Skip to content

Commit 90d5280

Browse files
SamAinsworth-NHSSamAinsworth-NHS
authored
Merge branch 'main' into DTOSS-7817-SonarCloud-Coverage-Refinements
2 parents 233674e + b86b28e commit 90d5280

File tree

11 files changed

+522
-55
lines changed

11 files changed

+522
-55
lines changed

‎.azuredevops/pipelines/cd-infrastructure-dev-core.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ resources:
1313
- repository: dtos-devops-templates
1414
type: github
1515
name: NHSDigital/dtos-devops-templates
16-
ref: c00889236a258a52a2f3131272427ce81d4da951
16+
ref: 63363f075e3cd89a35d79325a25c7f7b3d2ccff6
1717
endpoint: NHSDigital
1818

1919
variables:

‎infrastructure/tf-audit/outputs.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
output "application_insights" {
32
value = {
43
name = module.app_insights_audit[local.primary_region].name

‎infrastructure/tf-core/app_service_plan.tf‎

Lines changed: 48 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,62 +1,67 @@
11
locals {
2-
# Create a flat list of projects with region keys for consumption in a for_each meta argument
3-
app_service_plans_flatlist = flatten([
4-
for region_key, region_val in var.regions : [
5-
for asp_key, asp_val in var.app_service_plan.instances : {
6-
key = "${asp_key}-${region_key}"
7-
asp_key = asp_key
8-
asp_val = asp_val
9-
region_key = region_key
10-
}
2+
# There are multiple App Service Plans and possibly multiple regions.
3+
# We cannot nest for loops inside a map, so first iterate all permutations of both as a list of objects...
4+
app_service_object_list = flatten([
5+
for region in keys(var.regions) : [
6+
for app_service_plan, config in var.app_service_plan.instances : merge(
7+
{
8+
region = region # 1st iterator
9+
app_service_plan = app_service_plan # 2nd iterator
10+
},
11+
config # the rest of the key/value pairs for a specific app_service_plan
12+
)
1113
]
1214
])
1315

14-
# Project the above list into a map with unique keys for consumption in a for_each meta argument
15-
app_service_plans_map = { for asp in local.app_service_plans_flatlist : asp.key => asp }
16+
# ...then project the list of objects into a map with unique keys (combining the iterators), for consumption by a for_each meta argument
17+
app_service_plans_map = {
18+
for object in local.app_service_object_list : "${object.app_service_plan}-${object.region}" => object
19+
}
1620
}
1721

1822
module "app-service-plan" {
1923
for_each = local.app_service_plans_map
2024

2125
source = "../../../dtos-devops-templates/infrastructure/modules/app-service-plan"
2226

23-
name = "${module.regions_config[each.value.region_key].names.app-service-plan}-${lower(each.value.asp_key)}"
24-
resource_group_name = azurerm_resource_group.core[each.value.region_key].name
25-
location = each.value.region_key
27+
name = "${module.regions_config[each.value.region].names.app-service-plan}-${lower(each.value.app_service_plan)}"
28+
resource_group_name = azurerm_resource_group.core[each.value.region].name
29+
location = each.value.region
2630

2731
log_analytics_workspace_id = data.terraform_remote_state.audit.outputs.log_analytics_workspace_id[local.primary_region]
2832
monitor_diagnostic_setting_appserviceplan_metrics = local.monitor_diagnostic_setting_appserviceplan_metrics
29-
30-
os_type = var.app_service_plan.os_type
31-
sku_name = var.app_service_plan.sku_name
32-
33-
vnet_integration_subnet_id = module.subnets["${module.regions_config[each.value.region_key].names.subnet}-apps"].id
33+
os_type = lookup(each.value, "os_type", var.app_service_plan.os_type)
34+
sku_name = lookup(each.value, "sku_name", var.app_service_plan.sku_name)
35+
vnet_integration_subnet_id = module.subnets["${module.regions_config[each.value.region].names.subnet}-apps"].id
36+
wildcard_ssl_cert_name = each.value.wildcard_ssl_cert_key
37+
wildcard_ssl_cert_pfx_blob_key_vault_secret_name = each.value.wildcard_ssl_cert_key != null ? data.terraform_remote_state.hub.outputs.key_vault_certificates["${each.value.wildcard_ssl_cert_key}-${each.value.region}"].pfx_blob_secret_name : null
38+
wildcard_ssl_cert_key_vault_id = each.value.wildcard_ssl_cert_key != null ? data.terraform_remote_state.hub.outputs.key_vault["${each.value.region}"].key_vault_id : null
3439

