Skip to content

Commit c7f4862

Browse files
josielsouzanordcloudclaude
josielsouzanordcloud
and
claude
committed
feat(iac): add Arc infrastructure, gateway test VM, and CI/CD pipelines
- Add arc-infra Terraform module: Arc-enabled servers resource group, onboarding SPN role assignment, Log Analytics workspace, DCR, Azure Monitor Agent policy assignments (DeployIfNotExists), and managed identity for policy remediation - Add gateway-test-vm Terraform module: Windows Server 2022 VM (AVM ~> 0.20), Bastion, VNet/subnets, AAD login extension, and Entra ID group VM login RBAC - Add arc-setup.ps1: Arc evaluation onboarding script delivered via azurerm_virtual_machine_run_command with protected_parameter for SPN secret; re-enables Guest Agent post-enrollment so Run Command can report status - Add ADO pipelines: deploy and destroy for arc-infra environment targets - Update core.bicep: add role IDs and ABAC conditions for Arc, Log Analytics, Policy Contributor, and VM Administrator Login - Bump Terraform to 1.14.0 (required by AVM ~> 0.20) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 4101945 commit c7f4862

40 files changed

Lines changed: 1514 additions & 22 deletions

‎.azuredevops/pipelines/deploy.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
trigger: none
2+
pr: none
3+
4+
parameters:
5+
- name: commitSHA
6+
displayName: Commit SHA
7+
type: string
8+
- name: environment
9+
displayName: Environment
10+
type: string
11+
- name: pool
12+
displayName: ADO management pool
13+
type: string
14+
15+
stages:
16+
- stage: ${{ parameters.environment }}
17+
displayName: Deploy Arc infrastructure to ${{ parameters.environment }}
18+
pool:
19+
name: ${{ parameters.pool }}
20+
lockBehavior: sequential
21+
isSkippable: false
22+
23+
jobs:
24+
- deployment: DeployArcInfra
25+
displayName: Deploy Arc infrastructure
26+
environment: ${{ parameters.environment }}
27+
strategy:
28+
runOnce:
29+
deploy:
30+
steps:
31+
- checkout: self
32+
33+
- bash: |
34+
TF_VERSION=$(grep "^terraform" .tool-versions | awk '{print $2}')
35+
echo "##vso[task.setvariable variable=TF_VERSION]$TF_VERSION"
36+
displayName: Get Terraform version from .tool-versions
37+
38+
- task: TerraformInstaller@1
39+
displayName: Install Terraform
40+
inputs:
41+
terraformVersion: $(TF_VERSION)
42+
43+
- task: AzureCLI@2
44+
displayName: Run Terraform
45+
inputs:
46+
azureSubscription: manbgw-${{ parameters.environment }}
47+
scriptType: bash
48+
scriptLocation: inlineScript
49+
addSpnToEnvironment: true
50+
inlineScript: |
51+
export ARM_TENANT_ID="$tenantId"
52+
export ARM_CLIENT_ID="$servicePrincipalId"
53+
export ARM_OIDC_TOKEN="$idToken"
54+
export ARM_USE_OIDC=true
55+
make ci ${{ parameters.environment }} terraform-apply

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @NHSDigital/dtos-manage-breast-screening-gateway-code-owners

