Skip to content

Commit c6f195a

Browse files
mrlockstarmrlockstar
committed
terraform stuff
1 parent a86dad8 commit c6f195a

15 files changed

Lines changed: 476 additions & 208 deletions

File tree

‎.azuredevops/pipelines/hub-infrastructure-dev.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ stages:
3131
displayName: Terraform Plan
3232
condition: eq(variables['Build.Reason'], 'Manual')
3333
variables:
34-
tfVarsFile: environments/$(ENVIRONMENT)/variables.tfvars
34+
tfVarsFile: ../../environments/$(ENVIRONMENT)/variables.tfvars
3535
jobs:
3636
- job: init_and_plan
3737
displayName: Init, plan, store artifact

‎infrastructure/bootstrap/hub.bicep‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,6 @@ param vnetAddressPrefixes array
2828
param enableSoftDelete bool
2929

3030

31-
// var keyVaultName = 'kv-lungcs-${envConfig}-inf'
32-
3331
// removed when generalised
3432
var appShortName = 'lungcs'
3533
//var appShortName = 'lungal'
@@ -51,6 +49,7 @@ var storageAccountName = 'sa${appShortName}${regionShortName}state'
5149
var miADOtoAZname = 'mi-${appShortName}-${hubType}-adotoaz-${regionShortName}'
5250
var miGHtoADOname = 'mi-${appShortName}-${hubType}-ghtoado-${regionShortName}'
5351

52+
5453
// See: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
5554
var roleID = {
5655
CDNContributor: 'ec156ff8-a8d1-4d15-830c-5b80698ca432'

‎infrastructure/environments/nonlive-hub/variables.sh‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ ENVIRONMENT=nonlive-hub
22
ENV_CONFIG=nonlive-hub
33
AZURE_SUBSCRIPTION="Lung Cancer Risk Check - Non-live hub"
44
HUB_SUBSCRIPTION="Lung Cancer Risk Check - Non-live hub"
5-
STORAGE_ACCOUNT_RG=rg-tfstate-nonlive-hub-uks
65
TERRAFORM_MODULES_REF=main
76
# ENABLE_SOFT_DELETE=false
87
# DOCKER_IMAGE=ghcr.io/nhsdigital/lung_cancer_screening

‎infrastructure/environments/nonlive-hub/variables.tfvars‎

Lines changed: 82 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,98 @@
1+
application = "hub"
2+
environment = "nonlive-hub"
3+
env_type = "nonlive"
4+
15
features = {
2-
front_door = false
3-
hub_and_spoke = false
4-
private_networking = false
6+
private_endpoints_enabled = true
7+
private_service_connection_is_manual = false
8+
public_network_access_enabled = true
9+
log_analytics_data_export_rule_enabled = false
10+
}
11+
12+
virtual_desktop_group_active = "green"
13+
14+
projects = {
15+
lung-cancer-screening = {
16+
full_name = "Lung Cancer Screening"
17+
short_name = "lungcs"
18+
tags = {
19+
Project = "Lung Cancer Screening"
20+
}
21+
frontdoor_profile = {
22+
sku_name = "Premium_AzureFrontDoor"
23+
}
24+
}
25+
}
26+
27+
diagnostic_settings = {
28+
metric_enabled = true
29+
}
30+
31+
private_dns_zones = {
32+
is_app_services_enabled = true
33+
is_azure_sql_private_dns_zone_enabled = true
34+
is_postgres_sql_private_dns_zone_enabled = true
35+
is_storage_private_dns_zone_enabled = true
36+
is_acr_private_dns_zone_enabled = false
37+
is_app_insights_private_dns_zone_enabled = true
38+
is_apim_private_dns_zone_enabled = false
39+
is_key_vault_private_dns_zone_enabled = true
40+
is_event_hub_private_dns_zone_enabled = false
41+
is_event_grid_enabled_dns_zone_enabled = false
42+
is_container_apps_enabled_dns_zone_enabled = true
543
}
6-
fetch_secrets_from_app_key_vault = true
7-
github_mi_name = "mi-lungcs-hub-ghtoaz-uks"
8-
# key_vault_secrets_officer_groups = ["Azure-Lung-Cancer-Screening---Dev-Owner"]
9-
postgres_backup_retention_days = 7
10-
postgres_geo_redundant_backup_enabled = false
11-
protect_keyvault = false
12-
vnet_address_space = "10.65.0.0/16"
1344

