Skip to content

Commit 0f47d25

Browse files
v-ccolinv-ccolin
authored
Merge pull request #207149 from KimForss/main
DevOps Web App updates
2 parents 33e5ac5 + 52349e2 commit 0f47d25

File tree

8 files changed

+426
-73
lines changed

8 files changed

+426
-73
lines changed

‎articles/virtual-machines/workloads/sap/automation-configure-control-plane.md

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,14 @@ The table below contains the networking parameters.
8888
> | `management_firewall_subnet_address_prefix` | The address range for the subnet | Mandatory | For green field deployments. |
8989
> | | | | |
9090
> | `management_bastion_subnet_arm_id` | The Azure resource identifier for the Bastion subnet | Mandatory | For brown field deployments. |
91-
> | `management_bastion_subnet_address_prefix` | The address range for the subnet | Mandatory | For green field deployments. |
91+
> | `management_bastion_subnet_address_prefix` | The address range for the subnet | Mandatory | For green field deployments. |
92+
> | | | | |
93+
> | `webapp_subnet_arm_id` | The Azure resource identifier for the web app subnet | Mandatory | For brown field deployments using the web app |
94+
> | `webapp_subnet_address_prefix` | The address range for the subnet | Mandatory | For green field deployments using the web app |
95+
96+
> [!NOTE]
97+
> When using an existing subnet for the web app, the subnet must be empty, in the same region as the resource group being deployed, and delegated to Microsoft.Web/serverFarms
98+
9299

93100
### Deployer Virtual Machine Parameters
94101

‎articles/virtual-machines/workloads/sap/automation-configure-devops.md

Lines changed: 112 additions & 16 deletions
Large diffs are not rendered by default.

