Citrix has developed a custom Terraform provider for automating Citrix product deployments and configurations. Using Terraform with Citrix provider, you can manage your Citrix products via Infrastructure as Code, giving you higher efficiency and consistency on infrastructure management, as well as better reusability on infrastructure configuration. The provider is developed and maintained by Citrix.
- Plugin for Terraform Provider for Citrix®
- Table of Contents
- Contacting the Maintainers
- Examples
- Related Citrix Automation Repositories
- Plugin for Terraform Provider for Citrix® Documentation
- Using the Plugin for Terraform Provider for Citrix DaaS™
- Install Terraform
- (On-Premises Only) Enable Web Studio
- (Cloud Only) Create a Citrix Cloud Service Principal
- Configure your Plugin for Terraform Provider for Citrix DaaS™
- Start writing Terraform for managing your Citrix DaaS site
- Create a Zone in Citrix DaaS as the first step
- Create a Hypervisor
- Create a Hypervisor Resource Pool
- Create a Machine Catalog
- Create a Delivery Group
- Roadmap Proposal for a Smoother Onboarding Experience
- Using the Plugin for Terraform Provider for other Citrix resources
- Frequently Asked Questions
- Attributions
- License
This project uses GitHub to track all issues. See CONTRIBUTING.md for more information.
Basic example templates for getting started can be found in the repository at examples/
Please refer to Citrix Tech Zone to find detailed guides on how to deploy and manage resources using the Citrix provider:
- Installing and configuring the provider
- Daily administrative operations
- AWS EC2 via MCS
- AWS WorkSpaces Core
- Azure via MCS
- GCP via MCS
- vSphere via MCS
- XenServer via MCS
- Citrix policies
https://www.youtube.com/watch?v=c33sMLaCVjY
| Title | Details |
|---|---|
| Packer Image Management Module for Citrix® Virtual Apps and Desktops | Use Packer to create golden images with the Citrix VDA installed and using Citrix best practices. |
| Citrix Ansible Tools | Playbooks to install Citrix components using automation such as the VDA. |
| Site Deployment Module for Citrix® Virtual Apps and Desktops | Uses PowerShell to drive Terraform files to create a fully functional CVAD site. |
internalfolder - Contains the following sub directories:providerfolder - Contains the Citrix provider implementation for Terraformdaasfolder - Contains all the Citrix DaaS resources libraries that we support through Terraform.testfolder - Contains the Go tests for bothproviderand allresourcesthat we have.utilfolder - Contains general utility functions that can be reused.
examplesfolder - Contains the examples for users to use various Citrix resources e.g zone folder contains the resources.tf that illustrates how citrix_zone resource can be used to create a DaaS Zone on target Citrix DaaS site. There are also examples for Citrix provider configuration for both Citrix Cloud customer and Citrix on-premises customers. Users can use the examples as a starting point to configure their own Citrix Terraform script.docsfolder - resources - contains the documentation for all resource configurations supported through Terraform. Refer this to understand the properties, accepted values, and how various properties work together for each type of resource.
provider.tf contains the information on target DaaS site where you want to apply configuration.
Depending on whether its managing a Citrix Cloud site, or a Citrix on-premises site, Citrix provider should be configured differently.
Example for on-premises site:
provider "citrix" {
cvad_config = {
hostname = "10.71.136.250" # Optionally set with `CITRIX_HOSTNAME` environment variable.
client_id = "${var.domain_admin_id}" # Optionally set with `CITRIX_CLIENT_ID` environment variable.
client_secret = "${var.domain_admin_secret}" # Optionally set with `CITRIX_CLIENT_SECRET` environment variable.
}
}Example for Cloud site:
provider "citrix" {
cvad_config = {
customer_id = "${var.customer_id}" # Optionally set with `CITRIX_CUSTOMER_ID` environment variable.
client_id = "${var.api_key_clientId}" # Optionally set with `CITRIX_CLIENT_ID` environment variable.
client_secret = "${var.api_key_clientSecret}" # Optionally set with `CITRIX_CLIENT_SECRET` environment variable.
}
}You can use environment variables as stated in the comments above. When running Go tests, always use environment variables so that no credentials or other sensitive information are checked-in to the code.