1445

46+
avd_vm_count = 1
47+
avd_maximum_sessions_allowed = 1 # per session host
48+
avd_vm_size = "Standard_D4as_v5"
49+
avd_users_group_name = "DToS-hub-dev-uks-hub-virtual-desktop-User-Login"
50+
avd_admins_group_name = "DToS-hub-dev-uks-hub-virtual-desktop-User-ADMIN-Login"
51+
52+
avd_source_image_from_gallery = {
53+
image_name = "gi_wvd"
54+
gallery_name = "rg_hub_dev_uks_compute_gallery"
55+
gallery_rg_name = "rg-hub-dev-uks-hub-virtual-desktop"
56+
}
57+
58+
law = {
59+
export_enabled = false
60+
law_sku = "PerGB2018"
61+
retention_days = 30
62+
}
63+
1564
regions = {
1665
uksouth = {
1766
address_space = "10.65.0.0/16"
1867
is_primary_region = true
1968
subnets = {
20-
acr = {
69+
pep = {
70+
cidr_newbits = 8
71+
cidr_offset = 2
72+
}
73+
virtual-desktop = {
2174
cidr_newbits = 11
22-
cidr_offset = 8
75+
cidr_offset = 32
2376
}
24-
api-mgmt = {
25-
cidr_newbits = 8
26-
cidr_offset = 6
77+
dns-resolver-in = {
78+
cidr_newbits = 12
79+
cidr_offset = 112
80+
delegation_name = "Microsoft.Network/dnsResolvers"
81+
service_delegation_name = "Microsoft.Network/dnsResolvers"
82+
service_delegation_actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
2783
}
28-
app-gateway = {
29-
cidr_newbits = 8
30-
cidr_offset = 5
84+
firewall = {
85+
name = "AzureFirewallSubnet"
86+
cidr_newbits = 10
87+
cidr_offset = 192
88+
create_nsg = false
3189
}
90+
}
91+
}
92+
ukwest = {
93+
address_space = "10.65.0.0/16"
94+
is_primary_region = true
95+
subnets = {
3296
pep = {
3397
cidr_newbits = 8
3498
cidr_offset = 2
@@ -37,13 +101,6 @@ regions = {
37101
cidr_newbits = 11
38102
cidr_offset = 32
39103
}
40-
devops = {
41-
cidr_newbits = 8
42-
cidr_offset = 9
43-
delegation_name = "Microsoft.DevOpsInfrastructure/pools" # az provider register --namespace 'Microsoft.DevOpsInfrastructure'
44-
service_delegation_name = "Microsoft.DevOpsInfrastructure/pools"
45-
service_delegation_actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
46-
}
47104
dns-resolver-in = {
48105
cidr_newbits = 12
49106
cidr_offset = 112

