Deploy CoPilot Using Terraform

Use the Aviatrix control plane Terraform modules to deploy Aviatrix CoPilot alongside an existing Controller on one of the following clouds:

AWS
Microsoft Azure
Google Cloud

The deployment does the following:

Creates a CoPilot instance in the Controller’s network.
Initializes CoPilot.
Connects CoPilot to the Controller.

When you complete this guide, you have a running CoPilot that you can log in to. This guide covers deploying CoPilot only. To deploy a Controller and CoPilot together, see the guide for your cloud:

Cloud	Guide
AWS	AWS Getting Started Guide
Azure	Azure Getting Started Guide
Google Cloud	The top-level control plane module. See Supported Modules.

Supported Modules

Aviatrix publishes one control plane module per cloud on the Terraform Registry. This guide uses the copilot_build submodule of each control plane module, together with the copilot-init module.

Cloud	Terraform Registry module
AWS	terraform-aviatrix-modules/aws-controlplane/aviatrix
Azure	terraform-aviatrix-modules/azure-controlplane/aviatrix
Google Cloud	terraform-aviatrix-modules/gcp-controlplane/aviatrix

Prerequisites

Before you deploy, make sure you have the following:

Terraform 1.3 or later.
An initialized Controller, and the following information about it:
- The Controller public and private IP addresses.
- The Controller admin email address and password.
- The Controller network IDs:
  - AWS: The VPC ID and subnet ID.
  - Azure: The resource group name and subnet ID.
  - Google Cloud: The network and subnetwork self-links.
A subscription to the Aviatrix CoPilot offer in your cloud provider’s marketplace. See Subscribe to the Aviatrix CoPilot Offer in the Marketplace for the steps.
On Azure, the module does not accept the marketplace terms for you, so accept them before you deploy.

Cloud credentials with permission to create the CoPilot resources in the Controller’s network:

Cloud	Credentials	Resources the credentials must be able to create
AWS	An authenticated AWS CLI	EC2 instances EBS volumes Elastic IP addresses Key pairs Security groups
Azure	An installed and authenticated Azure CLI	Virtual machines Managed disks Network interfaces Public IP addresses Network security groups
Google Cloud	A project and credentials that the Google provider can use	Compute Engine instances Disks Addresses Firewall rules

The public IP addresses or CIDRs that need HTTPS access to CoPilot.

Deploy CoPilot

The following steps deploy CoPilot into the network of an existing Controller. Select your cloud in each step.

Create a Working Directory

Create a directory for the deployment and add a main.tf file to it. Keep this directory separate from the rest of your Terraform pipeline.

Declare the Variables

Add the following variables to main.tf. Pass the passwords through environment variables, a .tfvars file that you do not commit, or a secrets manager.

variable "controller_public_ip" {
  type = string
}

variable "controller_private_ip" {
  type = string
}

variable "controller_admin_email" {
  type = string
}

variable "controller_admin_password" {
  type      = string
  sensitive = true
}

variable "copilot_service_account_password" {
  type      = string
  sensitive = true
}

On Azure, also add a variable for the CoPilot virtual machine admin password:

variable "copilot_vm_admin_password" {
  type      = string
  sensitive = true
}

Configure the Cloud Provider

Add the provider block for your cloud to main.tf.

AWS
Azure
Google Cloud

provider "aws" {
  region = "us-east-1"
}

provider "azurerm" {
  features {}
  subscription_id = "<subscription-id>"
}

provider "google" {
  project = "<project-id>"
  region  = "us-east1"
  zone    = "us-east1-b"
}

Authenticate through your cloud CLI or environment variables. Do not hard-code access keys or client secrets in the provider block.

Add the CoPilot Modules

Add the copilot module and the copilot_init module for your cloud to main.tf. The copilot module deploys the CoPilot instance in the Controller’s network. The copilot_init module initializes CoPilot and connects it to the Controller.Set the port 443 rule in allowed_cidrs to the addresses that need HTTPS access to CoPilot. The examples set the data disk because some module defaults do not create one.

Set the port 443 rule in allowed_cidrs only to trusted networks, such as the following:

Your corporate CIDR ranges
A VPN
A bastion host

Do not use 0.0.0.0/0. See Reduce Surface Area for other hardening steps.

AWS
Azure
Google Cloud

module "copilot" {
  source = "terraform-aviatrix-modules/aws-controlplane/aviatrix//modules/copilot_build"

  copilot_name             = "aviatrix-copilot"
  controller_public_ip     = var.controller_public_ip
  controller_private_ip    = var.controller_private_ip
  use_existing_vpc         = true
  vpc_id                   = "<controller-vpc-id>"
  subnet_id                = "<controller-subnet-id>"
  default_data_volume_name = "/dev/sdf"

  allowed_cidrs = {
    "tcp_cidrs" = {
      protocol  = "Tcp"
      from_port = 443
      cidrs     = ["203.0.113.10/32"]
    }
    "udp_5000_cidrs" = {
      protocol  = "Udp"
      from_port = 5000
      cidrs     = ["${var.controller_public_ip}/32"]
    }
    "udp_31283_cidrs" = {
      protocol  = "Udp"
      from_port = 31283
      cidrs     = ["${var.controller_public_ip}/32"]
    }
    "tcp_50441_50443_cidrs" = {
      protocol  = "Tcp"
      from_port = 50441
      to_port   = 50443
      cidrs = [
        "${var.controller_public_ip}/32",
        "${var.controller_private_ip}/32",
      ]
    }
  }
}