3540
tags = var.tags
3641

3742
## autoscale rule
38-
metric = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.metric, var.app_service_plan.autoscale.scaling_rule.metric) : var.app_service_plan.autoscale.scaling_rule.metric
39-
40-
capacity_min = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.capacity_min, var.app_service_plan.autoscale.scaling_rule.capacity_min) : var.app_service_plan.autoscale.scaling_rule.capacity_min
41-
capacity_max = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.capacity_max, var.app_service_plan.autoscale.scaling_rule.capacity_max) : var.app_service_plan.autoscale.scaling_rule.capacity_max
42-
capacity_def = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.capacity_def, var.app_service_plan.autoscale.scaling_rule.capacity_def) : var.app_service_plan.autoscale.scaling_rule.capacity_def
43-
44-
time_grain = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.time_grain, var.app_service_plan.autoscale.scaling_rule.time_grain) : var.app_service_plan.autoscale.scaling_rule.time_grain
45-
statistic = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.statistic, var.app_service_plan.autoscale.scaling_rule.statistic) : var.app_service_plan.autoscale.scaling_rule.statistic
46-
time_window = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.time_window, var.app_service_plan.autoscale.scaling_rule.time_window) : var.app_service_plan.autoscale.scaling_rule.time_window
47-
time_aggregation = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.time_aggregation, var.app_service_plan.autoscale.scaling_rule.time_aggregation) : var.app_service_plan.autoscale.scaling_rule.time_aggregation
48-
49-
inc_operator = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.inc_operator, var.app_service_plan.autoscale.scaling_rule.inc_operator) : var.app_service_plan.autoscale.scaling_rule.inc_operator
50-
inc_threshold = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.inc_threshold, var.app_service_plan.autoscale.scaling_rule.inc_threshold) : var.app_service_plan.autoscale.scaling_rule.inc_threshold
51-
inc_scale_direction = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.inc_scale_direction, var.app_service_plan.autoscale.scaling_rule.inc_scale_direction) : var.app_service_plan.autoscale.scaling_rule.inc_scale_direction
52-
inc_scale_type = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.inc_scale_type, var.app_service_plan.autoscale.scaling_rule.inc_scale_type) : var.app_service_plan.autoscale.scaling_rule.inc_scale_type
53-
inc_scale_value = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.inc_scale_value, var.app_service_plan.autoscale.scaling_rule.inc_scale_value) : var.app_service_plan.autoscale.scaling_rule.inc_scale_value
54-
inc_scale_cooldown = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.inc_scale_cooldown, var.app_service_plan.autoscale.scaling_rule.inc_scale_cooldown) : var.app_service_plan.autoscale.scaling_rule.inc_scale_cooldown
55-
56-
dec_operator = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.dec_operator, var.app_service_plan.autoscale.scaling_rule.dec_operator) : var.app_service_plan.autoscale.scaling_rule.dec_operator
57-
dec_threshold = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.dec_threshold, var.app_service_plan.autoscale.scaling_rule.dec_threshold) : var.app_service_plan.autoscale.scaling_rule.dec_threshold
58-
dec_scale_direction = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.dec_scale_direction, var.app_service_plan.autoscale.scaling_rule.dec_scale_direction) : var.app_service_plan.autoscale.scaling_rule.dec_scale_direction
59-
dec_scale_type = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.dec_scale_type, var.app_service_plan.autoscale.scaling_rule.dec_scale_type) : var.app_service_plan.autoscale.scaling_rule.dec_scale_type
60-
dec_scale_value = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.dec_scale_value, var.app_service_plan.autoscale.scaling_rule.dec_scale_value) : var.app_service_plan.autoscale.scaling_rule.dec_scale_value
61-
dec_scale_cooldown = each.value.asp_val.autoscale_override != null ? coalesce(each.value.asp_val.autoscale_override.scaling_rule.dec_scale_cooldown, var.app_service_plan.autoscale.scaling_rule.dec_scale_cooldown) : var.app_service_plan.autoscale.memory_percentage.dec_scale_cooldown
