基于Azure+Terraform+Ansible实现静态IP原子化分配方案咨询

Great question—static IP allocation with concurrency safety in Azure using only Terraform + Ansible is a common pain point when external IPAM tools aren't an option. Let's break down three robust, industry-aligned solutions tailored to your stack:

方案1：Terraform状态锁 + 预定义静态IP池（Azure原生资源） #

This leverages Terraform's built-in state locking (with Azure Blob Storage as the backend) and pre-provisioned Azure static IP resources to eliminate concurrent IP conflicts.

实现步骤： #

1. Pre-create a pool of unassociated static private IPs in your target subnet:

resource "azurerm_private_ip_address" "static_ip_pool" {
  count               = 10 # Pre-allocate 10 static IPs
  name                = "static-ip-${count.index}"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  subnet_id           = azurerm_subnet.example.id
  private_ip_address_allocation = "Static"
  private_ip_address  = cidrhost(azurerm_subnet.example.address_prefix, 10 + count.index) # Start allocating from .10
}

2. Use a Terraform data source to filter for unassigned IPs at deployment time:

data "azurerm_private_ip_addresses" "available_ips" {
  resource_group_name = azurerm_resource_group.example.name
  subnet_id           = azurerm_subnet.example.id

  filter {
    name   = "ipConfiguration.id"
    values = [""] # Filter IPs not linked to any NIC
  }
}

3. Bind the first available IP to your VM's network interface:

resource "azurerm_network_interface" "vm_nic" {
  name                = "vm-nic-${var.vm_name}"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.example.id
    private_ip_address_id         = element(data.azurerm_private_ip_addresses.available_ips.ids, 0)
    private_ip_address_allocation = "Static"
  }
}

4. Enable Terraform state locking with Azure Blob Storage to enforce atomic operations:

terraform {
  backend "azurerm" {
    resource_group_name  = "tf-state-rg"
    storage_account_name = "tfstateaccount"
    container_name       = "tfstate"
    key                  = "prod.tfstate"
    enable_lock          = true
  }
}

优缺点： #

• ✅ Fully native to Azure + Terraform, no extra tools needed
• ✅ State locking natively guarantees atomicity
• ❌ Requires upfront IP pool planning; scaling needs manual adjustments to count

方案2：Ansible作为IP分配协调器 + 分布式锁 #

Here, Ansible handles atomic IP allocation using Azure Blob leases (for distributed locking), then passes the assigned IP to Terraform for VM deployment.

实现步骤： #

1. Maintain an IP inventory in Azure Blob Storage (ip_inventory.json):

{
  "available_ips": ["10.0.0.10", "10.0.0.11", "10.0.0.12"],
  "used_ips": {}
}

2. Ansible playbook to acquire a lock, allocate an IP, and update the inventory:

- name: Acquire lease for IP inventory blob
  azure_rm_storageblob:
    resource_group: tf-state-rg
    storage_account_name: ipinventoryaccount
    container: ipinventory
    blob: ip_inventory.json
    lease_state: acquired
    lease_duration: 300 # Lock for 5 minutes
    register: blob_lease

- name: Download IP inventory
  azure_rm_storageblob:
    resource_group: tf-state-rg
    storage_account_name: ipinventoryaccount
    container: ipinventory
    blob: ip_inventory.json
    dest: /tmp/ip_inventory.json
    lease_id: "{{ blob_lease.lease_id }}"

- name: Allocate first available IP
  set_fact:
    allocated_ip: "{{ (lookup('file', '/tmp/ip_inventory.json') | from_json).available_ips[0] }}"

- name: Update IP inventory (move IP to used list)
  copy:
    content: "{{ lookup('file', '/tmp/ip_inventory.json') | from_json | combine(
      {'available_ips': (lookup('file', '/tmp/ip_inventory.json') | from_json).available_ips[1:]},
      {'used_ips': {allocated_ip: '{{ vm_name }}'}}
    ) | to_json }}"
    dest: /tmp/ip_inventory.json

- name: Upload updated inventory
  azure_rm_storageblob:
    resource_group: tf-state-rg
    storage_account_name: ipinventoryaccount
    container: ipinventory
    blob: ip_inventory.json
    src: /tmp/ip_inventory.json
    lease_id: "{{ blob_lease.lease_id }}"

- name: Release blob lease
  azure_rm_storageblob:
    resource_group: tf-state-rg
    storage_account_name: ipinventoryaccount
    container: ipinventory
    blob: ip_inventory.json
    lease_id: "{{ blob_lease.lease_id }}"
    lease_state: released

3. Pass the allocated IP to Terraform as a variable:

- name: Deploy VM with static IP
  terraform:
    project_path: ./terraform-vm
    variables:
      vm_name: "{{ vm_name }}"
      static_ip: "{{ allocated_ip }}"
    state: present

4. Terraform uses the variable to configure the static IP:

variable "static_ip" {
  type = string
}

resource "azurerm_network_interface" "vm_nic" {
  name                = "vm-nic-${var.vm_name}"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.example.id
    private_ip_address            = var.static_ip
    private_ip_address_allocation = "Static"
  }
}

优缺点： #

• ✅ Flexible IP lifecycle management (easy to add IP recycling logic)
• ✅ Ansible handles atomicity, Terraform focuses on deployment
• ❌ Adds complexity via maintaining an external IP inventory

方案3：Azure子网IP范围预留 + Terraform动态分配 #

This uses Azure's subnet IP reservation feature combined with Terraform state tracking to auto-assign unused IPs, with state locking preventing concurrency issues.

实现步骤： #

1. Reserve a static IP range within your subnet:

resource "azurerm_subnet" "example" {
  name                 = "example-subnet"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.0.0.0/24"]

  private_ip_address_range {
    name            = "static-ip-range"
    address_prefix  = "10.0.0.10/28" # Reserve 16 IPs for static allocation
    allocation_type = "Static"
  }
}

2. Track allocated IPs using a local JSON file (synced with Terraform state):

data "file" "allocated_ips" {
  filename = "./allocated_ips.json"
}

locals {
  allocated_ips = jsondecode(data.file.allocated_ips.content)
  next_ip_index = length(local.allocated_ips) + 10 # Start from .10
  next_ip       = cidrhost(azurerm_subnet.example.address_prefix, local.next_ip_index)
}

3. Assign the next IP to the VM and update the tracking file:

resource "local_file" "allocated_ips" {
  content  = jsonencode(concat(local.allocated_ips, [local.next_ip]))
  filename = "./allocated_ips.json"
}

resource "azurerm_network_interface" "vm_nic" {
  name                = "vm-nic-${var.vm_name}"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.example.id
    private_ip_address            = local.next_ip
    private_ip_address_allocation = "Static"
  }

  depends_on = [local_file.allocated_ips]
}

4. Enable Terraform state locking to ensure only one deployment updates the IP tracking file at a time.

优缺点： #

• ✅ No pre-provisioned IP resources needed; auto-assigns from reserved range
• ✅ Aligns with Azure best practices for subnet IP management
• ❌ Requires syncing the IP tracking file across deployment environments

总结建议 #

• For small to medium-scale deployments (dozens of VMs), 方案1 is the most low-maintenance option, relying entirely on native Azure and Terraform features.
• If you need flexible IP recycling or custom allocation rules, 方案2 gives you full control via Ansible.
• For large-scale deployments, 方案3's dynamic auto-allocation is more efficient, combined with Azure's subnet reservation to avoid conflicts.

内容的提问来源于stack exchange，提问作者bry80921