Skip to content

Commit 2df09d6

Browse files
josielsouzanordcloudjosielsouzanordcloud
committed
feat(iac): add Arc infrastructure Terraform module and CI/CD pipelines
Adds a new Terraform module for setting up Arc infrastructure, including NAT gateway for outbound internet access. Also adds Azure DevOps pipelines for deploying and destroying the Arc infrastructure in different environments. Refs: DTOSS-12318
1 parent 9db8637 commit 2df09d6

24 files changed

Lines changed: 714 additions & 33 deletions

File tree

‎.azuredevops/pipelines/deploy.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
trigger: none
2+
pr: none
3+
4+
parameters:
5+
- name: commitSHA
6+
displayName: Commit SHA
7+
type: string
8+
- name: environment
9+
displayName: Environment
10+
type: string
11+
- name: pool
12+
displayName: ADO management pool
13+
type: string
14+
15+
stages:
16+
- stage: ${{ parameters.environment }}
17+
displayName: Deploy Arc infrastructure to ${{ parameters.environment }}
18+
pool:
19+
name: ${{ parameters.pool }}
20+
lockBehavior: sequential
21+
isSkippable: false
22+
23+
jobs:
24+
- deployment: DeployArcInfra
25+
displayName: Deploy Arc infrastructure
26+
environment: ${{ parameters.environment }}
27+
strategy:
28+
runOnce:
29+
deploy:
30+
steps:
31+
- checkout: self
32+
33+
- bash: |
34+
TF_VERSION=$(grep "^terraform" .tool-versions | awk '{print $2}')
35+
echo "##vso[task.setvariable variable=TF_VERSION]$TF_VERSION"
36+
displayName: Get Terraform version from .tool-versions
37+
38+
- task: TerraformInstaller@1
39+
displayName: Install Terraform
40+
inputs:
41+
terraformVersion: $(TF_VERSION)
42+
43+
- task: AzureCLI@2
44+
displayName: Run Terraform
45+
inputs:
46+
azureSubscription: manbgw-${{ parameters.environment }}
47+
scriptType: bash
48+
scriptLocation: inlineScript
49+
addSpnToEnvironment: true
50+
inlineScript: |
51+
export ARM_TENANT_ID="$tenantId"
52+
export ARM_CLIENT_ID="$servicePrincipalId"
53+
export ARM_OIDC_TOKEN="$idToken"
54+
export ARM_USE_OIDC=true
55+
make ci ${{ parameters.environment }} terraform-apply

‎.azuredevops/pipelines/destroy.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
trigger: none
2+
pr: none
3+
4+
parameters:
5+
- name: commitSHA
6+
displayName: Commit SHA
7+
type: string
8+
- name: environment
9+
displayName: Environment
10+
type: string
11+
- name: pool
12+
displayName: ADO management pool
13+
type: string
14+
15+
stages:
16+
- stage: ${{ parameters.environment }}
17+
displayName: Destroy Arc infrastructure in ${{ parameters.environment }}
18+
pool:
19+
name: ${{ parameters.pool }}
20+
lockBehavior: sequential
21+
isSkippable: false
22+
23+
jobs:
24+
- deployment: DestroyArcInfra
25+
displayName: Destroy Arc infrastructure
26+
environment: ${{ parameters.environment }}
27+
strategy:
28+
runOnce:
29+
deploy:
30+
steps:
31+
- checkout: self
32+
33+
- bash: |
34+
TF_VERSION=$(grep "^terraform" .tool-versions | awk '{print $2}')
35+
echo "##vso[task.setvariable variable=TF_VERSION]$TF_VERSION"
36+
displayName: Get Terraform version from .tool-versions
37+
38+
- task: TerraformInstaller@1
39+
displayName: Install Terraform
40+
inputs:
41+
terraformVersion: $(TF_VERSION)
42+
43+
- task: AzureCLI@2
44+
displayName: Run Terraform destroy
45+
inputs:
46+
azureSubscription: manbgw-${{ parameters.environment }}
47+
scriptType: bash
48+
scriptLocation: inlineScript
49+
addSpnToEnvironment: true
50+
inlineScript: |
51+
export ARM_TENANT_ID="$tenantId"
52+
export ARM_CLIENT_ID="$servicePrincipalId"
53+
export ARM_OIDC_TOKEN="$idToken"
54+
export ARM_USE_OIDC=true
55+
make ci ${{ parameters.environment }} terraform-destroy

‎.github/workflows/cicd-2-main-branch.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,3 +98,14 @@ jobs:
9898
version: ${{ needs.release-stage.outputs.new_release_version }}
9999
new_release_published: ${{ needs.release-stage.outputs.new_release_published == 'true' }}
100100
secrets: inherit
101+
102+
deploy-stage:
103+
name: Deploy stage
104+
needs: [test-stage]
105+
permissions:
106+
id-token: write
107+
uses: ./.github/workflows/stage-4-deploy.yaml
108+
with:
109+
environments: '["review"]'
110+
commit_sha: ${{ github.sha }}
111+
secrets: inherit

