Provision a GCP VM with Active Directory Join and DNS Registration

id: gcp-provision-vm-ad-dns
namespace: company.team
description: |
  Provision a Linux VM on Google Cloud with Terraform, wait for boot, join it
  to an Active Directory domain, and register its DNS record on the Windows
  domain controller via Ansible. The VM is tracked as a Kestra Asset.

inputs:
  - id: vmName
    type: STRING
    defaults: gcpdevlnxap08

  - id: ipAddress
    type: STRING
    description: Static internal IP for the VM.
    defaults: 10.128.10.8

  - id: vmSize
    type: STRING
    defaults: n1-standard-1

  - id: zone
    type: STRING
    defaults: us-central1-a

  - id: billingAccount
    type: STRING
    description: GCP project ID.
    defaults: my-gcp-project

  - id: osFlavor
    type: STRING
    defaults: ubuntu-os-cloud/ubuntu-2204-lts

  - id: network
    type: STRING
    defaults: default

  - id: subnet
    type: STRING
    defaults: default

tasks:
  - id: createVM
    type: io.kestra.plugin.terraform.cli.TerraformCLI
    description: Provision the instance with per-VM state in a shared GCS backend.
    env:
      GOOGLE_APPLICATION_CREDENTIALS: gcp-svc-account.json
    inputFiles:
      gcp-svc-account.json: "{{ secret('GCP_SERVICE_ACCOUNT_JSON') }}"
      backend.tf: |
        terraform {
          backend "gcs" {
            # Replace with your Terraform state bucket
            bucket = "my-terraform-state-bucket"
          }
        }
      main.tf: |
        resource "google_compute_instance" "default" {
          name         = "{{ inputs.vmName }}"
          machine_type = "{{ inputs.vmSize }}"
          zone         = "{{ inputs.zone }}"
          project      = "{{ inputs.billingAccount }}"

          boot_disk {
            initialize_params {
              image = "{{ inputs.osFlavor }}"
            }
          }

          network_interface {
            network            = "{{ inputs.network }}"
            subnetwork         = "{{ inputs.subnet }}"
            subnetwork_project = "{{ inputs.billingAccount }}"
            access_config {}
            network_ip = "{{ inputs.ipAddress }}"
          }

          metadata = {
            enable-oslogin = false
            "ssh-keys"     = <<EOT
              root:{{ secret('SSH_PUBLIC_KEY') }}
             EOT
          }
        }

        output "external_ip" {
          value       = google_compute_instance.default.network_interface[0].access_config[0].nat_ip
          description = "The external IP address of the VM"
        }
    beforeCommands:
      - terraform init -backend-config="prefix={{ inputs.vmName }}"
    commands:
      - terraform plan
      - terraform apply -auto-approve -json
      - terraform output -raw external_ip > external_ip.txt
    outputFiles:
      - "*.txt"
    assets:
      outputs:
        - id: "{{ inputs.vmName }}"
          type: io.kestra.plugin.ee.assets.VM
          metadata:
            vmName: "{{ inputs.vmName }}"
            vmSize: "{{ inputs.vmSize }}"
            zone: "{{ inputs.zone }}"
            billingAccount: "{{ inputs.billingAccount }}"
            osFlavor: "{{ inputs.osFlavor }}"
            network: "{{ inputs.network }}"
            subnet: "{{ inputs.subnet }}"
            ipAddress: "{{ inputs.ipAddress }}"
            state: active

  - id: waitForStartupBootConfig
    type: io.kestra.plugin.core.flow.Sleep
    description: Give the instance time to boot before configuration.
    duration: PT5M

  - id: addVMtoAD
    type: io.kestra.plugin.ansible.cli.AnsibleCLI
    description: Join the new Linux VM to the Active Directory domain over SSH.
    inputFiles:
      id_rsa: "{{ secret('SSH_PRIVATE_KEY') }}"
      inventory.ini: |
        [linux_vms]
        {{ read(outputs.createVM.outputFiles['external_ip.txt']) }} ansible_user=root ansible_ssh_private_key_file=id_rsa ansible_ssh_common_args='-o StrictHostKeyChecking=no'
      playbook.yml: |
        ---
        - name: Execute AD join script
          hosts: linux_vms
          become: yes
          tasks:
            - name: Join the domain
              ansible.builtin.shell: |
                #!/bin/bash
                set -e
                DC_IP="{{ kv('dcConfig').internalIPAddress }}"
                DC_FQDN="{{ kv('dcConfig').vmName }}.{{ kv('dcConfig').domainName }}"
                DOMAIN="{{ kv('dcConfig').domainName }}"
                ADMIN_PASS="{{ secret('AD_ADMIN_PASSWORD') }}"

                # Kerberos needs the DC resolvable by name
                if ! grep -q "$DOMAIN" /etc/hosts; then
                  echo -e "$DC_IP\t$DC_FQDN\t$DOMAIN" >> /etc/hosts
                fi

                # Wait for the DC's DNS service before joining
                until nc -z -v -w5 $DC_IP 53; do sleep 10; done

                apt-get update
                DEBIAN_FRONTEND=noninteractive apt-get install -y realmd sssd sssd-tools adcli samba-common-bin ntpdate

                # Point DNS at the domain controller
                echo "[Resolve]
                DNS=$DC_IP
                Domains=$DOMAIN" > /etc/systemd/resolved.conf
                systemctl restart systemd-resolved

                # Kerberos requires time drift under 5 minutes
                until ntpdate -u $DC_IP; do sleep 5; done

                echo "$ADMIN_PASS" | realm join $DOMAIN -U Administrator --verbose
                pam-auth-update --enable mkhomedir
    commands:
      - chmod 600 id_rsa
      - ansible-playbook -i inventory.ini playbook.yml

  - id: addDNSentry
    type: io.kestra.plugin.ansible.cli.AnsibleCLI
    description: Register the VM's A and PTR records on the Windows DC over WinRM.
    beforeCommands:
      - pip install pywinrm
    inputFiles:
      inventory.ini: |
        [windows_vms]
        {{ kv('dcConfig').externalIPAddress }}

        [windows_vms:vars]
        ansible_user={{ kv('dcConfig').username }}
        ansible_password="{{ secret('AD_ADMIN_PASSWORD') }}"
        ansible_connection=winrm
        ansible_port=5985
        ansible_winrm_server_cert_validation=ignore
        ansible_winrm_transport=ntlm
      playbook.yml: |
        ---
        - name: Register DNS records on the domain controller
          hosts: windows_vms
          gather_facts: no
          tasks:
            - name: Create the A record with PTR
              ansible.windows.win_shell: |
                try {
                    Add-DnsServerResourceRecordA -Name "{{ inputs.vmName }}" -ZoneName "{{ kv('dcConfig').domainName }}" -IPv4Address "{{ inputs.ipAddress }}" -CreatePtr
                } catch {
                    Write-Error "Adding DNS entry failed. Error: $_"
                }
              register: dns_script_output

            - name: Print output to Kestra logs
              debug:
                var: dns_script_output.stdout_lines
    commands:
      - ansible-playbook -i inventory.ini playbook.yml

outputs:
  - id: externalIpAddress
    type: STRING
    value: "{{ read(outputs.createVM.outputFiles['external_ip.txt']) }}"