‎.github/ISSUE_TEMPLATE/1_support_request.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# See:
2+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
3+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-issue-forms
4+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/common-validation-errors-when-creating-issue-forms
5+
6+
name: 🔧 Support Request
7+
description: Get help
8+
labels: ['support']
9+
body:
10+
- type: markdown
11+
attributes:
12+
value: |
13+
Thanks for taking the time to file a support request. Please fill out this form as completely as possible.
14+
- type: textarea
15+
attributes:
16+
label: What exactly are you trying to do?
17+
description: Describe in as much detail as possible.
18+
validations:
19+
required: true
20+
- type: textarea
21+
attributes:
22+
label: What have you tried so far?
23+
description: Describe what you have tried so far.
24+
validations:
25+
required: true
26+
- type: textarea
27+
attributes:
28+
label: Output of any commands you have tried
29+
description: Please copy and paste any relevant output. This will be automatically formatted into codeblock.
30+
render: Shell
31+
validations:
32+
required: false
33+
- type: textarea
34+
attributes:
35+
label: Additional context
36+
description: Add any other context about the problem here.
37+
validations:
38+
required: false
39+
- type: checkboxes
40+
attributes:
41+
label: Code of Conduct
42+
description: By submitting this issue you agree to follow our [Code of Conduct](../../docs/CODE_OF_CONDUCT.md)
43+
options:
44+
- label: I agree to follow this project's Code of Conduct
45+
required: true
46+
- type: checkboxes
47+
attributes:
48+
label: Sensitive Information Declaration
49+
description: To ensure the utmost confidentiality and protect your privacy, we kindly ask you to NOT including [PII (Personal Identifiable Information) / PID (Personal Identifiable Data)](https://digital.nhs.uk/data-and-information/keeping-data-safe-and-benefitting-the-public) or any other sensitive data in this form. We appreciate your cooperation in maintaining the security of your information.
50+
options:
51+
- label: I confirm that neither PII/PID nor sensitive data are included in this form
52+
required: true

‎.github/ISSUE_TEMPLATE/2_feature_request.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# See:
2+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
3+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-issue-forms
4+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/common-validation-errors-when-creating-issue-forms
5+
6+
name: 🚀 Feature Request
7+
description: Suggest an idea for this project
8+
labels: ['feature request']
9+
body:
10+
- type: markdown
11+
attributes:
12+
value: |
13+
Thanks for taking the time to file a feature request. Please fill out this form as completely as possible.
14+
- type: textarea
15+
attributes:
16+
label: What is the problem this feature will solve?
17+
description: Tell us why this change is needed or helpful and what problems it may help solve.
18+
validations:
19+
required: true
20+
- type: textarea
21+
attributes:
22+
label: What is the feature that you are proposing to solve the problem?
23+
description: Provide detailed information for what we should add.
24+
validations:
25+
required: true
26+
- type: textarea
27+
attributes:
28+
label: What alternatives have you considered?
29+
- type: checkboxes
30+
attributes:
31+
label: Code of Conduct
32+
description: By submitting this issue you agree to follow our [Code of Conduct](../../docs/CODE_OF_CONDUCT.md)
33+
options:
34+
- label: I agree to follow this project's Code of Conduct
35+
required: true
36+
- type: checkboxes
37+
attributes:
38+
label: Sensitive Information Declaration
39+
description: To ensure the utmost confidentiality and protect your privacy, we kindly ask you to NOT including [PII (Personal Identifiable Information) / PID (Personal Identifiable Data)](https://digital.nhs.uk/data-and-information/keeping-data-safe-and-benefitting-the-public) or any other sensitive data in this form. We appreciate your cooperation in maintaining the security of your information.
40+
options:
41+
- label: I confirm that neither PII/PID nor sensitive data are included in this form
42+
required: true

