From 9c748fa3ef58b66910324e965c880e1704f2c1cb Mon Sep 17 00:00:00 2001 From: Steve Laing Date: Thu, 18 Jun 2026 16:38:40 +0100 Subject: [PATCH 1/6] Remove date segment in run command name Azure Arc remote machines are limited to 25 run commands. The command we currently issue when deploying has a date in the name and this uniqueness means we hit this threshold regularly. Run commands with non-unique names overwrite one another. For the purposes of deploying to a machine this is fine as the command contains the clean sha (PR number or version) and the machine name. --- .github/workflows/cicd-2-main-branch.yaml | 46 +++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/.github/workflows/cicd-2-main-branch.yaml b/.github/workflows/cicd-2-main-branch.yaml index dabe8b44..4ecfa36a 100644 --- a/.github/workflows/cicd-2-main-branch.yaml +++ b/.github/workflows/cicd-2-main-branch.yaml @@ -15,6 +15,7 @@ on: - dev - preprod - review + - prod concurrency: cicd-${{ github.ref }} @@ -76,6 +77,7 @@ jobs: deploy_dev: ${{ steps.envs.outputs.deploy_dev }} deploy_preprod: ${{ steps.envs.outputs.deploy_preprod }} deploy_review: ${{ steps.envs.outputs.deploy_review }} + deploy_prod: ${{ steps.envs.outputs.deploy_prod }} env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: @@ -88,22 +90,32 @@ jobs: echo "deploy_dev=true" >> "$GITHUB_OUTPUT" echo "deploy_preprod=false" >> "$GITHUB_OUTPUT" echo "deploy_review=false" >> "$GITHUB_OUTPUT" + echo "deploy_prod=false" >> "$GITHUB_OUTPUT" ;; preprod) echo "deploy_dev=false" >> "$GITHUB_OUTPUT" echo "deploy_preprod=true" >> "$GITHUB_OUTPUT" echo "deploy_review=false" >> "$GITHUB_OUTPUT" + echo "deploy_prod=false" >> "$GITHUB_OUTPUT" ;; review) echo "deploy_dev=false" >> "$GITHUB_OUTPUT" echo "deploy_preprod=false" >> "$GITHUB_OUTPUT" echo "deploy_review=true" >> "$GITHUB_OUTPUT" + echo "deploy_prod=false" >> "$GITHUB_OUTPUT" + ;; + prod) + echo "deploy_dev=false" >> "$GITHUB_OUTPUT" + echo "deploy_preprod=false" >> "$GITHUB_OUTPUT" + echo "deploy_review=false" >> "$GITHUB_OUTPUT" + echo "deploy_prod=true" >> "$GITHUB_OUTPUT" ;; *) # push-to-main (empty input): deploy to both dev and preprod echo "deploy_dev=true" >> "$GITHUB_OUTPUT" echo "deploy_preprod=true" >> "$GITHUB_OUTPUT" echo "deploy_review=false" >> "$GITHUB_OUTPUT" + echo "deploy_prod=false" >> "$GITHUB_OUTPUT" ;; esac @@ -186,6 +198,40 @@ jobs: branch_name: ${{ github.ref_name }} secrets: inherit + deploy-infra-prod: + name: Deploy infra (prod) + needs: [resolve, deploy-app-dev] + if: | + always() && + needs.resolve.outputs.deploy_prod == 'true' && + (needs.deploy-app-dev.result == 'success' || needs.deploy-app-dev.result == 'skipped') + permissions: + id-token: write + uses: ./.github/workflows/stage-4-deploy.yaml + with: + environments: '["prod"]' + commit_sha: ${{ github.sha }} + branch_name: ${{ github.ref_name }} + secrets: inherit + + deploy-app-prod: + name: Deploy app (prod) + needs: [resolve, deploy-infra-prod] + if: | + always() && + needs.resolve.outputs.deploy_prod == 'true' && + needs.deploy-infra-prod.result == 'success' + permissions: + id-token: write + uses: ./.github/workflows/stage-4-deploy-app.yaml + with: + environments: '["prod"]' + release_tag: ${{ needs.resolve.outputs.release_tag }} + commit_sha: ${{ github.sha }} + branch_name: ${{ github.ref_name }} + secrets: inherit + + # ---- review (manual only) ------------------------------------------------- deploy-infra-review: From 3ef9344c4959a2d9d227f1081d98581b27403e79 Mon Sep 17 00:00:00 2001 From: Alastair Lock Date: Tue, 30 Jun 2026 13:06:10 +0100 Subject: [PATCH 2/6] Hard code in the arc principal id --- .github/workflows/cicd-2-main-branch.yaml | 1 + .gitleaksignore | 6 ++++++ infrastructure/environments/dev/variables.sh | 1 + infrastructure/environments/preprod/variables.sh | 1 + infrastructure/environments/prod/variables.sh | 2 ++ infrastructure/environments/review/variables.sh | 1 + infrastructure/modules/arc-infra/arc.tf | 12 +++++++----- 7 files changed, 19 insertions(+), 5 deletions(-) diff --git a/.github/workflows/cicd-2-main-branch.yaml b/.github/workflows/cicd-2-main-branch.yaml index 4ecfa36a..9c75e9b1 100644 --- a/.github/workflows/cicd-2-main-branch.yaml +++ b/.github/workflows/cicd-2-main-branch.yaml @@ -198,6 +198,7 @@ jobs: branch_name: ${{ github.ref_name }} secrets: inherit + # ---- prod -------------------------------------------------------------- deploy-infra-prod: name: Deploy infra (prod) needs: [resolve, deploy-app-dev] diff --git a/.gitleaksignore b/.gitleaksignore index 4bca537f..41f1a440 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -109,3 +109,9 @@ feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_proces feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:131 feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:150 feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:174 + +# Ignore the SCREENING_ENTRA_GROUP_ID +infrastructure/environments/prod/variables.sh:generic-api-key:10 +infrastructure/environments/preprod/variables.sh:generic-api-key:10 +infrastructure/environments/dev/variables.sh:generic-api-key:10 +infrastructure/environments/review/variables.sh:generic-api-key:10 diff --git a/infrastructure/environments/dev/variables.sh b/infrastructure/environments/dev/variables.sh index 085d3935..8b5f4627 100644 --- a/infrastructure/environments/dev/variables.sh +++ b/infrastructure/environments/dev/variables.sh @@ -7,3 +7,4 @@ TERRAFORM_MODULES_REF=main ENABLE_SOFT_DELETE=false ADO_MANAGEMENT_POOL=private-pool-dev-uks CLOUD_API_HOSTNAME=dev.manage-breast-screening.non-live.screening.nhs.uk +SCREENING_ENTRA_GROUP_ID="f20d9f9a-b1ac-4875-a5e1-f9dfc0307c34" diff --git a/infrastructure/environments/preprod/variables.sh b/infrastructure/environments/preprod/variables.sh index 81484ec9..c8f50a1a 100644 --- a/infrastructure/environments/preprod/variables.sh +++ b/infrastructure/environments/preprod/variables.sh @@ -7,4 +7,5 @@ TERRAFORM_MODULES_REF=main ENABLE_SOFT_DELETE=true ADO_MANAGEMENT_POOL=private-pool-prod-uks CLOUD_API_HOSTNAME=preprod.manage-breast-screening.nhs.uk +SCREENING_ENTRA_GROUP_ID="ab8fd001-2722-4118-9659-3d4425db7894" GATEWAY_RINGS="ring1" diff --git a/infrastructure/environments/prod/variables.sh b/infrastructure/environments/prod/variables.sh index 6bc7e584..8f96ca86 100644 --- a/infrastructure/environments/prod/variables.sh +++ b/infrastructure/environments/prod/variables.sh @@ -7,5 +7,7 @@ HUB=prod ENABLE_SOFT_DELETE=true ADO_MANAGEMENT_POOL=private-pool-prod-uks CLOUD_API_HOSTNAME=manage-breast-screening.nhs.uk +SCREENING_ENTRA_GROUP_ID="3b2b22b0-ac8e-4904-a94b-9010ff08698a" # ring1 = first real sites (one per PACS vendor) +# To onboard more rings: set GATEWAY_RINGS="ring0 ring1 ring2 ..." in this file GATEWAY_RINGS="ring1" diff --git a/infrastructure/environments/review/variables.sh b/infrastructure/environments/review/variables.sh index 9f9779a5..287ac969 100644 --- a/infrastructure/environments/review/variables.sh +++ b/infrastructure/environments/review/variables.sh @@ -7,3 +7,4 @@ TERRAFORM_MODULES_REF=main ENABLE_SOFT_DELETE=false ADO_MANAGEMENT_POOL=private-pool-dev-uks CLOUD_API_HOSTNAME=review.manage-breast-screening.non-live.screening.nhs.uk +SCREENING_ENTRA_GROUP_ID="14f915c3-ef0a-471b-b9bf-31187d18f8b6" diff --git a/infrastructure/modules/arc-infra/arc.tf b/infrastructure/modules/arc-infra/arc.tf index 58ab3b44..ec6b10fc 100644 --- a/infrastructure/modules/arc-infra/arc.tf +++ b/infrastructure/modules/arc-infra/arc.tf @@ -13,10 +13,10 @@ data "azuread_service_principal" "arc_onboarding" { } # Look up the Entra ID group that manages this environment -data "azuread_group" "screening" { - count = var.enable_arc_servers ? 1 : 0 - display_name = "screening_${var.app_short_name}_${var.env_config}" -} +# data "azuread_group" "screening" { +# count = var.enable_arc_servers ? 1 : 0 +# display_name = "screening_${var.app_short_name}_${var.env_config}" +# } # Assign "Azure Connected Machine Onboarding" role to allow Arc server enrollment module "arc_onboarding_role" { @@ -37,5 +37,7 @@ module "arc_wac_admin_login_role" { scope = data.azurerm_resource_group.arc_enabled_servers[0].id role_definition_name = "Windows Admin Center Administrator Login" - principal_id = data.azuread_group.screening[0].object_id + # principal_id = data.azuread_group.screening[0].object_id + principal_id = "3b2b22b0-ac8e-4904-a94b-9010ff08698a" + } From 6d177d27213a96d2f2fc7e728c9ef022f8719c03 Mon Sep 17 00:00:00 2001 From: Ife Ayelabola Date: Fri, 3 Jul 2026 13:08:10 +0100 Subject: [PATCH 3/6] added use temporary variable for group id --- infrastructure/modules/arc-infra/arc.tf | 5 ++++- infrastructure/modules/arc-infra/variables.tf | 5 +++++ infrastructure/terraform/main.tf | 1 + infrastructure/terraform/variables.tf | 5 +++++ 4 files changed, 15 insertions(+), 1 deletion(-) diff --git a/infrastructure/modules/arc-infra/arc.tf b/infrastructure/modules/arc-infra/arc.tf index ec6b10fc..55183966 100644 --- a/infrastructure/modules/arc-infra/arc.tf +++ b/infrastructure/modules/arc-infra/arc.tf @@ -12,6 +12,7 @@ data "azuread_service_principal" "arc_onboarding" { display_name = "spn-azure-arc-onboarding-screening-${var.env_config}" } +# Awaiting approval from Administrator team, # Look up the Entra ID group that manages this environment # data "azuread_group" "screening" { # count = var.enable_arc_servers ? 