Skip to content

Commit a432a1c

Browse files
oZakarijaredfholgatejtracey93
authored
feat: Integration of AVM based alz-bicep-accelerator (#111)
* Update readme * Initial changes for local version of bicep-avm * Updates to deploy local * Add logic for networktype and subscription id replacment * Adding subscription id replacement logic * Changes for new local config file for bicep-avm * Final updates for local bicep-avm deployment * Update error messaging * All changes requird for working Github implementation for bicep-avm * Add support for firstwhatif deployment to github * Initial azure devops files * Align permissiosn with github * Update permissions * Add location replacement logic * simplify deployment stack names and replacment managment group id * Update variable checks for network_type * Update logic for first deployment * Fix formatting * Add lint bypass * Add end-to-tests for bicep-avm * Add logic to exit for both bicep and bicep avm scripts if error * Extend retry duration * Add verbose logging * jared pedant changes * fixy mcfixington * fix e2e test * save changes * extract file manipulation and fix templating * more fixes * fixes for local * GitHub throttling * fix tests * fix e2e tests * fixes * i tests * fix bug * fix tf local * bug fix * fix templated files * reverse throttling * add option for debugging * bug fix * fix e2e tests * soft fail PowerShell module upgrade * fix tests * skip destory for avm bicep * unique deployment name * do not use runner groups in tests until we have a method to delete them * improve clean up jobs * loop cleanup * add time stamp capability * fix lin endings for linting * linting * linting * fix typo * engage brain * fix date format * randomise location to ensure a retry on a location specific issue can succeed * typo * simplify * remove canada * specify regions that have aci support and quota * fix regions list * fix scripts * remove eastus * Add nest MG test * fix first run check * fix logic... * improve clean up script * lookup sub * add provider no rbac for what if * feat: update alz custom roles (#117) * remove ARM deployment and stacks from TF * refine roles * clean up MGs * add check * trigger new run * fix what if perms * fix type for ps argument * add tenant role assignment for bicep * fix local name * refactor: rename tenant role assignment variables for bicep compatibility * docs and pipeline fixes * trigger a new run * try reverting role def * attempt to fix bootstrap perms issues * fix bug * revert variables * revert classic bicep perms * clean role defs * fix role def cleanup * typo * Fix spacing * revert classic what if change * stupid mistake... * fix linting --------- Co-authored-by: Jared Holgate <jaredholgate@microsoft.com> Co-authored-by: Jack Tracey <41163455+jtracey93@users.noreply.github.com>
1 parent 36a8d8e commit a432a1c

99 files changed

Lines changed: 5747 additions & 2118 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.config/ALZ-Powershell.config.json‎

Lines changed: 6 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -26,84 +26,19 @@
2626
"release_artifact_name": "starter_modules.zip",
2727
"release_artifact_root_path": ".",
2828
"release_artifact_config_file": ".config/ALZ-Powershell.config.json"
29-
3029
},
3130
"bicep": {
31+
"url": "https://github.com/Azure/alz-bicep-accelerator",
32+
"release_artifact_name": "starter_modules.zip",
33+
"release_artifact_root_path": ".",
34+
"release_artifact_config_file": ".config/ALZ-Powershell.config.json"
35+
},
36+
"bicep-classic": {
3237
"url": "https://github.com/Azure/ALZ-Bicep",
3338
"release_artifact_name": "accelerator.zip",
3439
"release_artifact_root_path": ".",
3540
"release_artifact_config_file": "accelerator/.config/ALZ-Powershell-Auto.config.json"
3641
}
3742
}
38-
},
39-
"validators": {
40-
"auth_scheme": {
41-
"Type": "AllowedValues",
42-
"Description": "A valid authentication scheme e.g. 'WorkloadIdentityFederation'",
43-
"AllowedValues": {
44-
"Display": true,
45-
"Values": [
46-
"WorkloadIdentityFederation",
47-
"ManagedServiceIdentity"
48-
]
49-
}
50-
},
51-
"azure_subscription_id": {
52-
"Type": "Valid",
53-
"Description": "A valid subscription id GUID e.g. '12345678-1234-1234-1234-123456789012'",
54-
"Valid": "^( {){0,1}[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}(}){0,1}$"
55-
},
56-
"azure_name": {
57-
"Type": "Valid",
58-
"Description": "A valid Azure name e.g. 'my-azure-name'",
59-
"Valid": "^[a-zA-Z0-9]{2,10}(-[a-zA-Z0-9]{2,10}){0,1}(-[a-zA-Z0-9]{2,10})?$"
60-
},
61-
"azure_name_section": {
62-
"Type": "Valid",
63-
"Description": "A valid Azure name with no hyphens and limited length e.g. 'abcd'",
64-
"Valid": "^[a-zA-Z0-9]{2,10}$"
65-
},
66-
"guid": {
67-
"Type": "Valid",
68-
"Description": "A valid GUID e.g. '12345678-1234-1234-1234-123456789012'",
69-
"Valid": "^( {){0,1}[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}(}){0,1}$"
70-
},
71-
"cidr_range": {
72-
"Type": "Valid",
73-
"Description": "A valid CIDR range e.g '10.0.0.0/16'",
74-
"Valid": "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(/(3[0-2]|[1-2][0-9]|[0-9]))$"
75-
},
76-
"configuration_file_path": {
77-
"Type": "Valid",
78-
"Description": "A valid yaml or json configuration file path e.g. './my-folder/my-config-file.yaml' or `c:\\my-folder\\my-config-file.yaml`",
79-
"Valid": "^.+\\.(yaml|yml|json)$"
80-
},
81-
"network_type": {
82-
"Type": "AllowedValues",
83-
"Description": "Networking Type'",
84-
"AllowedValues": {
85-
"Display": true,
86-
"Values": [
87-
"hubNetworking",
88-
"hubNetworkingMultiRegion",
89-
"vwanConnectivity",
90-
"vwanConnectivityMultiRegion",
91-
"none"
92-
]
93-
}
94-
},
95-
"email": {
96-
"Type": "Valid",
97-
"Description": "A valid email address",
98-
"Valid": "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$"
99-
},
100-
"azure_location": {
101-
"Type": "AllowedValues",
102-
"Description": "An Azure deployment location e.g. 'uksouth'",
103-
"AllowedValues": {
104-
"Display": false,
105-
"Values": [ "This is dynamically populated from Azure" ]
106-
}
107-
}
10843
}
10944
}

