Skip to content

Commit 06d6ffb

Browse files
patrickmoore-ncpatrickmoore-nc
authored
Merge pull request #190 from NHSDigital/PPHA-417-hub-bicep-bootstrap
PPHA-417: Hub infrastructure bootstrap bicep code
2 parents c31182a + d4b57a3 commit 06d6ffb

21 files changed

Lines changed: 455 additions & 11 deletions

‎.gitleaksignore‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,15 @@ infrastructure/terraform/resource_group_init/main.bicep:generic-api-key:32
1111
infrastructure/terraform/resource_group_init/main.bicep:generic-api-key:33
1212
infrastructure/terraform/resource_group_init/storage.bicep:generic-api-key:59
1313
infrastructure/terraform/resource_group_init/keyVault.bicep:generic-api-key:10
14+
infrastructure/bootstrap/core.bicep:generic-api-key:10
15+
infrastructure/bootstrap/core.bicep:generic-api-key:11
16+
infrastructure/bootstrap/core.bicep:generic-api-key:12
17+
infrastructure/bootstrap/core.bicep:generic-api-key:13
18+
infrastructure/bootstrap/core.bicep:generic-api-key:14
19+
infrastructure/bootstrap/main.bicep:generic-api-key:29
20+
infrastructure/bootstrap/main.bicep:generic-api-key:30
21+
infrastructure/bootstrap/main.bicep:generic-api-key:31
22+
infrastructure/bootstrap/main.bicep:generic-api-key:32
23+
infrastructure/bootstrap/main.bicep:generic-api-key:33
24+
infrastructure/bootstrap/modules/storage.bicep:generic-api-key:59
25+
infrastructure/bootstrap/modules/keyVault.bicep:generic-api-key:10

infrastructure/terraform/resource_group_init/core.bicep renamed to infrastructure/bootstrap/core.bicep

File renamed without changes.

‎infrastructure/bootstrap/environments/live/hub.bicepparam‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
using '../../hub.bicep'
2+
3+
param hubType = 'live'
4+
param vnetAddressPrefixes = [
5+
'10.21.0.0/16'
6+
]
7+
param devopsSubnetAddressPrefix = '10.21.1.0/24'
8+
param devopsInfrastructureId = ''

‎infrastructure/bootstrap/environments/live/variables.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
AZURE_SUBSCRIPTION="name"
2+
BOOTSTRAP=hub
3+
HUB_TYPE=live

‎infrastructure/bootstrap/environments/nonlive/hub.bicepparam‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
using '../../hub.bicep'
2+
3+
param hubType = 'nonlive'
4+
param vnetAddressPrefixes = [
5+
'10.11.0.0/16'
6+
]
7+
param devopsSubnetAddressPrefix = '10.11.1.0/24'
8+
param devopsInfrastructureId = ''

‎infrastructure/bootstrap/environments/nonlive/variables.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
AZURE_SUBSCRIPTION="Digital Screening DToS - Sandbox"
2+
BOOTSTRAP=hub
3+
HUB_TYPE=nonlive

‎infrastructure/bootstrap/hub.bicep‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
/*
2+
Root Bicep file for deploying Hub subscription bootstrap resources needed for Terraform to continue:
3+
- Private VNet
4+
- Managed DevOps Pool (for VNet-integrated ADO build agents)
5+
- Managed Identity for Terraform
6+
- Blob Storage Account with Container, Private Endpoint, and public access disabled
7+
- Private DNS for Storage Account Private Endpoint
8+
9+
Subscription pre-requisites:
10+
- az provider register --namespace 'Microsoft.DevOpsInfrastructure'
11+
- az provider register --namespace 'Microsoft.DevCenter'
12+
13+
Run once, deployment of the Managed DevOps Pool will fail.
14+
Manually Grant 'Reader' and 'Network Contributor' RBAC roles to the Service Principal 'DevopsInfrastructure' on the VNet resource.
15+
Re-run, it will succeed. This cannot be automated in Bicep, the object ID (which needs to be resolved from the appId) will be considered invalid, even though it's fine using az cli.
16+
*/
17+
18+
targetScope = 'subscription'
19+
20+
param devopsSubnetAddressPrefix string
21+
// param enableSoftDelete bool
22+
param hubType string // live / nonlive
23+
param region string = 'uksouth'
24+
param regionShortName string = 'uks'
25+
param vnetAddressPrefixes array
26+
27+
// var keyVaultName = 'kv-lungcs-${envConfig}-inf'
28+
29+
var devopsSubnetName = 'sn-hub-${hubType}-${regionShortName}-devops'
30+
var devCenterName = 'devc-hub-${hubType}-${regionShortName}'
31+
var devCenterProjectName = 'prj-hub-${hubType}-${regionShortName}'
32+
var poolName = 'private-pool-hub-${hubType}-${regionShortName}'
33+
var resourceGroupName = 'rg-hub-${hubType}-${regionShortName}-bootstrap'
34+
var virtualNetworkName = 'vnet-hub-${hubType}-${regionShortName}'
35+
36+
// var miADOtoAZname = 'mi-${appShortName}-${envConfig}-adotoaz-uks'
37+
// var miGHtoADOname = 'mi-${appShortName}-${envConfig}-ghtoado-uks'
38+
39+
resource bootstrapRG 'Microsoft.Resources/resourceGroups@2025-04-01' = {
40+
name: resourceGroupName
41+
location: region
42+
}
43+
44+
@description('Virtual Network Deployment')
45+
module virtualNetwork 'modules/virtualNetwork.bicep' = {
46+
scope: bootstrapRG
47+
params: {
48+
name: virtualNetworkName
49+
addressPrefixes: vnetAddressPrefixes
50+
}
51+
}
52+
53+
@description('Managed DevOps Pool Deployment')
54+
module managedDevopsPool 'modules/managedDevopsPool.bicep' = {
55+
scope: bootstrapRG
56+
params: {
57+
adoOrg: 'nhse-pps-1'
58+
agentProfileMaxAgentLifetime: '00.04:00:00'
59+
devCenterName: devCenterName
60+
devCenterProjectName: devCenterProjectName
61+
devopsSubnetName: devopsSubnetName
62+
devopsSubnetAddressPrefix: devopsSubnetAddressPrefix
63+
poolName: poolName
64+
virtualNetworkName: virtualNetwork.outputs.name
65+
}
66+
}