43+
metric = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.metric, var.app_service_plan.autoscale.scaling_rule.metric) : var.app_service_plan.autoscale.scaling_rule.metric
44+
45+
capacity_min = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.capacity_min, var.app_service_plan.autoscale.scaling_rule.capacity_min) : var.app_service_plan.autoscale.scaling_rule.capacity_min
46+
capacity_max = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.capacity_max, var.app_service_plan.autoscale.scaling_rule.capacity_max) : var.app_service_plan.autoscale.scaling_rule.capacity_max
47+
capacity_def = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.capacity_def, var.app_service_plan.autoscale.scaling_rule.capacity_def) : var.app_service_plan.autoscale.scaling_rule.capacity_def
48+
49+
time_grain = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.time_grain, var.app_service_plan.autoscale.scaling_rule.time_grain) : var.app_service_plan.autoscale.scaling_rule.time_grain
50+
statistic = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.statistic, var.app_service_plan.autoscale.scaling_rule.statistic) : var.app_service_plan.autoscale.scaling_rule.statistic
51+
time_window = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.time_window, var.app_service_plan.autoscale.scaling_rule.time_window) : var.app_service_plan.autoscale.scaling_rule.time_window
52+
time_aggregation = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.time_aggregation, var.app_service_plan.autoscale.scaling_rule.time_aggregation) : var.app_service_plan.autoscale.scaling_rule.time_aggregation
53+
54+
inc_operator = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.inc_operator, var.app_service_plan.autoscale.scaling_rule.inc_operator) : var.app_service_plan.autoscale.scaling_rule.inc_operator
55+
inc_threshold = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.inc_threshold, var.app_service_plan.autoscale.scaling_rule.inc_threshold) : var.app_service_plan.autoscale.scaling_rule.inc_threshold
56+
inc_scale_direction = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.inc_scale_direction, var.app_service_plan.autoscale.scaling_rule.inc_scale_direction) : var.app_service_plan.autoscale.scaling_rule.inc_scale_direction
57+
inc_scale_type = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.inc_scale_type, var.app_service_plan.autoscale.scaling_rule.inc_scale_type) : var.app_service_plan.autoscale.scaling_rule.inc_scale_type
58+
inc_scale_value = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.inc_scale_value, var.app_service_plan.autoscale.scaling_rule.inc_scale_value) : var.app_service_plan.autoscale.scaling_rule.inc_scale_value
59+
inc_scale_cooldown = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.inc_scale_cooldown, var.app_service_plan.autoscale.scaling_rule.inc_scale_cooldown) : var.app_service_plan.autoscale.scaling_rule.inc_scale_cooldown
60+
61+
dec_operator = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.dec_operator, var.app_service_plan.autoscale.scaling_rule.dec_operator) : var.app_service_plan.autoscale.scaling_rule.dec_operator
62+
dec_threshold = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.dec_threshold, var.app_service_plan.autoscale.scaling_rule.dec_threshold) : var.app_service_plan.autoscale.scaling_rule.dec_threshold
63+
dec_scale_direction = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.dec_scale_direction, var.app_service_plan.autoscale.scaling_rule.dec_scale_direction) : var.app_service_plan.autoscale.scaling_rule.dec_scale_direction
64+
dec_scale_type = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.dec_scale_type, var.app_service_plan.autoscale.scaling_rule.dec_scale_type) : var.app_service_plan.autoscale.scaling_rule.dec_scale_type
65+
dec_scale_value = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.dec_scale_value, var.app_service_plan.autoscale.scaling_rule.dec_scale_value) : var.app_service_plan.autoscale.scaling_rule.dec_scale_value
66+
dec_scale_cooldown = each.value.autoscale_override != null ? coalesce(each.value.autoscale_override.scaling_rule.dec_scale_cooldown, var.app_service_plan.autoscale.scaling_rule.dec_scale_cooldown) : var.app_service_plan.autoscale.scaling_rule.dec_scale_cooldown
6267
}