‎articles/virtual-machines/workloads/sap/automation-configure-webapp.md

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
---
2+
title: Configure a Deployer UX Web Application for SAP Deployment Automation Framework
3+
description: Configure a web app as a part of the control plane to help creating and deploying SAP workload zones and systems on Azure.
4+
author: wsheehan
5+
ms.author: wsheehan
6+
ms.reviewer: wsheehan
7+
ms.date: 06/21/2022
8+
ms.topic: conceptual
9+
ms.service: virtual-machines-sap
10+
---
11+
12+
# Configure the Control Plane UX Web Application
13+
14+
As a part of the SAP automation framework control plane, you can optionally create an interactive web application that will assist you in creating and deploying SAP workload zones and systems.
15+
16+
:::image type="content" source="./media/automation-deployment-framework/webapp-front-page.png" alt-text="Web app front page":::
17+
18+
## Create an app registration
19+
20+
If you would like to use the web app, you must first create an app registration for authentication purposes. Open the Azure Cloud Shell and execute the following commands:
21+
22+
# [Linux](#tab/linux)
23+
Replace MGMT with your environment as necessary.
24+
```bash
25+
echo '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","type":"Scope"}]}]' >> manifest.json
26+
27+
TF_VAR_app_registration_app_id=$(az ad app create \
28+
--display-name MGMT-webapp-registration \
29+
--enable-id-token-issuance true \
30+
--sign-in-audience AzureADMyOrg \
31+
--required-resource-access @manifest.json \
32+
--query "appId" | tr -d '"')
33+
34+
TF_VAR_webapp_client_secret=$(az ad app credential reset \
35+
--id $TF_VAR_app_registration_app_id --append \
36+
--query "password" | tr -d '"')
37+
38+
rm manifest.json
39+
```
40+
# [Windows](#tab/windows)
41+
Replace MGMT with your environment as necessary.
42+
```powershell
43+
Add-Content -Path manifest.json -Value '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","type":"Scope"}]}]'
44+
45+
$TF_VAR_app_registration_app_id=(az ad app create `
46+
--display-name $region_code-webapp-registration `
47+
--enable-id-token-issuance true `
48+
--sign-in-audience AzureADMyOrg `
49+
--required-resource-accesses ./manifest.json `
50+
--query "appId").Replace('"',"")
51+
52+
$TF_VAR_webapp_client_secret=(az ad app credential reset `
53+
--id $TF_VAR_app_registration_app_id --append `
54+
--query "password").Replace('"',"")
55+
56+
rm ./manifest.json
57+
```
58+
---
59+
60+
## Deploy via Azure DevOps (pipelines)
61+
62+
For full instructions on setting up the web app using Azure DevOps, see [Use SAP Deployment Automation Framework from Azure DevOps Services](automation-configure-devops.md)
63+
64+
### Summary of steps required to set up the web app before deploying the control plane:
65+
1. Add the web app deployment pipeline (deploy/pipelines/21-deploy-web-app.yaml).
66+
2. Add the variables TF_VAR_app_registration_app_id and TF_VAR_webapp_client_secret to your environment specific variable group before deployment.
67+
3. Assign the administrator role to the build service using the Security tab in your environment specific variable group.
68+
4. Check the box next to "deploy the web app infrastructure" when running the deploy control plane pipeline.
69+
70+
### Summary of steps required to access the web app after deploying the control plane:
71+
1. Update the app registration reply URLs.
72+
2. Assign the reader role with the subscription scope to the app service system assigned managed identity.
73+
3. Run the web app deployment pipeline.
74+
4. (Optionally) add an additional access policy to the app service.
75+
76+
## Deploy via Azure CLI (Cloud Shell)
77+
78+
For full instructions on setting up the web app using the Azure CLI, see [Deploy the control plane](automation-deploy-control-plane.md)
79+
80+
### Summary of steps required to set up the web app before deploying the control plane:
81+
1. Export the environment variables TF_VAR_app_registration_app_id, TF_VAR_webapp_client_secret, and TF_VAR_use_webapp="true".
82+
83+
### Summary of steps required to access the web app after deploying the control plane:
84+
1. Update the app registration reply URLs.
85+
2. Assign the reader role with the subscription scope to the app service system assigned managed identity.
86+
3. Generate a zip file of the web app code.
87+
4. Deploy the software to the app service.
88+
5. Configure the application settings.
89+
6. (Optionally) add an additional access policy to the app service.
90+
91+
92+
## Using the web app
93+
94+
The web app allows you to create SAP workload zone objects and system infrastructure objects. These are essentially another representation of the Terraform configuration file.
95+
If deploying using Azure Pipelines, you have ability to deploy these workload zones and system infrastructures right from the web app.
96+
If deploying using the Azure CLI, you can download the parameter file for any landscape or system object you create, and use that in your command line deployments.
97+
98+
### Creating a landscape or system object from scratch
99+
1. Navigate to the "Workload zones" or "Systems" tab at the top of the website.
100+
2. Click "Create New" in the bottom left corner.
101+
3. Fill out the required parameters in the "Basic" and "Advanced" tabs, and any additional parameters you desire.
102+
4. Certain parameters will be dropdowns populated with existing Azure resources.
103+
* If no results are shown for a dropdown, you probably need to specify another dropdown before you can see any options. Or, see step 2 above regarding the system assigned managed identity.
104+
- The subscription parameter must be specified before any other dropdown functionality is enabled
105+
- The network_arm_id parameter must be specified before any subnet dropdown functionality is enabled
106+
5. Select submit in the bottom left hand corner
107+
108+
### Creating a workload zone or system object from a file
109+
1. Navigate to the "File" tab at the top of the website.
110+
2. Your options are
111+
* Create a new file from scratch there in browser.
112+
* Import an existing.tfvars file, and (optionally) edit it before saving.
113+
* Use an existing template, and (optionally) edit it before saving.
114+
3. Make sure your file conforms to the correct naming conventions.
115+
4. Next to the file you would like to convert to a workload zone or system object, click "Convert".
116+
5. The workload zone or system object will appear in its respective tab.
117+
118+
### Deploying a workload zone or system object (Azure DevOps Pipelines deployment)
119+
1. Navigate to the Workload zones or Systems tab.
120+
2. Next to the workload zone or system you would like to deploy, click "Deploy".
121+
* If you would like to deploy a file, first convert it to a workload zone or system object.
122+
4. Specify the necessary parameters, and confirm it's the correct object.
123+
5. Click deploy.
124+
6. The web app will automatically generate a '.tfvars' file from the object, update your Azure DevOps repository, and kick off the workload zone or system (infrastructure) pipeline. You can monitor the deployment in the Azure DevOps Portal.

