Skip to content

Commit 1e706ed

Browse files
mrlockstarmrlockstar
committed
terraform stuff
1 parent db17ca8 commit 1e706ed

7 files changed

Lines changed: 125 additions & 39 deletions

File tree

‎.azuredevops/pipelines/hub-infrastructure-dev.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ stages:
3131
displayName: Terraform Plan
3232
condition: eq(variables['Build.Reason'], 'Manual')
3333
variables:
34-
tfVarsFile: environments/$(ENVIRONMENT)/variables.tfvars
34+
tfVarsFile: ../../environments/$(ENVIRONMENT)/variables.tfvars
3535
jobs:
3636
- job: init_and_plan
3737
displayName: Init, plan, store artifact

‎infrastructure/bootstrap/hub.bicep‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ var storageAccountName = 'sa${appShortName}${regionShortName}state'
4949
var miADOtoAZname = 'mi-${appShortName}-${hubType}-adotoaz-${regionShortName}'
5050
var miGHtoADOname = 'mi-${appShortName}-${hubType}-ghtoado-${regionShortName}'
5151

52+
5253
// See: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
5354
var roleID = {
5455
CDNContributor: 'ec156ff8-a8d1-4d15-830c-5b80698ca432'

‎infrastructure/environments/nonlive-hub/variables.tfvars‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ features = {
99
log_analytics_data_export_rule_enabled = false
1010
}
1111

12+
virtual_desktop_group_active = "green"
13+
1214
projects = {
1315
lung-cancer-screening = {
1416
full_name = "Lung Cancer Screening"
@@ -22,6 +24,25 @@ projects = {
2224
}
2325
}
2426

27+
diagnostic_settings = {
28+
metric_enabled = true
29+
}
30+
31+
private_dns_zones = {
32+
is_app_services_enabled = true
33+
is_azure_sql_private_dns_zone_enabled = true
34+
is_postgres_sql_private_dns_zone_enabled = true
35+
is_storage_private_dns_zone_enabled = true
36+
is_acr_private_dns_zone_enabled = false
37+
is_app_insights_private_dns_zone_enabled = true
38+
is_apim_private_dns_zone_enabled = false
39+
is_key_vault_private_dns_zone_enabled = true
40+
is_event_hub_private_dns_zone_enabled = false
41+
is_event_grid_enabled_dns_zone_enabled = false
42+
is_container_apps_enabled_dns_zone_enabled = true
43+
}
44+
45+
2546
avd_vm_count = 1
2647
avd_maximum_sessions_allowed = 1 # per session host
2748
avd_vm_size = "Standard_D4as_v5"
@@ -68,4 +89,31 @@ regions = {
6889
}
6990
}
7091
}
92+
ukwest = {
93+
address_space = "10.65.0.0/16"
94+
is_primary_region = true
95+
subnets = {
96+
pep = {
97+
cidr_newbits = 8
98+
cidr_offset = 2
99+
}
100+
virtual-desktop = {
101+
cidr_newbits = 11
102+
cidr_offset = 32
103+
}
104+
dns-resolver-in = {
105+
cidr_newbits = 12
106+
cidr_offset = 112
107+
delegation_name = "Microsoft.Network/dnsResolvers"
108+
service_delegation_name = "Microsoft.Network/dnsResolvers"
109+
service_delegation_actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
110+
}
111+
firewall = {
112+
name = "AzureFirewallSubnet"
113+
cidr_newbits = 10
114+
cidr_offset = 192
115+
create_nsg = false
116+
}
117+
}
118+
}
71119
}

‎infrastructure/terraform/hub/baseline.tf‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
resource "azurerm_resource_group" "rg_base" {
2+
for_each = var.regions
3+
4+
name = module.config[each.key].names.resource-group
5+
location = each.key
6+
}
7+
8+
resource "azurerm_resource_group" "rg_project" {
9+
# create a resource group for every project for every region:
10+
for_each = local.projects_map
11+
12+
name = "${module.config[each.value.region_key].names.resource-group}-${each.value.short_name}"
13+
location = each.value.region_key
14+
tags = length(each.value.tags) > 0 ? each.value.tags : var.tags
15+
}
16+
17+
locals {
18+
19+
# Create a flat list of projects with region keys for consumption in a for_each meta argument
20+
projects_flatlist = flatten([
21+
for region_key, region_val in var.regions : [
22+
for project_key, project_val in var.projects : {
23+
key = "${project_key}-${region_key}"
24+
region_key = region_key
25+
is_primary_region = region_val.is_primary_region
26+
project_key = project_key
27+
full_name = project_val.full_name
28+
short_name = project_val.short_name
29+
acr = project_val.acr
30+
tags = project_val.tags
31+
}
32+
]
33+
])
34+
35+
# Project the above list into a map with unique keys for consumption in a for_each meta argument
36+
projects_map = { for project in local.projects_flatlist : project.key => project }
37+
}

‎infrastructure/terraform/hub/dns_private.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,8 @@ module "private_dns_resolver" {
4040