1 : 0 @@ -37,7 +38,9 @@ module "arc_wac_admin_login_role" { scope = data.azurerm_resource_group.arc_enabled_servers[0].id role_definition_name = "Windows Admin Center Administrator Login" + # Waiting for approval to be provided by the Administrator team, + # This is a temporary fix till approval has been provided. # principal_id = data.azuread_group.screening[0].object_id - principal_id = "3b2b22b0-ac8e-4904-a94b-9010ff08698a" + principal_id = var.screening_entra_group_id } diff --git a/infrastructure/modules/arc-infra/variables.tf b/infrastructure/modules/arc-infra/variables.tf index 412cfe8b..cd2fb9f2 100644 --- a/infrastructure/modules/arc-infra/variables.tf +++ b/infrastructure/modules/arc-infra/variables.tf @@ -28,3 +28,8 @@ variable "static_arc_machine_names" { type = list(string) default = [] } + +variable "screening_entra_group_id" { + description = "Group ID for the environment" + type = string +} diff --git a/infrastructure/terraform/main.tf b/infrastructure/terraform/main.tf index ac3fbfc1..bddc5384 100644 --- a/infrastructure/terraform/main.tf +++ b/infrastructure/terraform/main.tf @@ -11,6 +11,7 @@ module "arc_infra" { env_config = var.env_config resource_group_name = local.resource_group_name enable_arc_servers = var.enable_arc_servers + screening_entra_group_id = var.screening_entra_group_id # Create the HC for the test VM in the same run as VM creation. # The Arc data source won't see a machine registered in the same apply. diff --git a/infrastructure/terraform/variables.tf b/infrastructure/terraform/variables.tf index db894346..21a73b95 100644 --- a/infrastructure/terraform/variables.tf +++ b/infrastructure/terraform/variables.tf @@ -44,6 +44,11 @@ variable "bastion_sku" { default = "Standard" } +variable "screening_entra_group_id" { + description = "Group ID for the environment" + type = string +} + variable "gateway_test_vm_size" { description = "SKU size for the gateway test VM" type = string From d520b1fd9ca5bb1d27a0e0ad9279ec1064f95c53 Mon Sep 17 00:00:00 2001 From: Ife Ayelabola Date: Fri, 3 Jul 2026 13:18:32 +0100 Subject: [PATCH 4/6] fixing guid placed in wrong file --- .gitleaksignore | 8 ++++---- infrastructure/environments/dev/variables.sh | 1 - infrastructure/environments/dev/variables.tfvars | 1 + infrastructure/environments/preprod/variables.sh | 1 - infrastructure/environments/preprod/variables.tfvars | 1 + infrastructure/environments/prod/variables.tfvars | 1 + infrastructure/environments/review/variables.sh | 1 - infrastructure/environments/review/variables.tfvars | 1 + 8 files changed, 8 insertions(+), 7 deletions(-) diff --git a/.gitleaksignore b/.gitleaksignore index 41f1a440..cbfb0ad5 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -111,7 +111,7 @@ feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_proces feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:174 # Ignore the SCREENING_ENTRA_GROUP_ID -infrastructure/environments/prod/variables.sh:generic-api-key:10 -infrastructure/environments/preprod/variables.sh:generic-api-key:10 -infrastructure/environments/dev/variables.sh:generic-api-key:10 -infrastructure/environments/review/variables.sh:generic-api-key:10 +infrastructure/environments/prod/variables.tfvars:generic-api-key:2 +infrastructure/environments/preprod/variables.tfvars:generic-api-key:2 +infrastructure/environments/dev/variables.tfvars:generic-api-key:2 +infrastructure/environments/review/variables.tfvars:generic-api-key:2 diff --git a/infrastructure/environments/dev/variables.sh b/infrastructure/environments/dev/variables.sh index 8b5f4627..085d3935 100644 --- a/infrastructure/environments/dev/variables.sh +++ b/infrastructure/environments/dev/variables.sh @@ -7,4 +7,3 @@ TERRAFORM_MODULES_REF=main