Merge pull request #158 from NHSDigital/adding_prod_steps_to_deploy_gateway

DTOSS-13192: Configuration changes required to deploy Prod gateway in Hull

Author: mrlockstar

.gitleaksignore

@@ -109,3 +109,9 @@ feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_proces
 feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:131
 feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:150
 feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:174
+
+# Ignore the SCREENING_ENTRA_GROUP_ID
+infrastructure/environments/prod/variables.tfvars:generic-api-key:2
+infrastructure/environments/preprod/variables.tfvars:generic-api-key:2
+infrastructure/environments/dev/variables.tfvars:generic-api-key:2
+infrastructure/environments/review/variables.tfvars:generic-api-key:2

infrastructure/environments/dev/variables.tfvars

@@ -1 +1,2 @@
-enable_gateway_test_vm = true
+enable_gateway_test_vm   = true
+screening_entra_group_id = "f20d9f9a-b1ac-4875-a5e1-f9dfc0307c34"

infrastructure/environments/preprod/variables.tfvars

@@ -1 +1,2 @@
 # All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true
+screening_entra_group_id = "ab8fd001-2722-4118-9659-3d4425db7894"

infrastructure/environments/prod/variables.sh

@@ -7,5 +7,7 @@ HUB=prod
 ENABLE_SOFT_DELETE=true
 ADO_MANAGEMENT_POOL=private-pool-prod-uks
 CLOUD_API_HOSTNAME=manage-breast-screening.nhs.uk
+SCREENING_ENTRA_GROUP_ID="3b2b22b0-ac8e-4904-a94b-9010ff08698a"
 # ring1 = first real sites (one per PACS vendor)
+# To onboard more rings: set GATEWAY_RINGS="ring0 ring1 ring2 ..." in this file
 GATEWAY_RINGS="ring1"

infrastructure/environments/prod/variables.tfvars

@@ -1 +1,2 @@
 # All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true
+SCREENING_ENTRA_GROUP_ID = "3b2b22b0-ac8e-4904-a94b-9010ff08698a"

infrastructure/environments/review/variables.tfvars

@@ -1 +1,2 @@
-enable_gateway_test_vm = true
+enable_gateway_test_vm   = true
+screening_entra_group_id = "14f915c3-ef0a-471b-b9bf-31187d18f8b6"

infrastructure/modules/arc-infra/arc.tf

@@ -12,11 +12,12 @@ data "azuread_service_principal" "arc_onboarding" {
   display_name = "spn-azure-arc-onboarding-screening-${var.env_config}"
 }
 
+# Awaiting approval from Administrator team, a bit of push back with regards to giving Group.Read.All permission to the service principal, so for now we will use the group ID from the environment variable instead of looking it up by name.
 # Look up the Entra ID group that manages this environment
-data "azuread_group" "screening" {
-  count        = var.enable_arc_servers ? 1 : 0
-  display_name = "screening_${var.app_short_name}_${var.env_config}"
-}
+# data "azuread_group" "screening" {
+#   count        = var.enable_arc_servers ? 1 : 0
+#   display_name = "screening_${var.app_short_name}_${var.env_config}"
+# }
 
 # Assign "Azure Connected Machine Onboarding" role to allow Arc server enrollment
 module "arc_onboarding_role" {
@@ -37,5 +38,8 @@ module "arc_wac_admin_login_role" {
 
   scope                = data.azurerm_resource_group.arc_enabled_servers[0].id
   role_definition_name = "Windows Admin Center Administrator Login"
-  principal_id         = data.azuread_group.screening[0].object_id
+  # Awaiting approval from Administrator team, a bit of push back with regards to giving Group.Read.All permission to the service principal, so for now we will use the group ID from the environment variable instead of looking it up by name.
+  # principal_id         = data.azuread_group.screening[0].object_id
+  principal_id = var.screening_entra_group_id
+
 }

infrastructure/modules/arc-infra/variables.tf

@@ -28,3 +28,8 @@ variable "static_arc_machine_names" {
   type        = list(string)
   default     = []
 }
+
+variable "screening_entra_group_id" {
+  description = "Group ID for the environment"
+  type        = string
+}

infrastructure/modules/gateway-test-vm/vm.tf

@@ -39,8 +39,8 @@ module "gateway_test_vm" {
 
   account_credentials = {
     admin_credentials = {
-      username                          = "arcadmin"
-      password                          = data.azurerm_key_vault_secret.vm_admin_password.value
+      username                           = "arcadmin"
+      password                           = data.azurerm_key_vault_secret.vm_admin_password.value
       generate_admin_password_or_ssh_key = false
     }
   }

infrastructure/terraform/main.tf

@@ -6,11 +6,12 @@ module "arc_infra" {
     azuread = azuread
   }
 
-  region              = local.region
-  app_short_name      = var.app_short_name
-  env_config          = var.env_config
-  resource_group_name = local.resource_group_name
-  enable_arc_servers  = var.enable_arc_servers
+  region                   = local.region
+  app_short_name           = var.app_short_name
+  env_config               = var.env_config
+  resource_group_name      = local.resource_group_name
+  enable_arc_servers       = var.enable_arc_servers
+  screening_entra_group_id = var.screening_entra_group_id
 
   # Create the HC for the test VM in the same run as VM creation.
   # The Arc data source won't see a machine registered in the same apply.