‎articles/virtual-machines/workloads/sap/automation-deploy-control-plane.md

Lines changed: 131 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,13 +40,71 @@ Optionally assign the following permissions to the Service Principal:
4040
az role assignment create --assignee <appId> --role "User Access Administrator" --scope /subscriptions/<subscriptionID>/resourceGroups/<resourceGroupName>
4141
```
4242

43+
44+
## Prepare the webapp
45+
This step is optional. If you would like a browser-based UX to assist in the configuration of SAP workload zones and systems, run the following commands before deploying the control plane.
46+
47+
# [Linux](#tab/linux)
48+
49+
```bash
50+
echo '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","type":"Scope"}]}]' >> manifest.json
51+
52+
region_code=WEEU
53+
54+
export TF_VAR_app_registration_app_id=$(az ad app create \
55+
--display-name ${region_code}-webapp-registration \
56+
--enable-id-token-issuance true \
57+
--sign-in-audience AzureADMyOrg \
58+
--required-resource-access @manifest.json \
59+
--query "appId" | tr -d '"')
60+
61+
export TF_VAR_webapp_client_secret=$(az ad app credential reset \
62+
--id $TF_VAR_app_registration_app_id --append \
63+
--query "password" | tr -d '"')
64+
65+
export TF_VAR_use_webapp=true
66+
rm manifest.json
67+
68+
```
69+
# [Windows](#tab/windows)
70+
71+
```powershell
72+
73+
Add-Content -Path manifest.json -Value '[{"resourceAppId":"00000003-0000-0000-c000-000000000000","resourceAccess":[{"id":"e1fe6dd8-ba31-4d61-89e7-88639da4683d","type":"Scope"}]}]'
74+
75+
$region_code="WEEU"
76+
77+
$env:TF_VAR_app_registration_app_id = (az ad app create `
78+
--display-name $region_code-webapp-registration `
79+
--enable-id-token-issuance true `
80+
--sign-in-audience AzureADMyOrg `
81+
--required-resource-accesses ./manifest.json `
82+
--query "appId").Replace('"',"")
83+
84+
$env:TF_VAR_webapp_client_secret=(az ad app credential reset `
85+
--id $env:TF_VAR_app_registration_app_id --append `
86+
--query "password").Replace('"',"")
87+
88+
$env:TF_VAR_use_webapp="true"
89+
90+
del manifest.json
91+
92+
```
93+
94+
# [Azure DevOps](#tab/devops)
95+
96+
It is currently not possible to perform this action from Azure DevOps.
97+
98+
---
99+
100+
43101
## Deploy the control plane
44102

45103
The sample Deployer configuration file `MGMT-WEEU-DEP00-INFRASTRUCTURE.tfvars` is located in the `~/Azure_SAP_Automated_Deployment/WORKSPACES/DEPLOYER/MGMT-WEEU-DEP00-INFRASTRUCTURE` folder.
46104

47105
The sample SAP Library configuration file `MGMT-WEEU-SAP_LIBRARY.tfvars` is located in the `~/Azure_SAP_Automated_Deployment/WORKSPACES/LIBRARY/MGMT-WEEU-SAP_LIBRARY` folder.
48106

49-
Running the command below will create the Deployer, the SAP Library and add the Service Principal details to the deployment key vault.
107+
Running the command below will create the Deployer, the SAP Library and add the Service Principal details to the deployment key vault. If you followed the web app setup in the step above, this command will also create the infrastructure to host the application.
50108

51109
# [Linux](#tab/linux)
52110

@@ -85,7 +143,7 @@ cd ~/Azure_SAP_Automated_Deployment/WORKSPACES
85143
--spn_secret "${spn_secret}" \
86144
--tenant_id "${tenant_id}" \
87145
--auto-approve
88-
```
146+
```
89147

90148
# [Windows](#tab/windows)
91149

@@ -100,7 +158,6 @@ xcopy /E sap-automation\samples\WORKSPACES WORKSPACES
100158
```
101159

102160

103-
104161
```powershell
105162
106163
@@ -115,14 +172,13 @@ New-SAPAutomationRegion -DeployerParameterfile .\DEPLOYER\MGMT-WEEU-DEP00-INFRAS
115172
```
116173

117174

118-
119175
> [!NOTE]
120176
> Be sure to replace the sample value `<subscriptionID>` with your subscription ID.
121177
> Replace the `<appID>`, `<password>`, `<tenant>` values with the output values of the SPN creation
122178
123179
# [Azure DevOps](#tab/devops)
124180

125-
Open (https://dev.azure.com) and and go to your Azure DevOps project.
181+
Open (https://dev.azure.com) and go to your Azure DevOps project.
126182

