|
2 | 2 | # Deploy the gateway app to all Arc machines matching a ring within an environment. |
3 | 3 | # Called by deploy_stage.sh. |
4 | 4 | # |
5 | | -# Usage: deploy_arc_ring.sh <environment> <ring> <release_tag> <kv_name> |
| 5 | +# Usage: deploy_arc_ring.sh <environment> <ring> <release_tag> |
6 | 6 |
|
7 | 7 | set -euo pipefail |
8 | 8 |
|
9 | 9 | ENVIRONMENT=$1 |
10 | 10 | RING=$2 |
11 | 11 | RELEASE_TAG=$3 |
12 | | -KV_NAME=$4 |
13 | 12 |
|
14 | 13 | APP_SHORT_NAME="mbsgw" |
15 | 14 | ARC_RG="rg-${APP_SHORT_NAME}-${ENVIRONMENT}-uks-arc-enabled-servers" |
16 | 15 |
|
17 | | -# Relay namespace is owned by dtos-manage-breast-screening; derive from environment name. |
18 | | -RELAY_NAMESPACE_NAME="relay-manbrs-${ENVIRONMENT}" |
19 | | -RELAY_RG="rg-manbrs-${ENVIRONMENT}-uks" |
20 | | -RELAY_NAMESPACE_HOSTNAME="${RELAY_NAMESPACE_NAME}.servicebus.windows.net" |
21 | | - |
22 | | -# Ensure the relay extension is installed |
23 | | -if ! az relay --help &>/dev/null; then |
24 | | - echo "Installing Azure CLI 'relay' extension..." |
25 | | - az extension add --name relay || { |
26 | | - echo "ERROR: Failed to install 'relay' extension. Please run 'az extension add --name relay' manually." |
27 | | - exit 1 |
28 | | - } |
29 | | -fi |
| 16 | +RELAY_NAMESPACE_HOSTNAME="relay-manbrs-${ENVIRONMENT}.servicebus.windows.net" |
30 | 17 |
|
31 | 18 | # Use forward slashes — Python handles these fine on Windows and avoids .env escaping issues |
32 | 19 | BASE_PATH="C:/Program Files/NHS/ManageBreastScreeningGateway" |
33 | 20 | PYTHON_VERSION=$(awk '/^python / {print $2}' .tool-versions) |
34 | 21 |
|
35 | 22 | echo "--- Ring: ${RING} | Environment: ${ENVIRONMENT} | Release: ${RELEASE_TAG} ---" |
36 | 23 |
|
| 24 | +# ── Per-environment config ───────────────────────────────────────────────────── |
| 25 | +source "infrastructure/environments/${ENVIRONMENT}/variables.sh" |
| 26 | +CLOUD_API_ENDPOINT="https://${CLOUD_API_HOSTNAME}/api/v1/dicom" |
| 27 | + |
| 28 | +APPLICATIONINSIGHTS_CONNECTION_STRING=$(az monitor app-insights component show \ |
| 29 | + --app "ai-${APP_SHORT_NAME}-${ENVIRONMENT}-arc-uks" \ |
| 30 | + --resource-group "$ARC_RG" \ |
| 31 | + --query connectionString -o tsv 2>/dev/null || echo "") |
| 32 | +[[ -z "$APPLICATIONINSIGHTS_CONNECTION_STRING" ]] && \ |
| 33 | + echo "##vso[task.logissue type=warning]Application Insights resource not found — telemetry will be disabled" |
| 34 | + |
37 | 35 | # ── Discover machines ────────────────────────────────────────────────────────── |
38 | 36 | MACHINES_JSON=$(az connectedmachine list \ |
39 | 37 | --resource-group "$ARC_RG" \ |
@@ -61,44 +59,13 @@ while IFS= read -r MACHINE_JSON; do |
61 | 59 | LOCATION=$(echo "$MACHINE_JSON" | jq -r '.location') |
62 | 60 | echo "Preparing deploy for $MACHINE ($LOCATION)..." |
63 | 61 |
|
64 | | - # Fetch relay SAS key directly — Contributor includes listKeys on relay HCs, |
65 | | - # and this avoids any dependency on Terraform state having the resource imported. |
66 | | - echo "Fetching SAS key for hc-${MACHINE} in $RELAY_NAMESPACE_NAME..." |
67 | | - SAS_KEY=$(az relay hyco authorization-rule keys list \ |
68 | | - --resource-group "$RELAY_RG" \ |
69 | | - --namespace-name "$RELAY_NAMESPACE_NAME" \ |
70 | | - --hybrid-connection-name "hc-${MACHINE}" \ |
71 | | - --name listen \ |
72 | | - --query primaryKey -o tsv 2>/tmp/relay_key_err_${MACHINE}) || { |
73 | | - ERR=$(cat /tmp/relay_key_err_${MACHINE}) |
74 | | - echo "##vso[task.logissue type=warning]Failed to fetch relay SAS key for hc-${MACHINE}: $ERR" |
75 | | - SAS_KEY="" |
76 | | - } |
77 | | - |
78 | | - [[ -z "$SAS_KEY" ]] && \ |
79 | | - echo "##vso[task.logissue type=warning]No relay SAS key found for hc-${MACHINE} — relay listener will not connect" |
80 | | - |
81 | | - # Cloud API secrets are optional — warn if absent, services still start |
82 | | - CLOUD_API_ENDPOINT=$(az keyvault secret show --vault-name "$KV_NAME" \ |
83 | | - --name "cloud-api-endpoint" --query value -o tsv 2>/dev/null || echo "") |
84 | | - CLOUD_API_TOKEN=$(az keyvault secret show --vault-name "$KV_NAME" \ |
85 | | - --name "cloud-api-token-${MACHINE}" --query value -o tsv 2>/dev/null || echo "") |
86 | | - |
87 | | - [[ -z "$CLOUD_API_ENDPOINT" ]] && \ |
88 | | - echo "##vso[task.logissue type=warning]cloud-api-endpoint not in $KV_NAME — Upload service will not reach cloud API for $MACHINE" |
89 | | - [[ -z "$CLOUD_API_TOKEN" ]] && \ |
90 | | - echo "##vso[task.logissue type=warning]cloud-api-token-${MACHINE} not in $KV_NAME — Upload service will not authenticate for $MACHINE" |
91 | | - |
92 | 62 | # Build .env, then base64-encode to pass newlines as a run command parameter. |
93 | 63 | # NOTE: Arc Run Command drops protectedParameters for inline source.script, |
94 | 64 | # so EnvContentB64 travels as a regular parameter (base64-encoded, not plain text). |
95 | | - # TODO: migrate to Key Vault + Arc MSI for production environments. |
96 | 65 | ENV_CONTENT="AZURE_RELAY_NAMESPACE=${RELAY_NAMESPACE_HOSTNAME} |
97 | 66 | AZURE_RELAY_HYBRID_CONNECTION=hc-${MACHINE} |
98 | | -AZURE_RELAY_KEY_NAME=listen |
99 | | -AZURE_RELAY_SHARED_ACCESS_KEY=${SAS_KEY} |
100 | 67 | CLOUD_API_ENDPOINT=${CLOUD_API_ENDPOINT} |
101 | | -CLOUD_API_TOKEN=${CLOUD_API_TOKEN} |
| 68 | +APPLICATIONINSIGHTS_CONNECTION_STRING=${APPLICATIONINSIGHTS_CONNECTION_STRING} |
102 | 69 | MWL_AET=SCREENING_MWL |
103 | 70 | MWL_PORT=4243 |
104 | 71 | MWL_DB_PATH=${BASE_PATH}/data/worklist.db |
|
0 commit comments