ENABLE_SOFT_DELETE=false ADO_MANAGEMENT_POOL=private-pool-dev-uks CLOUD_API_HOSTNAME=dev.manage-breast-screening.non-live.screening.nhs.uk -SCREENING_ENTRA_GROUP_ID="f20d9f9a-b1ac-4875-a5e1-f9dfc0307c34" diff --git a/infrastructure/environments/dev/variables.tfvars b/infrastructure/environments/dev/variables.tfvars index a1042038..5464cf79 100644 --- a/infrastructure/environments/dev/variables.tfvars +++ b/infrastructure/environments/dev/variables.tfvars @@ -1 +1,2 @@ enable_gateway_test_vm = true +SCREENING_ENTRA_GROUP_ID="f20d9f9a-b1ac-4875-a5e1-f9dfc0307c34" \ No newline at end of file diff --git a/infrastructure/environments/preprod/variables.sh b/infrastructure/environments/preprod/variables.sh index c8f50a1a..81484ec9 100644 --- a/infrastructure/environments/preprod/variables.sh +++ b/infrastructure/environments/preprod/variables.sh @@ -7,5 +7,4 @@ TERRAFORM_MODULES_REF=main ENABLE_SOFT_DELETE=true ADO_MANAGEMENT_POOL=private-pool-prod-uks CLOUD_API_HOSTNAME=preprod.manage-breast-screening.nhs.uk -SCREENING_ENTRA_GROUP_ID="ab8fd001-2722-4118-9659-3d4425db7894" GATEWAY_RINGS="ring1" diff --git a/infrastructure/environments/preprod/variables.tfvars b/infrastructure/environments/preprod/variables.tfvars index f560dcbc..78835a3e 100644 --- a/infrastructure/environments/preprod/variables.tfvars +++ b/infrastructure/environments/preprod/variables.tfvars @@ -1 +1,2 @@ # All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true +SCREENING_ENTRA_GROUP_ID="ab8fd001-2722-4118-9659-3d4425db7894" \ No newline at end of file diff --git a/infrastructure/environments/prod/variables.tfvars b/infrastructure/environments/prod/variables.tfvars index f560dcbc..f766843e 100644 --- a/infrastructure/environments/prod/variables.tfvars +++ b/infrastructure/environments/prod/variables.tfvars @@ -1 +1,2 @@ # All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true +SCREENING_ENTRA_GROUP_ID="3b2b22b0-ac8e-4904-a94b-9010ff08698a" \ No newline at end of file diff --git a/infrastructure/environments/review/variables.sh b/infrastructure/environments/review/variables.sh index 287ac969..9f9779a5 100644 --- a/infrastructure/environments/review/variables.sh +++ b/infrastructure/environments/review/variables.sh @@ -7,4 +7,3 @@ TERRAFORM_MODULES_REF=main ENABLE_SOFT_DELETE=false ADO_MANAGEMENT_POOL=private-pool-dev-uks CLOUD_API_HOSTNAME=review.manage-breast-screening.non-live.screening.nhs.uk -SCREENING_ENTRA_GROUP_ID="14f915c3-ef0a-471b-b9bf-31187d18f8b6" diff --git a/infrastructure/environments/review/variables.tfvars b/infrastructure/environments/review/variables.tfvars index a1042038..c2043e99 100644 --- a/infrastructure/environments/review/variables.tfvars +++ b/infrastructure/environments/review/variables.tfvars @@ -1 +1,2 @@ enable_gateway_test_vm = true +SCREENING_ENTRA_GROUP_ID="14f915c3-ef0a-471b-b9bf-31187d18f8b6" \ No newline at end of file From 9c8caf54e3ee34bd87b5b6a3e0ceb9bca651ef5b Mon Sep 17 00:00:00 2001 From: Ife Ayelabola Date: Fri, 3 Jul 2026 13:24:51 +0100 Subject: [PATCH 5/6] updating variable to lowercase --- infrastructure/environments/dev/variables.tfvars | 2 +- infrastructure/environments/preprod/variables.tfvars | 2 +- infrastructure/environments/review/variables.tfvars | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/infrastructure/environments/dev/variables.tfvars