module "copilot_init" {
  source = "terraform-aviatrix-modules/copilot-init/aviatrix"

  controller_public_ip             = var.controller_public_ip
  controller_admin_password        = var.controller_admin_password
  copilot_public_ip                = module.copilot.public_ip
  service_account_email            = var.controller_admin_email
  copilot_service_account_password = var.copilot_service_account_password
}

module "copilot" {
  source = "terraform-aviatrix-modules/azure-controlplane/aviatrix//modules/copilot_build"

  copilot_name                   = "aviatrix-copilot"
  location                       = "East US"
  controller_public_ip           = var.controller_public_ip
  controller_private_ip          = var.controller_private_ip
  use_existing_vnet              = true
  resource_group_name            = "<controller-resource-group>"
  subnet_id                      = "<controller-subnet-id>"
  virtual_machine_admin_username = "aviatrix"
  virtual_machine_admin_password = var.copilot_vm_admin_password
  default_data_disk_size         = 100

  allowed_cidrs = {
    "tcp_cidrs_https" = {
      priority = "100"
      protocol = "Tcp"
      ports    = ["443"]
      cidrs    = ["203.0.113.10/32"]
    }
    "tcp_cidrs" = {
      priority = "101"
      protocol = "Tcp"
      ports    = ["50441-50443"]
      cidrs    = [var.controller_public_ip, var.controller_private_ip]
    }
    "udp_cidrs" = {
      priority = "200"
      protocol = "Udp"
      ports    = ["5000", "31283"]
      cidrs    = [var.controller_public_ip, var.controller_private_ip]
    }
  }
}

module "copilot_init" {
  source = "terraform-aviatrix-modules/copilot-init/aviatrix"

  controller_public_ip             = var.controller_public_ip
  controller_admin_password        = var.controller_admin_password
  copilot_public_ip                = module.copilot.public_ip
  service_account_email            = var.controller_admin_email
  copilot_service_account_password = var.copilot_service_account_password
}

module "copilot" {
  source = "terraform-aviatrix-modules/gcp-controlplane/aviatrix//modules/copilot_build"

  copilot_name          = "aviatrix-copilot"
  region                = "us-east1"
  zone                  = "us-east1-b"
  controller_public_ip  = var.controller_public_ip
  controller_private_ip = var.controller_private_ip
  use_existing_network  = true
  network               = "<controller-network-self-link>"
  subnetwork            = "<controller-subnetwork-self-link>"

  allowed_cidrs = {
    "tcp-443" = {
      protocol = "Tcp"
      ports    = ["443"]
      cidrs    = ["203.0.113.10/32"]
    }
    "udp-5000" = {
      protocol = "Udp"
      ports    = ["5000"]
      cidrs    = ["${var.controller_public_ip}/32"]
    }
    "udp-31283" = {
      protocol = "Udp"
      ports    = ["31283"]
      cidrs    = ["${var.controller_public_ip}/32"]
    }
    "tcp-50441-50443" = {
      protocol = "Tcp"
      ports    = ["50441-50443"]
      cidrs = [
        "${var.controller_public_ip}/32",
        "${var.controller_private_ip}/32",
      ]
    }
  }
}

module "copilot_init" {
  source = "terraform-aviatrix-modules/copilot-init/aviatrix"

  controller_public_ip             = var.controller_public_ip
  controller_admin_password        = var.controller_admin_password
  copilot_public_ip                = module.copilot.public_ip
  service_account_email            = var.controller_admin_email
  copilot_service_account_password = var.copilot_service_account_password
}

Add an Output for CoPilot

Add an output to main.tf that returns everything the copilot module provides, including the CoPilot public IP address.

output "copilot" {
  value = module.copilot
}

Deploy the CoPilot Instance

Run terraform init. Then run terraform apply -target=module.copilot, review the planned changes, and confirm.

Allow CoPilot to Reach the Controller

The CoPilot modules do not change the security group of the existing Controller. In your cloud provider, add a rule to the Controller’s security group that allows HTTPS (TCP port 443) from the CoPilot public IP address. To get the address, run terraform output copilot and use public_ip. Without this rule, copilot_init cannot reach the Controller and fails.

Initialize CoPilot

Run terraform apply, review the planned changes, and confirm.

Verify the Deployment

After terraform apply completes, log in to CoPilot to confirm that the deployment works.

Get the CoPilot IP Address

Run terraform output copilot and note the public_ip value.

Open https://<public_ip> in a browser. Log in with the username admin and the Controller admin password.

Verify Connectivity with the Controller

See Verify the CoPilot Deployment and the Connectivity with Controller.

Delete CoPilot

To remove CoPilot, run terraform destroy from the working directory. This removes only the resources that this deployment created. It does not delete the Controller.

Concepts & Architecture

Guides

Reference

Supported Modules

Prerequisites

Deploy CoPilot

Verify the Deployment

Delete CoPilot

​Supported Modules

​Prerequisites

​Deploy CoPilot

​Verify the Deployment

​Delete CoPilot

​Related Resources

Supported Modules

Prerequisites

Deploy CoPilot

Verify the Deployment

Delete CoPilot

Related Resources