Merge pull request #4165 from Azure/skuznets/use-execution-constraint-global

global-pipeline: add an execution constraint

Author: stevekuznetsov

dev-infrastructure/global-pipeline.yaml

@@ -17,9 +17,28 @@ buildStep:
   - ../tooling/grafanactl
   - bundle
 resourceGroups:
-- name: global
+- name: singleton
   resourceGroup: '{{ .global.rg }}'
   subscription: '{{ .global.subscription.key }}'
+  executionConstraints:
+  - clouds:
+    - public
+    environments:
+    - int
+    regions:
+    - uksouth
+  - clouds:
+    - public
+    environments:
+    - stg
+    regions:
+    - uksouth
+  - clouds:
+    - public
+    environments:
+    - prod
+    regions:
+    - eastus2euap
   steps:
   - name: infra
     action: ARM
@@ -33,7 +52,7 @@ resourceGroups:
     deploymentLevel: ResourceGroup
     outputOnly: true
     dependsOn:
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: infra
   - name: global-kv-private-issuer
     action: SetCertificateIssuer
@@ -45,7 +64,7 @@ resourceGroups:
       configRef: ev2.assistedId.applicationId
     vaultBaseUrl:
       input:
-        resourceGroup: global
+        resourceGroup: singleton
         step: output
         name: globalKeyVaultUrl
     issuer:
@@ -60,7 +79,7 @@ resourceGroups:
       configRef: ev2.assistedId.applicationId
     vaultBaseUrl:
       input:
-        resourceGroup: global
+        resourceGroup: singleton
         step: output
         name: genevaActionKeyVaultUrl
     issuer:
@@ -71,9 +90,9 @@ resourceGroups:
     parameters: configurations/geneva-identities.tmpl.bicepparam
     deploymentLevel: ResourceGroup
     dependsOn:
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: global-kv-private-issuer
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: geneva-kv-private-issuer
   - name: housekeeping
     action: Shell
@@ -88,21 +107,21 @@ resourceGroups:
       configRef: global.rg
     shellIdentity:
       input:
-        resourceGroup: global
+        resourceGroup: singleton
         step: output
         name: globalMSIId
     dependsOn:
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: infra
   - name: grafana-dashboards
     action: Shell
     omitFromServiceGroupCompletion: true
     command: ./grafanactl sync dashboards --subscription=${SUBSCRIPTION_ID} --resource-group=${GLOBAL_RESOURCEGROUP} --grafana-name=${GRAFANA_NAME} --config-file=./observability.yaml
     workingDir: ../tooling/grafanactl
     dependsOn:
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: housekeeping
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: output
     dryRun:
       command: ./grafanactl sync dashboards --subscription=${SUBSCRIPTION_ID} --resource-group=${GLOBAL_RESOURCEGROUP} --grafana-name=${GRAFANA_NAME} --config-file=./observability.yaml --dry-run
@@ -113,12 +132,12 @@ resourceGroups:
       configRef: global.rg
     - name: SUBSCRIPTION_ID
       input:
-        resourceGroup: global
+        resourceGroup: singleton
         step: output
         name: subscriptionId
     shellIdentity:
       input:
-        resourceGroup: global
+        resourceGroup: singleton
         step: output
         name: globalMSIId
   # creates DNS delegation for the ARO HCP global SVC zone
@@ -135,7 +154,7 @@ resourceGroups:
     dstsHost:
       configRef: ev2.assistedId.dstsHost
     dependsOn:
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: infra
   # creates DNS delegation for the ARO HCP global CX zone
   - name: cxChildZone
@@ -151,7 +170,7 @@ resourceGroups:
     dstsHost:
       configRef: ev2.assistedId.dstsHost
     dependsOn:
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: infra
   # create global ARO HCP ACRs for OCP and SVC images
   - name: acrs
@@ -160,7 +179,7 @@ resourceGroups:
     parameters: configurations/global-acr.tmpl.bicepparam
     deploymentLevel: ResourceGroup
     dependsOn:
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: infra
   # ingests secrets into the global KV
   - name: decrypt-and-ingest-secrets
@@ -169,10 +188,10 @@ resourceGroups:
     configurationFile: 'data/encryptedsecrets.yaml'
     encryptionKey: 'secretSyncKey'
     dependsOn:
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: infra
     identityFrom:
-      resourceGroup: global
+      resourceGroup: singleton
       step: output
       name: globalMSIId
   # mirror oc-mirror image
@@ -191,13 +210,13 @@ resourceGroups:
     pullSecretName:
       configRef: imageSync.ondemandSync.pullSecretName
     dependsOn:
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: acrs
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: decrypt-and-ingest-secrets
     shellIdentity:
       input:
-        resourceGroup: global
+        resourceGroup: singleton
         step: output
         name: globalMSIId
     automatedRetry:
@@ -212,5 +231,5 @@ resourceGroups:
     parameters: configurations/global-image-sync.tmpl.bicepparam
     deploymentLevel: ResourceGroup
     dependsOn:
-    - resourceGroup: global
+    - resourceGroup: singleton
       step: mirror-oc-mirror-image