b/infrastructure/environments/dev/variables.tfvars index 5464cf79..e3b80dd3 100644 --- a/infrastructure/environments/dev/variables.tfvars +++ b/infrastructure/environments/dev/variables.tfvars @@ -1,2 +1,2 @@ enable_gateway_test_vm = true -SCREENING_ENTRA_GROUP_ID="f20d9f9a-b1ac-4875-a5e1-f9dfc0307c34" \ No newline at end of file +screening_entra_group_id="f20d9f9a-b1ac-4875-a5e1-f9dfc0307c34" \ No newline at end of file diff --git a/infrastructure/environments/preprod/variables.tfvars b/infrastructure/environments/preprod/variables.tfvars index 78835a3e..3050526d 100644 --- a/infrastructure/environments/preprod/variables.tfvars +++ b/infrastructure/environments/preprod/variables.tfvars @@ -1,2 +1,2 @@ # All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true -SCREENING_ENTRA_GROUP_ID="ab8fd001-2722-4118-9659-3d4425db7894" \ No newline at end of file +screening_entra_group_id="ab8fd001-2722-4118-9659-3d4425db7894" \ No newline at end of file diff --git a/infrastructure/environments/review/variables.tfvars b/infrastructure/environments/review/variables.tfvars index c2043e99..886564cb 100644 --- a/infrastructure/environments/review/variables.tfvars +++ b/infrastructure/environments/review/variables.tfvars @@ -1,2 +1,2 @@ enable_gateway_test_vm = true -SCREENING_ENTRA_GROUP_ID="14f915c3-ef0a-471b-b9bf-31187d18f8b6" \ No newline at end of file +screening_entra_group_id="14f915c3-ef0a-471b-b9bf-31187d18f8b6" \ No newline at end of file From 767c164bbf3060d2a4e34d0771ca531820aeb9f4 Mon Sep 17 00:00:00 2001 From: Alastair Lock Date: Fri, 3 Jul 2026 14:55:23 +0100 Subject: [PATCH 6/6] Remove prod from the cicd-main Instead we will deploy using the tag using cicd-3 --- .github/workflows/cicd-2-main-branch.yaml | 47 ------------------- .../environments/dev/variables.tfvars | 4 +- .../environments/preprod/variables.tfvars | 2 +- .../environments/prod/variables.tfvars | 2 +- .../environments/review/variables.tfvars | 4 +- infrastructure/modules/arc-infra/arc.tf | 7 ++- infrastructure/modules/gateway-test-vm/vm.tf | 4 +- infrastructure/terraform/main.tf | 10 ++-- 8 files changed, 16 insertions(+), 64 deletions(-) diff --git a/.github/workflows/cicd-2-main-branch.yaml b/.github/workflows/cicd-2-main-branch.yaml index 9c75e9b1..dabe8b44 100644 --- a/.github/workflows/cicd-2-main-branch.yaml +++ b/.github/workflows/cicd-2-main-branch.yaml @@ -15,7 +15,6 @@ on: - dev - preprod - review - - prod concurrency: cicd-${{ github.ref }} @@ -77,7 +76,6 @@ jobs: deploy_dev: ${{ steps.envs.outputs.deploy_dev }} deploy_preprod: ${{ steps.envs.outputs.deploy_preprod }} deploy_review: ${{ steps.envs.outputs.deploy_review }} - deploy_prod: ${{ steps.envs.outputs.deploy_prod }} env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: @@ -90,32 +88,22 @@ jobs: echo "deploy_dev=true" >> "$GITHUB_OUTPUT" echo "deploy_preprod=false" >> "$GITHUB_OUTPUT" echo "deploy_review=false" >> "$GITHUB_OUTPUT" - echo "deploy_prod=false" >> "$GITHUB_OUTPUT" ;; preprod) echo "deploy_dev=false" >> "$GITHUB_OUTPUT" echo "deploy_preprod=true" >> "$GITHUB_OUTPUT" echo "deploy_review=false" >> "$GITHUB_OUTPUT" - echo "deploy_prod=false" >> "$GITHUB_OUTPUT" ;; review) echo "deploy_dev=false" >> "$GITHUB_OUTPUT" echo "deploy_preprod=false" >> "$GITHUB_OUTPUT" echo "deploy_review=true" >> "$GITHUB_OUTPUT" - echo "deploy_prod=false" >> "$GITHUB_OUTPUT" - ;; - prod) - echo "deploy_dev=false" >> "$GITHUB_OUTPUT" - echo "deploy_preprod=false" >> "$GITHUB_OUTPUT" - echo "deploy_review=false" >> "$GITHUB_OUTPUT" - echo "deploy_prod=true" >> "$GITHUB_OUTPUT" ;; *) # push-to-main (empty input): deploy to both dev and preprod echo "deploy_dev=true" >> "$GITHUB_OUTPUT" echo "deploy_preprod=true" >> "$GITHUB_OUTPUT" echo "deploy_review=false" >> "$GITHUB_OUTPUT" - echo "deploy_prod=false" >> "$GITHUB_OUTPUT" ;; esac @@ -198,41 +186,6 @@ jobs: branch_name: ${{ github.ref_name }} secrets: inherit - # ---- prod -------------------------------------------------------------- - deploy-infra-prod: - name: Deploy infra (prod) - needs: [resolve, deploy-app-dev] - if: | - always() && - needs.resolve.outputs.deploy_prod == 'true' && - (needs.deploy-app-dev.result == 'success' || needs.deploy-app-dev.result == 'skipped') - permissions: - id-token: write - uses: ./.github/workflows/stage-4-deploy.yaml - with: - environments: '["prod"]' - commit_sha: ${{ github.sha }} - branch_name: ${{ github.ref_name }} - secrets: inherit - - deploy-app-prod: - name: Deploy app (prod) - needs: [resolve, deploy-infra-prod] - if: | - always() && - needs.resolve.outputs.deploy_prod == 'true' && - needs.deploy-infra-prod.result == 'success' - permissions: - id-token: write - uses: ./.github/workflows/stage-4-deploy-app.yaml - with: - environments: '["prod"]' - release_tag: ${{ needs.resolve.outputs.release_tag }} - commit_sha: ${{ github.sha }} - branch_name: ${{ github.ref_name }} - secrets: inherit - - # ---- review (manual only) ------------------------------------------------- deploy-infra-review: diff --git a/infrastructure/environments/dev/variables.tfvars b/infrastructure/environments/dev/variables.tfvars index e3b80dd3..0ba14f7a 100644 --- a/infrastructure/environments/dev/variables.tfvars +++ b/infrastructure/environments/dev/variables.tfvars @@ -1,2 +1,2 @@ -enable_gateway_test_vm = true -screening_entra_group_id="f20d9f9a-b1ac-4875-a5e1-f9dfc0307c34" \ No newline at end of file +enable_gateway_test_vm = true +screening_entra_group_id = "f20d9f9a-b1ac-4875-a5e1-f9dfc0307c34" diff --git a/infrastructure/environments/preprod/variables.tfvars b/infrastructure/environments/preprod/variables.tfvars index 3050526d..34c404fa 100644 --- a/infrastructure/environments/preprod/variables.tfvars +++ b/infrastructure/environments/preprod/variables.tfvars @@ -1,2 +1,2 @@ # All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true -screening_entra_group_id="ab8fd001-2722-4118-9659-3d4425db7894" \ No newline at end of file +screening_entra_group_id = "ab8fd001-2722-4118-9659-3d4425db7894" diff --git a/infrastructure/environments/prod/variables.tfvars b/infrastructure/environments/prod/variables.tfvars index f766843e..7a560678 100644 --- a/infrastructure/environments/prod/variables.tfvars +++ b/infrastructure/environments/prod/variables.tfvars @@ -1,2 +1,2 @@ # All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true -SCREENING_ENTRA_GROUP_ID="3b2b22b0-ac8e-4904-a94b-9010ff08698a" \ No newline at end of file +SCREENING_ENTRA_GROUP_ID = "3b2b22b0-ac8e-4904-a94b-9010ff08698a" diff --git