azure Basic SKUロードバランサーをTerraformで構築する手順｜Standard移行との比較

この記事のポイント

・Basic SKU LBはTerraformで sku = "Basic" を指定するだけで定義できる
・Basic SKUはAvailability Setが必須、Standard SKUはVNet内の任意VMに対応
・Standard移行時はPublic IPのSKUとallocation_methodも同時に変更が必要
・Standard SKUへの移行後はアウトバウンドルールの追加が必要になる

mkdir azure-basic-lb-terraform
cd azure-basic-lb-terraform

# provider.tf
terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.95"
    }
  }
  required_version = ">= 1.5.0"
}

provider "azurerm" {
  features {}
}

# main.tf
resource "azurerm_resource_group" "rg" {
  name     = "rg-basic-lb-demo"
  location = "japaneast"
}

resource "azurerm_virtual_network" "vnet" {
  name                = "vnet-basic-lb"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
}

resource "azurerm_subnet" "subnet" {
  name                 = "subnet-backend"
  resource_group_name  = azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.0.1.0/24"]
}

# Basic SKUでは Availability Set が必須
resource "azurerm_availability_set" "avset" {
  name                = "avset-basic-lb"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  managed             = true
}

# lb.tf
resource "azurerm_public_ip" "pip" {
  name                = "pip-basic-lb"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  # Basic SKU は Dynamic のみ指定可
  allocation_method   = "Dynamic"
  sku                 = "Basic"
}

resource "azurerm_lb" "lb" {
  name                = "lb-basic-demo"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  sku                 = "Basic"

  frontend_ip_configuration {
    name                 = "frontend-config"
    public_ip_address_id = azurerm_public_ip.pip.id
  }
}

resource "azurerm_lb_backend_address_pool" "backend_pool" {
  name            = "backend-pool"
  loadbalancer_id = azurerm_lb.lb.id
}

resource "azurerm_lb_probe" "http_probe" {
  name            = "http-probe"
  loadbalancer_id = azurerm_lb.lb.id
  # Basic SKU は TCP・HTTP のみ（HTTPS 不可）
  protocol        = "Http"
  port            = 80
  request_path    = "/"
}

resource "azurerm_lb_rule" "http_rule" {
  name                           = "http-rule"
  loadbalancer_id                = azurerm_lb.lb.id
  protocol                       = "Tcp"
  frontend_port                  = 80
  backend_port                   = 80
  frontend_ip_configuration_name = "frontend-config"
  backend_address_pool_ids       = [azurerm_lb_backend_address_pool.backend_pool.id]
  probe_id                       = azurerm_lb_probe.http_probe.id
}

# vm.tf
resource "azurerm_network_interface" "nic" {
  count               = 2
  name                = "nic-vm-${count.index}"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name

  ip_configuration {
    name                          = "ipconfig"
    subnet_id                     = azurerm_subnet.subnet.id
    private_ip_address_allocation = "Dynamic"
  }
}

resource "azurerm_network_interface_backend_address_pool_association" "nic_assoc" {
  count                   = 2
  network_interface_id    = azurerm_network_interface.nic[count.index].id
  ip_configuration_name   = "ipconfig"
  backend_address_pool_id = azurerm_lb_backend_address_pool.backend_pool.id
}

resource "azurerm_linux_virtual_machine" "vm" {
  count                 = 2
  name                  = "vm-backend-${count.index}"
  location              = azurerm_resource_group.rg.location
  resource_group_name   = azurerm_resource_group.rg.name
  size                  = "Standard_B1s"
  # Availability Set への所属（Basic SKU の必須条件）
  availability_set_id   = azurerm_availability_set.avset.id
  admin_username        = "azureuser"
  network_interface_ids = [azurerm_network_interface.nic[count.index].id]

  admin_ssh_key {
    username   = "azureuser"
    public_key = file("~/.ssh/id_rsa.pub")
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "RedHat"
    offer     = "RHEL"
    sku       = "9-gen2"
    version   = "latest"
  }
}

terraform init
terraform plan -out=tfplan
terraform apply tfplan

az network public-ip show   --resource-group rg-basic-lb-demo   --name pip-basic-lb   --query "ipAddress"   -o tsv

# 出力例（環境により異なります）
# 20.XXX.XXX.XXX

# バックエンドVM上でポートのLISTEN状態を確認
ss -tlnp | grep :80

# 出力例（環境により異なります）
# LISTEN  0  511  0.0.0.0:80  0.0.0.0:*  users:(("nginx",pid=1234,fd=6))

# Basic SKU（変更前）
resource "azurerm_public_ip" "pip" {
  allocation_method = "Dynamic"
  sku               = "Basic"
}

# Standard SKU（変更後）
resource "azurerm_public_ip" "pip" {
  allocation_method = "Static"   # Dynamic から Static に変更
  sku               = "Standard" # Basic から Standard に変更
}

# Basic SKU（変更前）
resource "azurerm_lb" "lb" {
  sku = "Basic"
}

# Standard SKU（変更後）
resource "azurerm_lb" "lb" {
  sku = "Standard"
}

# Standard SKU では HTTPS プローブが使える
resource "azurerm_lb_probe" "https_probe" {
  name            = "https-probe"
  loadbalancer_id = azurerm_lb.lb.id
  protocol        = "Https"     # Basic では不可・Standard のみ対応
  port            = 443
  request_path    = "/health"
}

# Standard SKU でアウトバウンドを許可する場合
resource "azurerm_lb_outbound_rule" "outbound" {
  name                    = "outbound-rule"
  loadbalancer_id         = azurerm_lb.lb.id
  protocol                = "All"
  backend_address_pool_id = azurerm_lb_backend_address_pool.backend_pool.id

  frontend_ip_configuration {
    name = "frontend-config"
  }
}