‎.github/ISSUE_TEMPLATE/3_bug_report.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# See:
2+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/configuring-issue-templates-for-your-repository
3+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/syntax-for-issue-forms
4+
# - https://docs.github.com/en/communities/using-templates-to-encourage-useful-issues-and-pull-requests/common-validation-errors-when-creating-issue-forms
5+
6+
name: 🐞 Bug Report
7+
description: File a bug report
8+
labels: ['bug', 'triage']
9+
body:
10+
- type: markdown
11+
attributes:
12+
value: |
13+
Thanks for taking the time to file a bug report. Please fill out this form as completely as possible.
14+
- type: checkboxes
15+
attributes:
16+
label: Is there an existing issue for this?
17+
description: Please, search the Issues to see if an issue already exists for the bug you have encountered.
18+
options:
19+
- label: I have searched the existing Issues
20+
required: true
21+
- type: textarea
22+
attributes:
23+
label: Current Behavior
24+
description: A concise description of what you are experiencing.
25+
validations:
26+
required: true
27+
- type: textarea
28+
attributes:
29+
label: Expected Behavior
30+
description: A concise description of what you expect to happen.
31+
validations:
32+
required: true
33+
- type: textarea
34+
attributes:
35+
label: Steps To Reproduce
36+
description: Steps to reproduce the behavior
37+
placeholder: |
38+
1. In this environment...
39+
2. With this config...
40+
3. Run `...`
41+
validations:
42+
required: false
43+
- type: textarea
44+
attributes:
45+
label: Output
46+
description: Please copy and paste any relevant output. This will be automatically formatted into codeblock.
47+
render: Shell
48+
validations:
49+
required: false
50+
- type: checkboxes
51+
attributes:
52+
label: Code of Conduct
53+
description: By submitting this issue you agree to follow our [Code of Conduct](../../docs/CODE_OF_CONDUCT.md)
54+
options:
55+
- label: I agree to follow this project's Code of Conduct
56+
required: true
57+
- type: checkboxes
58+
attributes:
59+
label: Sensitive Information Declaration
60+
description: To ensure the utmost confidentiality and protect your privacy, we kindly ask you to NOT including [PII (Personal Identifiable Information) / PID (Personal Identifiable Data)](https://digital.nhs.uk/data-and-information/keeping-data-safe-and-benefitting-the-public) or any other sensitive data in this form. We appreciate your cooperation in maintaining the security of your information.
61+
options:
62+
- label: I confirm that neither PII/PID nor sensitive data are included in this form
63+
required: true

‎.github/SECURITY.md‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Security
2+
3+
NHS England takes security and the protection of private data extremely seriously. If you believe you have found a vulnerability or other issue which has compromised or could compromise the security of any of our systems and/or private data managed by our systems, please do not hesitate to contact us using the methods outlined below.
4+
5+
## Table of Contents
6+
7+
- [Security](#security)
8+
- [Table of Contents](#table-of-contents)
9+
- [Reporting a vulnerability](#reporting-a-vulnerability)
10+
- [Email](#email)
11+
- [NCSC](#ncsc)
12+
- [General Security Enquiries](#general-security-enquiries)
13+
14+
## Reporting a vulnerability
15+
16+
Please note, email is our preferred method of receiving reports.
17+
18+
### Email
19+
20+
If you wish to notify us of a vulnerability via email, please include detailed information on the nature of the vulnerability and any steps required to reproduce it.
21+
22+
You can reach us at:
23+
24+
- [cybersecurity@nhs.net](cybersecurity@nhs.net)
25+
26+
### NCSC
27+
28+
You can send your report to the National Cyber Security Centre, who will assess your report and pass it on to NHS England if necessary.
29+
30+
You can report vulnerabilities here: [https://www.ncsc.gov.uk/information/vulnerability-reporting](https://www.ncsc.gov.uk/information/vulnerability-reporting)
31+
32+
## General Security Enquiries
33+
34+
If you have general enquiries regarding our cybersecurity, please reach out to us at [cybersecurity@nhs.net](cybersecurity@nhs.net)

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,12 @@ on:
44
pull_request:
55

66
concurrency:
7-
group: cicd-${{ github.ref }}
7+
group: pr-${{ github.ref }}
88
cancel-in-progress: true
99

1010
permissions:
1111
contents: read
12+
id-token: write
1213
security-events: write
1314

1415
jobs:
@@ -20,3 +21,14 @@ jobs:
2021
needs: commit-stage
2122
uses: ./.github/workflows/stage-2-test.yaml
2223
secrets: inherit
24+
25+
deploy-stage:
26+
name: Deploy stage
27+
needs: [commit-stage, test-stage]
28+
permissions:
29+
id-token: write
30+
uses: ./.github/workflows/stage-4-deploy.yaml
31+
with:
32+
environments: '["review"]'
33+
commit_sha: ${{ github.event.pull_request.head.sha }}
34+
secrets: inherit