a/infrastructure/environments/review/variables.tfvars b/infrastructure/environments/review/variables.tfvars index 886564cb..2a9578a0 100644 --- a/infrastructure/environments/review/variables.tfvars +++ b/infrastructure/environments/review/variables.tfvars @@ -1,2 +1,2 @@ -enable_gateway_test_vm = true -screening_entra_group_id="14f915c3-ef0a-471b-b9bf-31187d18f8b6" \ No newline at end of file +enable_gateway_test_vm = true +screening_entra_group_id = "14f915c3-ef0a-471b-b9bf-31187d18f8b6" diff --git a/infrastructure/modules/arc-infra/arc.tf b/infrastructure/modules/arc-infra/arc.tf index 55183966..d8d7127b 100644 --- a/infrastructure/modules/arc-infra/arc.tf +++ b/infrastructure/modules/arc-infra/arc.tf @@ -12,7 +12,7 @@ data "azuread_service_principal" "arc_onboarding" { display_name = "spn-azure-arc-onboarding-screening-${var.env_config}" } -# Awaiting approval from Administrator team, +# Awaiting approval from Administrator team, a bit of push back with regards to giving Group.Read.All permission to the service principal, so for now we will use the group ID from the environment variable instead of looking it up by name. # Look up the Entra ID group that manages this environment # data "azuread_group" "screening" { # count = var.enable_arc_servers ? 1 : 0 @@ -38,9 +38,8 @@ module "arc_wac_admin_login_role" { scope = data.azurerm_resource_group.arc_enabled_servers[0].id role_definition_name = "Windows Admin Center Administrator Login" - # Waiting for approval to be provided by the Administrator team, - # This is a temporary fix till approval has been provided. + # Awaiting approval from Administrator team, a bit of push back with regards to giving Group.Read.All permission to the service principal, so for now we will use the group ID from the environment variable instead of looking it up by name. # principal_id = data.azuread_group.screening[0].object_id - principal_id = var.screening_entra_group_id + principal_id = var.screening_entra_group_id } diff --git a/infrastructure/modules/gateway-test-vm/vm.tf b/infrastructure/modules/gateway-test-vm/vm.tf index f3fab2ca..020e385e 100644 --- a/infrastructure/modules/gateway-test-vm/vm.tf +++ b/infrastructure/modules/gateway-test-vm/vm.tf @@ -39,8 +39,8 @@ module "gateway_test_vm" { account_credentials = { admin_credentials = { - username = "arcadmin" - password = data.azurerm_key_vault_secret.vm_admin_password.value + username = "arcadmin" + password = data.azurerm_key_vault_secret.vm_admin_password.value generate_admin_password_or_ssh_key = false } } diff --git a/infrastructure/terraform/main.tf b/infrastructure/terraform/main.tf index bddc5384..fe5dbb42 100644 --- a/infrastructure/terraform/main.tf +++ b/infrastructure/terraform/main.tf @@ -6,11 +6,11 @@ module "arc_infra" { azuread = azuread } - region = local.region - app_short_name = var.app_short_name - env_config = var.env_config - resource_group_name = local.resource_group_name - enable_arc_servers = var.enable_arc_servers + region = local.region + app_short_name = var.app_short_name + env_config = var.env_config + resource_group_name = local.resource_group_name + enable_arc_servers = var.enable_arc_servers screening_entra_group_id = var.screening_entra_group_id # Create the HC for the test VM in the same run as VM creation.