‎infrastructure/terraform/hub/azure_monitor_private_link_scope.tf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# This is a global resource, but it can have regional private endpoints
2+
resource "azurerm_monitor_private_link_scope" "ampls" {
3+
name = module.config[local.primary_region].names.private-link-scope
4+
resource_group_name = azurerm_resource_group.rg_private_endpoints[local.primary_region].name
5+
6+
ingestion_access_mode = "PrivateOnly"
7+
query_access_mode = "Open"
8+
9+
tags = var.tags
10+
}
11+
12+
module "private_endpoint_ampls" {
13+
for_each = var.features.private_endpoints_enabled ? var.regions : {}
14+
15+
source = "../../../../dtos-devops-templates/infrastructure/modules/private-endpoint"
16+
17+
name = module.config[each.key].names.private-link-scope-private-endpoint
18+
resource_group_name = azurerm_resource_group.rg_private_endpoints[each.key].name
19+
location = each.key
20+
subnet_id = module.subnets_hub["${module.config[each.key].names.subnet}-pep"].id
21+
22+
private_dns_zone_group = {
23+
name = "${module.config[each.key].names.private-link-scope-private-endpoint}-zone-group"
24+
private_dns_zone_ids = [
25+
module.private_dns_zones["${each.key}-app_insights"].id,
26+
module.private_dns_zones["${each.key}-automation"].id,
27+
module.private_dns_zones["${each.key}-operations_data_store"].id,
28+
module.private_dns_zones["${each.key}-operations_management_suite"].id,
29+
module.private_dns_zones["${each.key}-storage_blob"].id
30+
]
31+
}
32+
33+
private_service_connection = {
34+
name = "${module.config[each.key].names.private-link-scope-private-endpoint}-connection"
35+
private_connection_resource_id = azurerm_monitor_private_link_scope.ampls.id
36+
subresource_names = ["azuremonitor"]
37+
is_manual_connection = var.features.private_service_connection_is_manual
38+
}
39+
40+
tags = var.tags
41+
}

‎infrastructure/terraform/hub/baseline.tf‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
resource "azurerm_resource_group" "rg_base" {
2+
for_each = var.regions
3+
4+
name = module.config[each.key].names.resource-group
5+
location = each.key
6+
}
7+
8+
resource "azurerm_resource_group" "rg_project" {
9+
# create a resource group for every project for every region:
10+
for_each = local.projects_map
11+
12+
name = "${module.config[each.value.region_key].names.resource-group}-${each.value.short_name}"
13+
location = each.value.region_key
14+
tags = length(each.value.tags) > 0 ? each.value.tags : var.tags
15+
}
16+
17+
locals {
18+
19+
# Create a flat list of projects with region keys for consumption in a for_each meta argument
20+
projects_flatlist = flatten([
21+
for region_key, region_val in var.regions : [
22+
for project_key, project_val in var.projects : {
23+
key = "${project_key}-${region_key}"
24+
region_key = region_key
25+
is_primary_region = region_val.is_primary_region
26+
project_key = project_key
27+
full_name = project_val.full_name
28+
short_name = project_val.short_name
29+
acr = project_val.acr
30+
tags = project_val.tags
31+
}
32+
]
33+
])
34+
35+
# Project the above list into a map with unique keys for consumption in a for_each meta argument
36+
projects_map = { for project in local.projects_flatlist : project.key => project }
37+
}

‎infrastructure/terraform/hub/data.tf‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
data "azurerm_client_config" "current" {}
2+
3+
data "azuread_group" "avd_users" {
4+
display_name = var.avd_users_group_name
5+
}
6+
7+
data "azuread_group" "avd_admins" {
8+
display_name = var.avd_admins_group_name
9+
}
10+
11+
data "azuread_group" "avd_platform_users" {
12+
display_name = "DToS-platform-team-Dev"
13+
}
14+
15+
# This client id is the same for all Azure customers - it is not a secret.
16+
# https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service_certificate
17+
data "azuread_service_principal" "MicrosoftAzureAppService" {
18+
client_id = "abfa0a7c-a6b6-4736-8310-5855508787cd"
19+
}
20+
21+
data "azuread_service_principal" "MicrosoftAzureFrontDoorCdn" {
22+
client_id = "205478c0-bd83-4e1b-a9d6-db63a3e1e1c8"
23+
}
24+
25+
# data "azurerm_key_vault_secret" "object-id" {
26+
# for_each = var.regions
27+
# name = "dtos-apim-object-id"
28+
# key_vault_id = module.key_vault[each.key].key_vault_id
29+
30+
# depends_on = [azurerm_key_vault_access_policy.terraform-mi]
31+
# }
32+
33+
# data "azurerm_key_vault_secret" "secret" {
34+
# for_each = var.regions
35+
# name = "dtos-apim-secret"
36+
# key_vault_id = module.key_vault[each.key].key_vault_id
37+
38+
# depends_on = [azurerm_key_vault_access_policy.terraform-mi]
39+
# }

