DTOSS-12586: Set up dev and preprod environments infrastructure and fix deployment pipeline - #77
Merged
Conversation
josielsouzanordcloud
force-pushed
the
DTOSS-12586-preprod-environment-setup
branch
2 times, most recently
from
April 10, 2026 09:48
db3a289 to
e73daa1
Compare
- Extend infra pipeline deployment matrix to cover dev and preprod;
remove prod from app deploy (not yet ready)
- Rename ADO service connection references from manbgw-* to mbsgw-*
- Move Arc-enabled servers RG from Terraform-managed resource to a
data source — RG is now pre-created by Bicep to break the
chicken-and-egg on first apply
- Add Arc-enabled servers RG creation to core.bicep with new
appShortName/envConfig/region params
- Fix role assignment GUIDs in main.bicep to be unique per managed
identity (prevents ARM conflict on re-deploy)
- Fix resourcePolicyContributor role ID in core.bicep
- Switch AMA install and DCR association policies to correct
Windows Arc-specific built-in definition IDs
- Add Monitoring Contributor role to Arc monitor policy identity
- Add policy remediation resources for self-healing AMA/DCR setup
- Default vnet_address_space to 10.131.0.0/16 (isolated, never peered)
- Enable gateway test VM in dev environment (variables.tfvars)
- Add create-environment runbook
- Add hospital VM Arc onboarding runbook
- Remove 16-Deploy-Script-Analysis.md (moved to analyses repo)
josielsouzanordcloud
force-pushed
the
DTOSS-12586-preprod-environment-setup
branch
from
April 10, 2026 11:20
e73daa1 to
2a5fee1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Deploys Arc infrastructure to dev and preprod environments for the first time, including Arc-enabled server RBAC, relay hybrid connections, Log Analytics workspace, Data Collection Rule, and Azure Monitor policy assignments with self-healing remediation. The gateway test VM is enabled for dev only.
This PR also fixes several issues discovered during the preprod setup:
core.bicep) so it exists before Terraform runs, fixingfor_eachunknown value errors on new environment deploymentsresourcePolicyContributorrole and Azure Monitor policy definitions (ama_install,dcr_association)main.bicepby using the managed identity name instead ofenvConfigas the GUID seedMonitoring Contributorrole to the policy remediation identity, fixing DCR association failures (Microsoft.Insights/dataCollectionRuleAssociations/write)manbgw-tombsgw-to match naming conventionprodfrom app deployment targets (dev and preprod only for now)docs/deployment/infrastructure/create-environment.md— step-by-step guide for bootstrapping new environmentsJira link
DTOSS-12586
Review notes
Review checklist