‎infrastructure/tf-core/data.tf‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,13 @@ data "terraform_remote_state" "audit" {
2222
}
2323
}
2424

25+
data "azurerm_application_insights" "ai" {
26+
provider = azurerm.audit
27+
28+
name = data.terraform_remote_state.audit.outputs.application_insights.name
29+
resource_group_name = data.terraform_remote_state.audit.outputs.application_insights.resource_group_name
30+
}
31+
2532
data "azurerm_virtual_network" "vnet_audit" {
2633
for_each = var.regions
2734

@@ -58,10 +65,3 @@ data "azurerm_user_assigned_identity" "acr_mi" {
5865
name = var.function_apps.acr_mi_name
5966
resource_group_name = var.function_apps.acr_rg_name
6067
}
61-
62-
data "azurerm_application_insights" "ai" {
63-
provider = azurerm.audit
64-
65-
name = data.terraform_remote_state.audit.outputs.application_insights.name
66-
resource_group_name = data.terraform_remote_state.audit.outputs.application_insights.resource_group_name
67-
}

‎infrastructure/tf-core/diagnostic_settings.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,8 @@ locals {
3131
# VNET
3232
monitor_diagnostic_setting_vnet_enabled_logs = ["VMProtectionAlerts"]
3333
monitor_diagnostic_setting_vnet_metrics = ["AllMetrics"]
34+
35+
# WEB APP
36+
monitor_diagnostic_setting_linux_web_app_enabled_logs = ["AppServicePlatformLogs"]
37+
monitor_diagnostic_setting_linux_web_app_metrics = ["AllMetrics"]
3438
}

‎infrastructure/tf-core/environments/development.tfvars‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,17 @@ regions = {
3636
cidr_newbits = 8
3737
cidr_offset = 3
3838
}
39+
webapps = {
40+
cidr_newbits = 8
41+
cidr_offset = 4
42+
delegation_name = "Microsoft.Web/serverFarms"
43+
service_delegation_name = "Microsoft.Web/serverFarms"
44+
service_delegation_actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
45+
}
46+
pep-dmz = {
47+
cidr_newbits = 8
48+
cidr_offset = 5
49+
}
3950
}
4051
}
4152
}
@@ -1242,6 +1253,58 @@ function_apps = {
12421253

12431254
function_app_slots = []
12441255

1256+
linux_web_app = {
1257+
acr_mi_name = "dtos-cohort-manager-acr-push"
1258+
acr_name = "acrukshubdevcohman"
1259+
acr_rg_name = "rg-hub-dev-uks-cohman"
1260+
1261+
always_on = true
1262+
1263+
cont_registry_use_mi = true
1264+
1265+
docker_CI_enable = "true"
1266+
docker_env_tag = "development"
1267+
docker_img_prefix = "cohort-manager"
1268+
1269+
enable_appsrv_storage = "false"
1270+
ftps_state = "Disabled"
1271+
https_only = true
1272+
remote_debugging_enabled = false
1273+
worker_32bit = false
1274+
# storage_name = "webappstor"
1275+
# storage_type = "AzureBlob"
1276+
# share_name = "webapp"
1277+
1278+
linux_web_app_config = {
1279+
1280+
FrontEndUi = {
1281+
name_suffix = "web"
1282+
app_service_plan_key = "DefaultPlan"
1283+
env_vars = {
1284+
static = {
1285+
AUTH_CIS2_ISSUER_URL = "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443"
1286+
AUTH_CIS2_CLIENT_ID = "7708154963.cohort-manager-ui-dev-environment.b099494b-7c49-4d78-9e3c-3a801aac691b.apps"
1287+
AUTH_TRUST_HOST = "true"
1288+
SERVICE_NAME = "Cohort Manager"
1289+
}
1290+
from_key_vault = {
1291+
# env_var_name = "key_vault_secret_name"
1292+
AUTH_CIS2_CLIENT_SECRET = "auth-cis2-client-secret"
1293+
COHORT_MANAGER_USERS = "cohort-manager-users"
1294+
NEXTAUTH_SECRET = "nextauth-secret"
1295+
}
1296+
local_urls = {
1297+
# %s becomes the environment and region prefix (e.g. dev-uks)
1298+
EXCEPTIONS_API_URL = "https://%s-get-validation-exceptions.azurewebsites.net"
1299+
NEXTAUTH_URL = "https://%s-web.azurewebsites.net/api/auth"
1300+
}
1301+
}
1302+
}
1303+
}
1304+
}
1305+
1306+
linux_web_app_slots = []
1307+
12451308
key_vault = {
12461309
disk_encryption = true
12471310
soft_del_ret_days = 7