Below is a table to show the difference between on-premises and Cloud provider configuration:
| Cloud | On-Premises | |
|---|---|---|
| environment | Production, Japan, Gov |
N/A |
| customerId | Cloud Customer Id | N/A |
| hostname | (Optional) Cloud DDC hostname | On-Premises DDC Hostname / IP address |
| clientId | Citrix Cloud service principal ID | Domain Admin Username |
| clientSecret | Citrix Cloud service principal secret | Domain Admin Password |
Resources.tf can be used to configure the desired state of the resources that you want to create and manage in your Citrix Services. The example below shows how you can configure a Citrix DaaS Zone in Citrix DaaS service in resource.tf.
citrix_zone
resource "citrix_zone" "example-zone" {
name = "example-zone"
description = "zone example"
metadata = [
{
name = "key1"
value = "value1"
}
]
}Please refer the Plugin for Terraform Provider for Citrix DaaS™ documentation such as docs/resources/zone.md to find out the configurable properties of each type of resources, understand what they do, and what option values are supported.
Refer the Hashicorp documentation for installing Terraform CLI for your own environment.
For on-premises sites with version >= 2311 are supported. Web Studio needs to be installed and configured for the provider to work.
A service principal is an API client which is not associated with an email. It can be given delegated permissions just like a regular administrator. Follow the Citrix Cloud API Access with Service Principals guide to create a service principal for your cloud customer. When selecting the service principal's access choose an appropriate DaaS role.
Refer to section Provider Configuration to configure the provider for the Citrix DaaS site you want to manage with Terraform.
To find all the Citrix DaaS resources manageable via Terraform, understand all the configurable properties for each resource and how they work together, refer documentations for resources in Citrix Terraform resource documentation. To better understand how the resource is managed via Citrix DaaS Rest API, you can refer the Citrix DaaS Rest API documentation.
Refer the DaaS Zone documentation to configure a zone via terraform.
Hypervisor is needed to use your preferred public cloud provider with Citrix DaaS. Refer the DaaS Hypervisor documentation to configure an Azure hypervisor in a zone via terraform.
The hypervisor resource pool defines the network configuration for a hypervisor connection. Refer the DaaS Hypervisor Resource Pool documentation to configure an Azure hypervisr resource pool via terraform.
A machine catalog is a collection of machines managed as a single entity. Refer the DaaS Machine Catalog documentation to configure a machine catalog via terraform.
A delivery group is a collection of machines selected from one or more machine catalogs. The delivery group can also specify which users can use those machines, plus the applications and desktops available to those users. Refer the DaaS Delivery Group documentation to configure a delivery group via terraform.
To streamline your onboarding experience with the Citrix Terraform Provider, we recommend starting with the core resources essential for a Citrix deployment:
- Resource Location (for Citrix Cloud customers only)
- Zone
- Hypervisor
- Hypervisor Resource Pool
These resources are straightforward to configure and can be created or removed quickly. Begin your Terraform journey with these resources to build confidence in managing your Citrix deployment via Terraform.
Once these resources are properly configured, the next step is to set up your machine catalog with Terraform. Managing the machine catalog with Terraform will provide a solid foundation for designing a pipeline that meets your specific use case.
The Global App Configuration service provides a centralized setup for IT admins to easily configure Citrix Workspace app settings on Windows, Mac, Android, iOS, HTML5, Chrome OS platforms. Please refer to Global App Configuration settings documentation to configure GAC settings via terraform.
Resource locations contain the resources (e.g. cloud connectors) required to deliver applications and desktops to users. Resource locations are only supported for Cloud customers. On-premises customers can use the zone resource directly. Please refer to Citrix Resource Location documentation to configure citrix cloud resource locations via terraform.
Please refer to the StoreFront.md to configure StoreFront resources via terraform. Note that this feature is in Tech Preview.
QuickCreate service allows customers to create and manage Amazon WorkSpaces Core instances in Amazon Web Services (AWS). Please refer to the QuickCreate documentation to learn more. Note that this feature is in Tech Preview.
| Connection Type | Hypervisor | Resource Pool | MCS Power Managed | MCS Provisioning | PVS | Manual/Remote PC |
|---|---|---|---|---|---|---|
| AzureRM | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
| AWS EC2 | ✔️ | ✔️ | ✔️ | ✔️ | ✖️ | ✔️ |
| GCP | ✔️ | ✔️ | ✔️ | ✔️ | ✖️ | ✔️ |
| vSphere | ✔️ | ✔️ | ✔️ | ✔️ | ✖️ | ✔️ |
| XenServer | ✔️ | ✔️ | ✔️ | ✔️ | ✖️ | ✔️ |
| Nutanix | ✔️ | ✔️ | ✔️ | ✔️ | ✖️ | ✔️ |
| SCVMM | ✔️ | ✔️ | ✔️ | ✔️ | ✖️ | ✔️ |
- URLs of the Citrix admin consoles: please visit this documentation for more information.
