[Doc] Reimplement Azure Databricks deployment guide to use VNet injection & NPIP

docs/guides/azure-workspace.md

@@ -13,8 +13,8 @@ The following sample configuration assumes you have been authorized with `az log
 ```hcl
 terraform {
   required_providers {
-    azurerm = "~> 2.33"
-    random  = "~> 2.2"
+    azurerm = "~> 4.0"
+    random  = "~> 3.6"
   }
 }
 
@@ -26,6 +26,17 @@ variable "region" {
   type    = string
   default = "westeurope"
 }
+variable "cidr" {
+  type        = string
+  default     = "10.179.0.0/20"
+  description = "Network range for created virtual network."
+}
+
+variable "no_public_ip" {
+  type        = bool
+  default     = true
+  description = "Defines whether Secure Cluster Connectivity (No Public IP) should be enabled."
+}
 
 resource "random_string" "naming" {
   special = false
@@ -54,13 +65,85 @@ resource "azurerm_resource_group" "this" {
   tags     = local.tags
 }
 
+resource "azurerm_virtual_network" "this" {
+  name                = "${local.prefix}-vnet"
+  resource_group_name = azurerm_resource_group.this.name
+  location            = azurerm_resource_group.this.location
+  address_space       = [var.cidr]
+  tags                = local.tags
+}
+
+resource "azurerm_network_security_group" "this" {
+  name                = "${local.prefix}-nsg"
+  resource_group_name = azurerm_resource_group.this.name
+  location            = azurerm_resource_group.this.location
+  tags                = local.tags
+}
+
+resource "azurerm_subnet" "public" {
+  name                 = "${local.prefix}-public"
+  resource_group_name  = azurerm_resource_group.this.name
+  virtual_network_name = azurerm_virtual_network.this.name
+  address_prefixes     = [cidrsubnet(var.cidr, 3, 0)]
+
+  delegation {
+    name = "databricks"
+    service_delegation {
+      name = "Microsoft.Databricks/workspaces"
+      actions = [
+        "Microsoft.Network/virtualNetworks/subnets/action",
+        "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
+        "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"
+      ]
+    }
+  }
+}
+
+resource "azurerm_subnet_network_security_group_association" "public" {
+  subnet_id                 = azurerm_subnet.public.id
+  network_security_group_id = azurerm_network_security_group.this.id
+}
+
+resource "azurerm_subnet" "private" {
+  name                 = "${local.prefix}-private"
+  resource_group_name  = azurerm_resource_group.this.name
+  virtual_network_name = azurerm_virtual_network.this.name
+  address_prefixes     = [cidrsubnet(var.cidr, 3, 1)]
+
+  delegation {
+    name = "databricks"
+    service_delegation {
+      name = "Microsoft.Databricks/workspaces"
+      actions = [
+        "Microsoft.Network/virtualNetworks/subnets/action",
+        "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
+        "Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"
+      ]
+    }
+  }
+}
+
+resource "azurerm_subnet_network_security_group_association" "private" {
+  subnet_id                 = azurerm_subnet.private.id
+  network_security_group_id = azurerm_network_security_group.this.id
+}
+
 resource "azurerm_databricks_workspace" "this" {
   name                        = "${local.prefix}-workspace"
   resource_group_name         = azurerm_resource_group.this.name
   location                    = azurerm_resource_group.this.location
   sku                         = "premium"
   managed_resource_group_name = "${local.prefix}-workspace-rg"
   tags                        = local.tags
+
+  custom_parameters {
+    no_public_ip                                         = var.no_public_ip
+    virtual_network_id                                   = azurerm_virtual_network.this.id
+    private_subnet_name                                  = azurerm_subnet.private.name
+    public_subnet_name                                   = azurerm_subnet.public.name
+    public_subnet_network_security_group_association_id  = azurerm_subnet_network_security_group_association.public.id
+    private_subnet_network_security_group_association_id = azurerm_subnet_network_security_group_association.private.id
+  }
 }
 
 output "databricks_host" {