infrastructure/terraform/resource_group_init/main.bicep renamed to infrastructure/bootstrap/main.bicep

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ resource managedIdentityRG 'Microsoft.Resources/resourceGroups@2024-11-01' exist
5151
}
5252

5353
// Create the managed identity assumed by Azure devops to connect to Azure
54-
module managedIdentiyADOtoAZ 'managedIdentity.bicep' = {
54+
module managedIdentiyADOtoAZ 'modules/managedIdentity.bicep' = {
5555
scope: managedIdentityRG
5656
params: {
5757
name: miADOtoAZname
@@ -60,7 +60,7 @@ module managedIdentiyADOtoAZ 'managedIdentity.bicep' = {
6060
}
6161

6262
// Create the managed identity assumed by Github actions to trigger Azure devops pipelines
63-
module managedIdentiyGHtoADO 'managedIdentity.bicep' = {
63+
module managedIdentiyGHtoADO 'modules/managedIdentity.bicep' = {
6464
scope: managedIdentityRG
6565
params: {
6666
name: miGHtoADOname
@@ -84,7 +84,7 @@ resource readerAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' =
8484
}
8585

8686
// Create the storage account, blob service and container
87-
module terraformStateStorageAccount 'storage.bicep' = {
87+
module terraformStateStorageAccount 'modules/storage.bicep' = {
8888
scope: storageAccountRG
8989
params: {
9090
storageLocation: region
@@ -96,23 +96,23 @@ module terraformStateStorageAccount 'storage.bicep' = {
9696
}
9797

9898
// Retrieve storage private DNS zone
99-
module storagePrivateDNSZone 'dns.bicep' = {
99+
module storagePrivateDNSZone 'modules/dns.bicep' = {
100100
scope: privateDNSZoneRG
101101
params: {
102102
resourceServiceType: 'storage'
103103
}
104104
}
105105

106106
// Retrieve key vault private DNS zone
107-
module keyVaultPrivateDNSZone 'dns.bicep' = {
107+
module keyVaultPrivateDNSZone 'modules/dns.bicep' = {
108108
scope: privateDNSZoneRG
109109
params: {
110110
resourceServiceType: 'keyVault'
111111
}
112112
}
113113

114114
// Create private endpoint and register DNS
115-
module storageAccountPrivateEndpoint 'privateEndpoint.bicep' = {
115+
module storageAccountPrivateEndpoint 'modules/privateEndpoint.bicep' = {
116116
scope: privateEndpointResourceGroup
117117
params: {
118118
hub: hubMap[envConfig]
@@ -141,7 +141,7 @@ resource infraRG 'Microsoft.Resources/resourceGroups@2024-11-01' = {
141141
}
142142

143143
// Private endpoint for infra key vault
144-
module kvPrivateEndpoint 'privateEndpoint.bicep' = {
144+
module kvPrivateEndpoint 'modules/privateEndpoint.bicep' = {
145145
scope: resourceGroup(infraResourceGroupName)
146146
params: {
147147
hub: hubMap[envConfig]
@@ -154,7 +154,7 @@ module kvPrivateEndpoint 'privateEndpoint.bicep' = {
154154
}
155155

156156
// Use a module to deploy Key Vault into the infra RG
157-
module keyVaultModule 'keyVault.bicep' = {
157+
module keyVaultModule 'modules/keyVault.bicep' = {
158158
name: 'keyVaultDeployment'
159159
scope: resourceGroup(infraResourceGroupName)
160160
params: {

infrastructure/terraform/resource_group_init/dns.bicep renamed to infrastructure/bootstrap/modules/dns.bicep

File renamed without changes.

infrastructure/terraform/resource_group_init/keyVault.bicep renamed to infrastructure/bootstrap/modules/keyVault.bicep

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
param enableSoftDelete bool
32
param keyVaultName string
43
param miPrincipalId string

0 commit comments

Comments
 (0)