‎.github/linters/.yaml-lint.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,12 @@ extends: default
44
ignore: |
55
**/bicep/**/ci-template.yaml
66
**/bicep/**/cd-template.yaml
7+
**/bicep-classic/**/ci-template.yaml
8+
**/bicep-classic/**/cd-template.yaml
79
*bicep-templates.yaml
810
**/bicep/**/cd.yaml
11+
**/bicep-classic/**/cd.yaml
12+
**/bicep-classic/**/ci.yaml
913
1014
rules:
1115
# 500 chars should be enough, but don't fail if a line is longer

‎.github/tests/cleanup-scripts/cleanup_azure_resouces.ps1‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
# This file can be used to clean up Resource Groups if there has been an issue with the End to End tests.
2+
# CAUTION: Make sure you are connected to the correct subscription before running this script!
3+
$managementGroupFilter = "alz-r"
4+
if($managementGroupFilter -eq "")
5+
{
6+
throw "Please set a management group filter to avoid disaster!"
7+
}
8+
$subscriptionFilter = ""
9+
10+
$managementGroups = @(
11+
"dac8feee-8768-4fbd-9cf9-9d96d4718018",
12+
"alz-accelerator-parent-test"
13+
)
14+
15+
$subscriptions = @(
16+
"6be58818-3390-4c43-a3bb-2666110eeb66",
17+
"5331601a-985a-4f45-87d1-6b4156c8acf5",
18+
"bceedecb-9f0b-4aa3-9778-1d1fa92f289e",
19+
"9ebf45b8-555d-49c6-81fb-d27ca08f7c28",
20+
"eac9acf5-0a34-4db8-ae56-cdbcc7e2cf4c",
21+
"3a6bdc35-0830-41ac-b323-37a5a030e241",
22+
"c4332eb2-f966-47db-aa47-5d71e239d8aa",
23+
"0aeefd1c-62c7-4071-91ad-925899603976",
24+
"0d754f66-65b4-4f64-97f5-221f0174ad48"
25+
)
26+
27+
$roleDefinitionsFilter = "Azure Landing Zones"
28+
29+
$subscriptions | ForEach-Object -Parallel {
30+
$subscription = $_
31+
$subscriptionDetails = az account show --subscription $subscription | ConvertFrom-Json
32+
Write-Host "Processing subscription: $subscription - $($subscriptionDetails.name)"
33+
34+
$resourceGroups = @("")
35+
while ($resourceGroups.Count -gt 0) {
36+
if($subscriptionFilter -eq "")
37+
{
38+
$resourceGroups = az group list --subscription $subscription | ConvertFrom-Json
39+
}
40+
else
41+
{
42+
$resourceGroups = az group list --subscription $subscription --query "[?contains(name, '$subscriptionFilter')]" | ConvertFrom-Json
43+
}
44+
45+
$resourceGroups | ForEach-Object -Parallel {
46+
$subscription = $using:subscription
47+
$subscriptionDetails = $using:subscriptionDetails
48+
Write-Host "Deleting resource group: $($_.name) in subscription: $subscription - $($subscriptionDetails.name)"
49+
az group delete --subscription $subscription --name $_.name --yes
50+
} -ThrottleLimit 10
51+
}
52+
} -ThrottleLimit 10
53+
54+
$managementGroups | ForEach-Object -Parallel {
55+
$managementGroupFilter = $using:managementGroupFilter
56+
$managementGroup = $_
57+
Write-Host "Processing management group: $managementGroup"
58+
59+
$managementGroupDetails = az account management-group show --name $managementGroup --expand | ConvertFrom-Json
60+
$childManagementGroups = $managementGroupDetails.children | Where-Object { $_.type -eq "Microsoft.Management/managementGroups" }
61+
if($managementGroupFilter -ne "") {
62+
$childManagementGroups = $childManagementGroups | Where-Object { $_.name -like "*$managementGroupFilter*" }
63+
}
64+
65+
$childManagementGroups | ForEach-Object -Parallel {
66+
$managementGroup = $using:managementGroup
67+
$childManagementGroup = $_
68+
Write-Host "Deleting management group: $($childManagementGroup.name) under parent: $managementGroup"
69+
az account management-group delete --name $childManagementGroup.name
70+
} -ThrottleLimit 10
71+
72+
$roleDefinitionsFilter = $using:roleDefinitionsFilter
73+
$subscriptions = $using:subscriptions
74+
$roleDefinitions = az role definition list --custom-role-only true --scope "/providers/Microsoft.Management/managementGroups/$managementGroup" --query "[].{name:name,roleName:roleName,id:id,assignableScopes:assignableScopes}" -o json | ConvertFrom-Json | Where-Object { $_.roleName -like "*$roleDefinitionsFilter*" -and $_.assignableScopes -contains "/providers/Microsoft.Management/managementGroups/$managementGroup" }
75+
$roleDefinitions | ForEach-Object -Parallel {
76+
$managementGroup = $using:managementGroup
77+
$roleDefinition = $_
78+
79+
$roleAssignments = az role assignment list --role $roleDefinition.name --scope "/providers/Microsoft.Management/managementGroups/$managementGroup" --query "[].{id:id,principalName:principalName,principalId:principalId}" -o json | ConvertFrom-Json
80+
$roleAssignments | ForEach-Object -Parallel {
81+
$managementGroup = $using:managementGroup
82+
$roleDefinition = $using:roleDefinition
83+
$roleAssignment = $_
84+
Write-Host "Deleting role assignment: $($roleAssignment.id) for role definition: $($roleDefinition.roleName) in management group: $managementGroup"
85+
az role assignment delete --ids $roleAssignment.id
86+
} -ThrottleLimit 10
87+
88+
foreach ($subscription in $using:subscriptions) {
89+
$subscriptionRoleAssignments = az role assignment list --role $roleDefinition.name --subscription $subscription --query "[].{id:id,principalName:principalName,principalId:principalId}" -o json | ConvertFrom-Json
90+
$subscriptionRoleAssignments | ForEach-Object -Parallel {
91+
$roleDefinition = $using:roleDefinition
92+
$subscription = $using:subscription
93+
$roleAssignment = $_
94+
Write-Host "Deleting role assignment: $($roleAssignment.id) for role definition: $($roleDefinition.roleName) in subscription: $subscription"
95+
az role assignment delete --ids $roleAssignment.id
96+
} -ThrottleLimit 10
97+
}
98+
99+
Write-Host "Deleting custom role definition: $($roleDefinition.roleName) in management group: $managementGroup"
100+
az role definition delete --name $roleDefinition.name --scope "/providers/Microsoft.Management/managementGroups/$managementGroup"
101+
102+
} -ThrottleLimit 10
103+
} -ThrottleLimit 10
104+
105+
Write-Host "Cleanup complete. :)"