127183
> [!NOTE]
128184
> Ensure that the 'Deployment_Configuration_Path' variable in the 'SDAF-General' variable group is set to the folder that contains your configuration files, for this example you can use 'samples/WORKSPACES'.
@@ -224,9 +280,77 @@ cd sap-automation/deploy/scripts
224280

225281
The script will install Terraform and Ansible and configure the deployer.
226282

283+
284+
## Deploy the web app software
285+
286+
If you would like to use the web app, follow the steps below. If not, ignore this section.
287+
288+
The web app resource can be found in the deployer resource group. In the Azure portal, select resource groups in your subscription. The deployer resource group will be named something like MGMT-[region]-DEP00-INFRASTRUCTURE. Inside the deployer resource group, locate the app service, named something like mgmt-[region]-dep00-sapdeployment123. Open the app service and copy the URL listed. It should be in the format of https://mgmt-[region]-dep00-sapdeployment123.azurewebsites.net. This will be the value for webapp_url below.
289+
290+
The following commands will configure the application urls, generate a zip file of the web app code, deploy the software to the app service, and configure the application settings.
291+
292+
# [Linux](#tab/linux)
293+
294+
```bash
295+
296+
webapp_url=<webapp_url>
297+
az ad app update \
298+
--id $TF_VAR_app_registration_app_id \
299+
--web-home-page-url ${webapp_url} \
300+
--web-redirect-uris ${webapp_url}/ ${webapp_url}/.auth/login/aad/callback
301+
302+
```
303+
# [Windows](#tab/windows)
304+
305+
```powershell
306+
307+
$webapp_url="<webapp_url>"
308+
az ad app update `
309+
--id $TF_VAR_app_registration_app_id `
310+
--web-home-page-url $webapp_url `
311+
--web-redirect-uris $webapp_url/ $webapp_url/.auth/login/aad/callback
312+
313+
```
314+
# [Azure DevOps](#tab/devops)
315+
316+
It is currently not possible to perform this action from Azure DevOps.
317+
---
318+
319+
> [!TIP]
320+
> Perform the following task from the deployer.
321+
```bash
322+
323+
cd ~/Azure_SAP_Automated_Deployment/sap-automation/Webapp/AutomationForm
324+
325+
dotnet build
326+
dotnet publish --configuration Release
327+
328+
cd bin/Release/netcoreapp3.1/publish/
329+
330+
sudo apt install zip
331+
zip -r deploymentfile.zip .
332+
333+
az webapp deploy --resource-group <group-name> --name <app-name> --src-path deploymentfile.zip
334+
335+
```
336+
```bash
337+
338+
az webapp config appsettings set -g <group-name> -n <app-name> --settings \
339+
IS_PIPELINE_DEPLOYMENT=false
340+
341+
```
342+
343+
344+
## Accessing the web app
345+
346+
By default there will be no inbound public internet access to the web app apart from the deployer virtual network. To allow additional access to the web app, navigate to the Azure portal. In the deployer resource group, find the web app. Then under settings on the left hand side, click on networking. From here, click Access restriction. Add any allow or deny rules you would like. For more information on configuring access restrictions, see [Set up Azure App Service access restrictions](/azure/app-service/app-service-ip-restrictions).
347+
348+
You will also need to grant reader permissions to the app service system-assigned managed identity. Navigate to the app service resource. On the left hand side, click "Identity". In the "system assigned" tab, click on "Azure role assignments" > "Add role assignment". Select "subscription" as the scope, and "reader" as the role. Then click save. Without this step, the web app dropdown functionality will not work.
349+
350+
You can log in and visit the web app by following the URL from earlier or clicking browse inside the app service resource. With the web app, you are able to configure SAP workload zones and system infrastructure. Click download to obtain a parameter file of the workload zone or system you specified, for use in the later deployment steps.
351+
352+
227353
## Next step
228354

229355
> [!div class="nextstepaction"]
230356
> [Configure SAP Workload Zone](automation-configure-workload-zone.md)
231-
232-

‎articles/virtual-machines/workloads/sap/media/automation-deployment-framework/control-plane-sap-infrastructure.png

-42.4 KB
Loading

‎articles/virtual-machines/workloads/sap/media/automation-deployment-framework/control-plane.png

43.8 KB
Loading

‎articles/virtual-machines/workloads/sap/media/automation-deployment-framework/webapp-front-page.png

77.5 KB
Loading

0 commit comments

Comments
 (0)