‎infrastructure/terraform/hub/dns_private.tf‎

Lines changed: 30 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5,37 +5,43 @@ resource "azurerm_resource_group" "private_dns_rg" {
55
location = each.key
66
}
77

8+
data "azurerm_virtual_network" "this" {
9+
name = var.vnet_name
10+
resource_group_name = var.vnet_resource_group
11+
}
12+
13+
814
/*--------------------------------------------------------------------------------------------------
915
Private DNS Zone Resolver
1016
--------------------------------------------------------------------------------------------------*/
1117

12-
# module "private_dns_resolver" {
13-
# for_each = var.regions
18+
module "private_dns_resolver" {
19+
for_each = var.regions
1420

15-
# source = "../../../../dtos-devops-templates/infrastructure/modules/private-dns-zone-resolver"
21+
source = "../../../../dtos-devops-templates/infrastructure/modules/private-dns-zone-resolver"
1622

17-
# name = "${module.config[each.key].names.resource-application}-private-dns-zone-resolver"
18-
# resource_group_name = azurerm_resource_group.private_dns_rg[each.key].name
19-
# location = each.key
20-
# vnet_id = module.vnets_hub[each.key].vnet.id
23+
name = "${module.config[each.key].names.resource-application}-private-dns-zone-resolver"
24+
resource_group_name = azurerm_resource_group.private_dns_rg[each.key].name
25+
location = each.key
26+
vnet_id = data.azurerm_virtual_network.this.id
2127

22-
# inbound_endpoint_config = {
23-
# name = "private-dns-resolver-inbound-endpoint"
24-
# private_ip_allocation_method = "Dynamic"
25-
# subnet_id = module.subnets_hub["${module.config[each.key].names.subnet}-dns-resolver-in"].id
26-
# }
28+
inbound_endpoint_config = {
29+
name = "private-dns-resolver-inbound-endpoint"
30+
private_ip_allocation_method = "Dynamic"
31+
subnet_id = module.subnets_hub["${module.config[each.key].names.subnet}-dns-resolver-in"].id
32+
}
2733

28-
# tags = var.tags
29-
# }
34+
tags = var.tags
35+
}
3036

3137
/*--------------------------------------------------------------------------------------------------
3238
Private DNS zones
3339
--------------------------------------------------------------------------------------------------*/
3440

3541
locals {
3642
private_dns_zones = {
37-
national_screening = var.dns_zone_name_private.nationalscreening
38-
screening = var.dns_zone_name_private.screening
43+
# national_screening = var.dns_zone_name_private.nationalscreening
44+
# screening = var.dns_zone_name_private.screening
3945
container_registry = "privatelink.azurecr.io"
4046
app_insights = var.private_dns_zones.is_app_insights_private_dns_zone_enabled ? "privatelink.monitor.azure.com" : null
4147
automation = var.private_dns_zones.is_app_insights_private_dns_zone_enabled ? "privatelink.agentsvc.azure-automation.net" : null
@@ -66,17 +72,17 @@ locals {
6672
private_dns_zones_map = { for obj in local.private_dns_zones_obj_list : "${obj.region}-${obj.description}" => obj }
6773
}
6874

69-
# module "private_dns_zones" {
70-
# for_each = local.private_dns_zones_map
75+
module "private_dns_zones" {
76+
for_each = local.private_dns_zones_map
7177

72-
# source = "../../../../dtos-devops-templates/infrastructure/modules/private-dns-zone"
78+
source = "../../../../dtos-devops-templates/infrastructure/modules/private-dns-zone"
7379

74-
# name = each.value.name
75-
# resource_group_name = azurerm_resource_group.private_dns_rg[each.value.region].name
76-
# vnet_id = module.vnets_hub[each.value.region].vnet.id
80+
name = each.value.name
81+
resource_group_name = azurerm_resource_group.private_dns_rg[each.value.region].name
82+
vnet_id = data.azurerm_virtual_network.this.id
7783

78-
# tags = var.tags
79-
# }
84+
tags = var.tags
85+
}
8086

8187
/*--------------------------------------------------------------------------------------------------
8288
Private DNS A Records for APIM and Application Gateway

0 commit comments

Comments
 (0)