‎.github/workflows/cicd-2-main-branch.yaml‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@ on:
88
- 'v*'
99
workflow_dispatch:
1010

11-
concurrency:
12-
group: cicd-${{ github.ref }}
13-
cancel-in-progress: true
11+
concurrency: cicd-${{ github.ref }}
1412

1513
permissions:
1614
contents: write
@@ -98,3 +96,14 @@ jobs:
9896
version: ${{ needs.release-stage.outputs.new_release_version }}
9997
new_release_published: ${{ needs.release-stage.outputs.new_release_published == 'true' }}
10098
secrets: inherit
99+
100+
deploy-stage:
101+
name: Deploy stage
102+
needs: [commit-stage, test-stage]
103+
permissions:
104+
id-token: write
105+
uses: ./.github/workflows/stage-4-deploy.yaml
106+
with:
107+
environments: '["review"]'
108+
commit_sha: ${{ github.sha }}
109+
secrets: inherit

‎.github/workflows/stage-4-deploy.yaml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Deployment stage
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
environments:
7+
description: List of environments to deploy to (JSON string array)
8+
required: true
9+
type: string
10+
commit_sha:
11+
description: Commit SHA used to trigger the ADO pipeline
12+
required: true
13+
type: string
14+
15+
jobs:
16+
deploy:
17+
name: Deploy
18+
runs-on: ubuntu-latest
19+
strategy:
20+
matrix:
21+
environment: ${{ fromJson(inputs.environments) }}
22+
max-parallel: 1
23+
environment: ${{ matrix.environment }}
24+
# Prevent concurrent deployments to the same environment
25+
concurrency: deploy-${{ matrix.environment }}
26+
permissions:
27+
id-token: write
28+
29+
steps:
30+
- name: Checkout code
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
32+
33+
- name: Azure login
34+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
35+
with:
36+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
37+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
38+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
39+
40+
- name: Call deployment pipeline
41+
env:
42+
ENVIRONMENT: ${{ matrix.environment }}
43+
COMMIT_SHA: ${{ inputs.commit_sha }}
44+
ADO_PROJECT: ${{ github.event.repository.name }}
45+
run: |
46+
source "infrastructure/environments/${ENVIRONMENT}/variables.sh"
47+
48+
echo "Starting Azure devops pipeline \"Deploy to Azure - ${ENVIRONMENT}\"..."
49+
RUN_ID=$(az pipelines run \
50+
--commit-id "${COMMIT_SHA}" \
51+
--name "Deploy to Azure - ${ENVIRONMENT}" \
52+
--org https://dev.azure.com/nhse-dtos \
53+
--project "${ADO_PROJECT}" \
54+
--parameters commitSHA="${COMMIT_SHA}" environment="${ENVIRONMENT}" pool="${ADO_MANAGEMENT_POOL}" \
55+
--output tsv --query id)
56+
57+
echo "See pipeline run in Azure devops: https://dev.azure.com/nhse-dtos/${ADO_PROJECT}/_build/results?buildId=${RUN_ID}&view=results"
58+
59+
scripts/bash/wait_ado_pipeline.sh "$RUN_ID" https://dev.azure.com/nhse-dtos "${ADO_PROJECT}"

‎.gitignore‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,13 @@ lines-of-code-report.json
1313

1414
# Please, add your custom content below!
1515

16+
# Terraform
17+
.terraform/
18+
*.tfstate
19+
*.tfstate.backup
20+
*.tfplan
21+
infrastructure/modules/dtos-devops-templates/
22+
1623
# Python
1724
__pycache__/
1825
*.py[cod]
@@ -60,4 +67,3 @@ mediafiles/
6067
# Documentation
6168
.structurizr
6269
workspace.json
63-

0 commit comments

Comments
 (0)