‎.github/tests/cleanup-scripts/cleanup_github-repositories.ps1‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,19 @@
11
# This file can be used to clean up GitHub repositories if there has been an issue with the End to End tests.
22
# CAUTION: Make sure you are connected to the correct organization before running this script!
3-
$repos = gh repo list microsoft-azure-landing-zones-cd-tests --json name,owner | ConvertFrom-Json
3+
$filter = ""
44

5-
$repos | ForEach-Object -Parallel {
6-
$match = "*229*"
7-
$repoName = "$($_.owner.login)/$($_.name)"
8-
9-
if($repoName -like $match)
5+
$repos = @("")
6+
while ($repos.Count -gt 0) {
7+
$repos = gh repo list microsoft-azure-landing-zones-cd-tests --json name,owner | ConvertFrom-Json
8+
if($filter -ne "")
109
{
10+
$repos = $repos | Where-Object { $_.name -like "*$filter*" }
11+
}
12+
13+
$repos | ForEach-Object -Parallel {
14+
$repoName = "$($_.owner.login)/$($_.name)"
15+
1116
Write-Host "Deleting repo: $repoName"
1217
gh repo delete $repoName --yes
13-
14-
}
15-
} -ThrottleLimit 10
18+
} -ThrottleLimit 10
19+
}

‎.github/tests/cleanup-scripts/cleanup_resouce_groups.ps1‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎.github/tests/scripts/azuredevops-pipeline-run.ps1‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,18 @@ function Invoke-Pipeline {
5050
}
5151

5252
if($iac -eq "bicep") {
53+
$pipelineDispatchBody = @{
54+
"resources" = @{
55+
"repositories" = @{
56+
"self" = @{
57+
"refName" = "refs/heads/main"
58+
}
59+
}
60+
}
61+
} | ConvertTo-Json -Depth 100
62+
}
63+
64+
if($iac -eq "bicep-classic") {
5365
$pipelineDispatchBody = @{
5466
"resources" = @{
5567
"repositories" = @{

0 commit comments

Comments
 (0)