4141
locals {
4242
private_dns_zones = {
43-
national_screening = var.dns_zone_name_private.nationalscreening
44-
screening = var.dns_zone_name_private.screening
43+
# national_screening = var.dns_zone_name_private.nationalscreening
44+
# screening = var.dns_zone_name_private.screening
4545
container_registry = "privatelink.azurecr.io"
4646
app_insights = var.private_dns_zones.is_app_insights_private_dns_zone_enabled ? "privatelink.monitor.azure.com" : null
4747
automation = var.private_dns_zones.is_app_insights_private_dns_zone_enabled ? "privatelink.agentsvc.azure-automation.net" : null
@@ -79,7 +79,7 @@ module "private_dns_zones" {
7979

8080
name = each.value.name
8181
resource_group_name = azurerm_resource_group.private_dns_rg[each.value.region].name
82-
vnet_id = data.azurerm_virtual_network.hub[0].id
82+
vnet_id = data.azurerm_virtual_network.this.id
8383

8484
tags = var.tags
8585
}

‎infrastructure/terraform/hub/outputs.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@ output "private_endpoint_rg_name" {
3030
value = { for k, v in azurerm_resource_group.rg_private_endpoints : k => v.name }
3131
}
3232

33-
output "public_dns_zone_rg_name" {
34-
value = var.dns_zone_rg_name_public
35-
}
33+
# output "public_dns_zone_rg_name" {
34+
# value = var.dns_zone_rg_name_public
35+
# }
3636

3737
output "subnets_hub" {
3838
value = module.subnets_hub

‎infrastructure/terraform/hub/variables.tf‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@ variable "AVD_SOURCE_IMAGE_ID" {
44
default = null
55
}
66

7-
variable "HUB_BACKEND_AZURE_STORAGE_ACCOUNT_NAME" {
8-
description = "Storage account for certbot state"
9-
type = string
10-
}
7+
# variable "HUB_BACKEND_AZURE_STORAGE_ACCOUNT_NAME" {
8+
# description = "Storage account for certbot state"
9+
# type = string
10+
# }
1111

1212
variable "GITHUB_ORG_DATABASE_ID" {
1313
description = "GitHub Organization Database ID, specified via TF_VAR env var"
@@ -21,10 +21,10 @@ variable "TARGET_SUBSCRIPTION_ID" {
2121
}
2222

2323

24-
variable "WAF_POLICY_ID_APIM_GATEWAY" {
25-
description = "ID of the WAF policy which will be bound to the Application Gateway listener for APIM Gateway"
26-
type = string
27-
}
24+
# variable "WAF_POLICY_ID_APIM_GATEWAY" {
25+
# description = "ID of the WAF policy which will be bound to the Application Gateway listener for APIM Gateway"
26+
# type = string
27+
# }
2828

2929
variable "regions" {
3030
type = map(object({
@@ -48,10 +48,10 @@ variable "application" {
4848
default = "hub"
4949
}
5050

51-
variable "attached_environments" {
52-
description = "Configuration of the Log Analytics Workspace"
53-
type = list(string)
54-
}
51+
# variable "attached_environments" {
52+
# description = "Configuration of the Log Analytics Workspace"
53+
# type = list(string)
54+
# }
5555

5656
variable "avd_users_group_name" {
5757
description = "Entra ID group containing AVD users"
@@ -106,19 +106,19 @@ variable "diagnostic_settings" {
106106
})
107107
}
108108

109-
variable "dns_zone_name_private" {
110-
type = map(string)
111-
description = "Map of zone identifiers to their full private DNS zone names"
112-
}
109+
# variable "dns_zone_name_private" {
110+
# type = map(string)
111+
# description = "Map of zone identifiers to their full private DNS zone names"
112+
# }
113113

114-
variable "dns_zone_name_public" {
115-
type = map(string)
116-
description = "Map of zone identifiers to their full public DNS zone names"
117-
}
114+
# variable "dns_zone_name_public" {
115+
# type = map(string)
116+
# description = "Map of zone identifiers to their full public DNS zone names"
117+
# }
118118

119-
variable "dns_zone_rg_name_public" {
120-
type = string
121-
}
119+
# variable "dns_zone_rg_name_public" {
120+
# type = string
121+
# }
122122

123123
variable "environment" {
124124
description = "Environment code for deployments"
@@ -156,15 +156,15 @@ variable "firewall_config" {
156156
default = {}
157157
}
158158

159-
variable "key_vault" {
160-
description = "Configuration for the key vault"
161-
type = object({
162-
disk_encryption = optional(bool, true)
163-
soft_del_ret_days = optional(number, 7)
164-
purge_prot = optional(bool, false)
165-
sku_name = optional(string, "standard")
166-
})
167-
}
159+
# variable "key_vault" {
160+
# description = "Configuration for the key vault"
161+
# type = object({
162+
# disk_encryption = optional(bool, true)
163+
# soft_del_ret_days = optional(number, 7)
164+
# purge_prot = optional(bool, false)
165+
# sku_name = optional(string, "standard")
166+
# })
167+
# }
168168

169169
variable "law" {
170170
description = "Configuration of the Log Analytics Workspace"

0 commit comments

Comments
 (0)