob_connection_string
245+
aof_storage_connection_string_1 = azurerm_storage_account.backup.secondary_blob_connection_string
246+
}
247+
248+
# Patch schedule
249+
patch_schedules = [
250+
{
251+
day_of_week = "Sunday"
252+
start_hour_utc = 2
253+
},
254+
{
255+
day_of_week = "Wednesday"
256+
start_hour_utc = 3
257+
}
258+
]
259+
260+
# Firewall rules
261+
firewall_rules = [
262+
{
263+
name = "allow-aks-nodes"
264+
start_ip_address = "10.0.1.0"
265+
end_ip_address = "10.0.1.255"
266+
},
267+
{
268+
name = "allow-vnet"
269+
start_ip_address = "10.0.0.0"
270+
end_ip_address = "10.0.255.255"
271+
}
272+
]
273+
274+
# Redis modules (Premium only)
275+
redis_modules = [
276+
{
277+
name = "RedisJSON"
278+
version = "v100"
279+
},
280+
{
281+
name = "RediSearch"
282+
version = "v202"
283+
}
284+
]
285+
286+
# Customer-managed key for encryption at rest
287+
customer_managed_key = {
288+
key_vault_key_id = azurerm_key_vault_key.redis.id
289+
identity_client_id = azurerm_user_assigned_identity.redis.client_id
290+
}
291+
292+
# Managed identity
293+
identity_type = "UserAssigned"
294+
user_assigned_identity_ids = [azurerm_user_assigned_identity.redis.id]
295+
296+
# Monitoring
297+
enable_diagnostic_setting = true
298+
log_analytics_workspace_id = azurerm_log_analytics_workspace.this.id
299+
storage_account_id = azurerm_storage_account.backup.id
300+
301+
tags = merge(
302+
var.tags,
303+
{
304+
Environment = var.environment
305+
Example = "Complete Configuration"
306+
}
307+
)
308+
309+
depends_on = [
310+
azurerm_key_vault_access_policy.redis_identity
311+
]
312+
}
313+
314+
# Output the Redis connection details
315+
output "redis_hostname" {
316+
value = module.redis.redis_hostname
317+
description = "The hostname of the Redis instance"
318+
}
319+
320+
output "redis_ssl_port" {
321+
value = module.redis.redis_ssl_port
322+
description = "The SSL port of the Redis instance"
323+
}
324+
325+
output "private_endpoint_fqdn" {
326+
value = module.redis.private_endpoint_fqdn
327+
description = "The FQDN of the private endpoint"
328+
}
329+
330+
output "resource_group_name" {
331+
value = azurerm_resource_group.this.name
332+
description = "The name of the resource group"
333+
}
334+
335+
data "azurerm_client_config" "current" {}

‎infrastructure/examples/redis/complete/variables.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
variable "location" {
2+
description = "The Azure region where resources will be created"
3+
type = string
4+
default = "eastus"
5+
}
6+
7+
variable "environment" {
8+
description = "The deployment environment (e.g., dev, test, prod)"
9+
type = string
10+
default = "test"
11+
12+
validation {
13+
condition = contains(["dev", "test", "prod"], lower(var.environment))
14+
error_message = "Environment must be one of: dev, test, prod"
15+
}
16+
}
17+
18+
variable "tags" {
19+
description = "A mapping of tags to assign to all resources"
20+
type = map(string)
21+
default = {
22+
Environment = "Test"
23+
ManagedBy = "Terraform"
24+
Project = "RedisExample"
25+
}
26+
}

0 commit comments

Comments
 (0)