- URL of the HashiCorp Terraform registry: https://registry.terraform.io or a private registry.
The Onboarding Script will discover all resource IDs and import them into a local terraform state file. You can then run terraform state show to inspect the state and discover the IDs.
Alternatively the IDs can be found in Web Studio by looking at the network traces. Open your browser developer tools (usually F12) and navigate to the Network tab. Refresh Web Studio and click on the resource you want to find the ID for. There should be 2 corresponding network calls (OPTIONS then GET) for the resource which includes the ID as the last path in the url before the ? query.
For example in this network call the delivery group ID is 9e451353-d41c-40d5-80da-37177680364b:
OPTIONS https://customerId.xendesktop.net/citrix/orchestration/api/customerId/e4c48b1c-0c2c-4ede-b9a2-ec34998ab118/DeliveryGroups/9e451353-d41c-40d5-80da-37177680364b?fields=SimpleAccessPolicy%2C...
When you use Terraform, any secret in the resource configuration will be stored in the state file. Terraform has guidance to handle the state file itself as sensitive: https://developer.hashicorp.com/terraform/language/state/sensitive-data. This can be mitigated by using a remote state file with encryption enabled.
It is still best to avoid putting secrets in the state file, and DaaS has a few options to avoid storing secrets in the state:
MCS offers the option to use the managed identity of the Citrix Cloud Connector to call Azure APIs instead of the application ID + secret. See the Citrix docs for this feature and the provider docs
resource "citrix_azure_hypervisor" "example-azure-hypervisor" {
name = "example-azure-hypervisor"
zone = "<Zone Id>"
active_directory_id = "<Azure Tenant Id>"
subscription_id = "<Azure Subscription Id>"
authentication_mode = "SystemAssignedManagedIdentity" // or "UserAssignedManagedIdentities"
proxy_hypervisor_traffic_through_connector = true
}
A domain user is required for the citrix_machine_catalog resource to create and manage AD machine accounts for the VDAs. This can be pre-created as a Service Account in Web Studio and then imported into Terraform. The machine catalog will then use the credentials stored on the DDC to communicate with AD. See the citrix_service_account and citrix_machine_catalog docs.
resource citrix_service_account "example-service-account" {
// These values should match what was entered in Web Studio to ensure the import is successful
display_name = "example-ad-service-account"
identity_provider_type = "ActiveDirectory"
identity_provider_identifier = "<DomainFQDN>"
account_id = "<Domain>\\<Admin Username>"
account_secret_format = "PlainText"
// the actual secret is already in remote, putting a dummy value here and setting to ignore changes because this argument is required
account_secret = "dummy secret for import"
lifecycle {
ignore_changes = [account_secret]
}
}
// terraform import citrix_service_account.example-service-account <service account ID>
resource "citrix_machine_catalog" "dj-test" {
provisioning_scheme = {
machine_domain_identity = {
domain = "<DomainFQDN>"
// use the imported service account when creating this catalog
service_account_id = citrix_service_account.cmdlab-service-account.id
...
- https://api.cloud.com
- Or for Japan environment: https://api.citrixcloud.jp
- Or for Gov environment:
https://[customerId].xendesktop.usandhttps://*.citrixworkspacesapi.us
- https://cws.citrixworkspacesapi.net
- Or for Japan environment: https://cws.citrixworkspacesapi.jp
- Or for Gov environment: https://cws.citrixworkspacesapi.us
- Hostname of the DDC
- Hostname of the StoreFront Server
- Hostname of the DDC
- US environment: https://api.wem.cloud.com
- EU environment: https://eu-api.wem.cloud.com
- APS environment: https://aps-api.wem.cloud.com
- Japan environment: https://jp-api.wem.citrixcloud.jp
The code in this repository makes use of the following packages:
- Hashicorp Terraform Plugin Framework (https://github.com/hashicorp/terraform-plugin-framework)
- Google Go Uuid (https://github.com/google/uuid)
This project is Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Copyright © 2025. Citrix Systems, Inc.