‎infrastructure/tf-core/environments/integration.tfvars‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,17 @@ regions = {
3636
cidr_newbits = 8
3737
cidr_offset = 3
3838
}
39+
webapps = {
40+
cidr_newbits = 8
41+
cidr_offset = 4
42+
delegation_name = "Microsoft.Web/serverFarms"
43+
service_delegation_name = "Microsoft.Web/serverFarms"
44+
service_delegation_actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
45+
}
46+
pep-dmz = {
47+
cidr_newbits = 8
48+
cidr_offset = 5
49+
}
3950
}
4051
}
4152
}
@@ -1170,6 +1181,58 @@ function_apps = {
11701181

11711182
function_app_slots = []
11721183

1184+
linux_web_app = {
1185+
acr_mi_name = "dtos-cohort-manager-acr-push"
1186+
acr_name = "acrukshubdevcohman"
1187+
acr_rg_name = "rg-hub-dev-uks-cohman"
1188+
1189+
always_on = true
1190+
1191+
cont_registry_use_mi = true
1192+
1193+
docker_CI_enable = "true"
1194+
docker_env_tag = "integration"
1195+
docker_img_prefix = "cohort-manager"
1196+
1197+
enable_appsrv_storage = "false"
1198+
ftps_state = "Disabled"
1199+
https_only = true
1200+
remote_debugging_enabled = false
1201+
worker_32bit = false
1202+
# storage_name = "webappstor"
1203+
# storage_type = "AzureBlob"
1204+
# share_name = "webapp"
1205+
1206+
linux_web_app_config = {
1207+
1208+
FrontEndUi = {
1209+
name_suffix = "web"
1210+
app_service_plan_key = "DefaultPlan"
1211+
env_vars = {
1212+
static = {
1213+
AUTH_CIS2_ISSUER_URL = "https://am.nhsint.auth-ptl.cis2.spineservices.nhs.uk:443"
1214+
AUTH_CIS2_CLIENT_ID = "5789849932.cohort-manager-ui-dev.b099494b-7c49-4d78-9e3c-3a801aac691b.apps"
1215+
AUTH_TRUST_HOST = "true"
1216+
SERVICE_NAME = "Cohort Manager"
1217+
}
1218+
from_key_vault = {
1219+
# env_var_name = "key_vault_secret_name"
1220+
AUTH_CIS2_CLIENT_SECRET = "auth-cis2-client-secret"
1221+
COHORT_MANAGER_USERS = "cohort-manager-users"
1222+
NEXTAUTH_SECRET = "nextauth-secret"
1223+
}
1224+
local_urls = {
1225+
# %s becomes the environment and region prefix (e.g. dev-uks)
1226+
EXCEPTIONS_API_URL = "https://%s-get-validation-exceptions.azurewebsites.net"
1227+
NEXTAUTH_URL = "https://%s-web.azurewebsites.net/api/auth"
1228+
}
1229+
}
1230+
}
1231+
}
1232+
}
1233+
1234+
linux_web_app_slots = []
1235+
11731236
key_vault = {
11741237
disk_encryption = true
11751238
soft_del_ret_days = 7

0 commit comments

Comments
 (0)