‎.github/workflows/stage-4-deploy.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Deployment stage
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
environments:
7+
description: List of environments to deploy to (JSON string array)
8+
required: true
9+
type: string
10+
commit_sha:
11+
description: Commit SHA used to trigger the ADO pipeline
12+
required: true
13+
type: string
14+
15+
jobs:
16+
deploy:
17+
name: Deploy
18+
runs-on: ubuntu-latest
19+
strategy:
20+
matrix:
21+
environment: ${{ fromJson(inputs.environments) }}
22+
max-parallel: 1
23+
environment: ${{ matrix.environment }}
24+
# Prevent concurrent deployments to the same environment
25+
concurrency: deploy-${{ matrix.environment }}
26+
permissions:
27+
id-token: write
28+
29+
steps:
30+
- name: Checkout code
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
32+
33+
- name: Azure login
34+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
35+
with:
36+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
37+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
38+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
39+
40+
- name: Call deployment pipeline
41+
env:
42+
ENVIRONMENT: ${{ matrix.environment }}
43+
COMMIT_SHA: ${{ inputs.commit_sha }}
44+
run: |
45+
source "infrastructure/environments/${ENVIRONMENT}/variables.sh"
46+
47+
echo "Starting Azure devops pipeline \"Deploy to Azure - ${ENVIRONMENT}\"..."
48+
RUN_ID=$(az pipelines run \
49+
--commit-id "${COMMIT_SHA}" \
50+
--name "Deploy to Azure - ${ENVIRONMENT}" \
51+
--org https://dev.azure.com/nhse-dtos \
52+
--project manage-breast-screening-gateway \
53+
--parameters commitSHA="${COMMIT_SHA}" environment="${ENVIRONMENT}" pool="${ADO_MANAGEMENT_POOL}" \
54+
--output tsv --query id)
55+
56+
echo "See pipeline run in Azure devops: https://dev.azure.com/nhse-dtos/manage-breast-screening-gateway/_build/results?buildId=${RUN_ID}&view=results"
57+
58+
scripts/bash/wait_ado_pipeline.sh "$RUN_ID" https://dev.azure.com/nhse-dtos manage-breast-screening-gateway

‎.github/workflows/stage-4-destroy.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Destroy Arc infrastructure
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
environment:
7+
description: Environment to destroy
8+
required: true
9+
type: string
10+
commit_sha:
11+
description: Commit SHA used to trigger the ADO pipeline
12+
required: true
13+
type: string
14+
workflow_dispatch:
15+
inputs:
16+
environment:
17+
description: Environment to destroy
18+
required: true
19+
type: choice
20+
options:
21+
- dev
22+
- review
23+
24+
jobs:
25+
destroy:
26+
name: Destroy ${{ inputs.environment }}
27+
runs-on: ubuntu-latest
28+
environment: ${{ inputs.environment }}
29+
# Prevent concurrent destroy running alongside a deploy for the same environment
30+
concurrency: deploy-${{ inputs.environment }}
31+
permissions:
32+
id-token: write
33+
34+
steps:
35+
- name: Checkout code
36+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
37+
38+
- name: Azure login
39+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
40+
with:
41+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
42+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
43+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
44+
45+
- name: Call destroy pipeline
46+
env:
47+
ENVIRONMENT: ${{ inputs.environment }}
48+
COMMIT_SHA: ${{ inputs.commit_sha || github.sha }}
49+
run: |
50+
source "infrastructure/environments/${ENVIRONMENT}/variables.sh"
51+
52+
echo "Starting Azure devops pipeline \"Destroy Arc Infrastructure\"..."
53+
RUN_ID=$(az pipelines run \
54+
--commit-id "${COMMIT_SHA}" \
55+
--name "Destroy Arc Infrastructure" \
56+
--org https://dev.azure.com/nhse-dtos \
57+
--project manage-breast-screening-gateway \
58+
--parameters commitSHA="${COMMIT_SHA}" environment="${ENVIRONMENT}" pool="${ADO_MANAGEMENT_POOL}" \
59+
--output tsv --query id)
60+
61+
echo "See pipeline run in Azure devops: https://dev.azure.com/nhse-dtos/manage-breast-screening-gateway/_build/results?buildId=${RUN_ID}&view=results"
62+
63+
scripts/bash/wait_ado_pipeline.sh "$RUN_ID" https://dev.azure.com/nhse-dtos manage-breast-screening-gateway

‎.gitignore‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,14 @@ lines-of-code-report.json
1313

1414
# Please, add your custom content below!
1515

16+
# Terraform
17+
.terraform/
18+
.terraform.lock.hcl
19+
*.tfstate
20+
*.tfstate.backup
21+
*.tfplan
22+
infrastructure/modules/dtos-devops-templates/
23+
1624
# Python
1725
__pycache__/
1826
*.py[cod]

‎.tool-versions‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,4 @@ uv 0.9.7
66
ruff 0.14.1
77
pre-commit 3.6.0
88
gitleaks 8.18.4
9+
terraform 1.9.8

‎infrastructure/environments/dev/variables.sh‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎infrastructure/environments/preprod/variables.sh‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎infrastructure/environments/prod/variables.sh‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

0 commit comments

Comments
 (0)