VED-366 Set up internal QA env and stop CD into int (#908)

dlzhry2nhs · mfjarvis · commit 51f1b7a21b1d · 2025-12-11T10:12:27.000Z
diff --git a/.github/workflows/continuous-deployment.yml b/.github/workflows/continuous-deployment.yml
@@ -59,7 +59,7 @@ jobs:
     needs: [run-internal-dev-tests]
     strategy:
       matrix:
-        sub_environment_name: [ref, int]
+        sub_environment_name: [ref, internal-qa]
     uses: ./.github/workflows/deploy-backend.yml
     with:
       apigee_environment: ${{ matrix.sub_environment_name }}
@@ -71,7 +71,7 @@ jobs:
     needs: [deploy-higher-dev-envs]
     strategy:
       matrix:
-        sub_environment_name: [ref, int]
+        sub_environment_name: [ref, internal-qa]
     uses: ./.github/workflows/run-e2e-tests.yml
     with:
       apigee_environment: ${{ matrix.sub_environment_name }}
diff --git a/.github/workflows/deploy-backend.yml b/.github/workflows/deploy-backend.yml
@@ -23,6 +23,7 @@ on:
         description: Select the Apigee proxy environment
         options:
           - internal-dev
+          - internal-qa
           - int
           - ref
           - prod
diff --git a/.github/workflows/run-e2e-tests.yml b/.github/workflows/run-e2e-tests.yml
@@ -30,6 +30,7 @@ on:
           - internal-dev
           - internal-dev-sandbox
           - sandbox
+          - internal-qa
           - int
           - ref
           - prod
diff --git a/azure/azure-int-proxy-release-pipeline.yml b/azure/azure-int-proxy-release-pipeline.yml
@@ -0,0 +1,43 @@
+name: "$(SourceBranchName)+$(BuildID)"
+
+trigger: none
+pr: none
+
+resources:
+  repositories:
+    - repository: common
+      type: github
+      name: NHSDigital/api-management-utils
+      ref: refs/heads/edge
+      endpoint: NHSDigital
+  pipelines:
+    - pipeline: build_pipeline
+      source: "Immunisation-Fhir-Api-Build"
+
+pool:
+  name: "AWS-ECS"
+
+variables:
+  - template: project.yml
+
+parameters:
+  - name: sub_environment
+    displayName: Sub-Environment
+    type: string
+    default: int-blue
+    values:
+      - int-blue
+      - int-green
+
+extends:
+  template: azure/common/apigee-deployment.yml@common
+  parameters:
+    service_name: ${{ variables.service_name }}
+    short_service_name: ${{ variables.short_service_name }}
+    service_base_path: ${{ variables.service_base_path }}
+    apigee_deployments:
+      - environment: int
+        depends_on: []
+        jinja_templates:
+          DOMAIN_ENDPOINT: https://${{ parameters.sub_environment }}.imms.preprod.vds.platform.nhs.uk
+          KEYSTORE_REF: imms-int-client
diff --git a/azure/azure-release-pipeline.yml b/azure/azure-release-pipeline.yml
@@ -49,8 +49,8 @@ extends:
           - internal_dev
         jinja_templates:
           DOMAIN_ENDPOINT: https://ref.imms.dev.vds.platform.nhs.uk
-      - environment: int
+      - environment: internal-qa
         depends_on:
           - internal_dev
         jinja_templates:
-          DOMAIN_ENDPOINT: https://int.imms.dev.vds.platform.nhs.uk
+          DOMAIN_ENDPOINT: https://internal-qa.imms.dev.vds.platform.nhs.uk
diff --git a/config/preprod/permissions_config.json b/config/preprod/permissions_config.json
@@ -149,10 +149,12 @@
   },
   {
     "supplier": "EVA",
+    "permissions": ["COVID.CUD"],
     "ods_codes": ["8HA94"]
   },
   {
     "supplier": "SONAR",
+    "permissions": ["FLU.CD"],
     "ods_codes": ["8HK48"]
   }
 ]
diff --git a/infrastructure/instance/environments/dev/int/variables.tfvars b/infrastructure/instance/environments/dev/int/variables.tfvars
@@ -1,3 +1,4 @@
+# TODO - once DEV int -> PREPROD migration complete, please destroy env and delete this file.
 environment                       = "dev"
 immunisation_account_id           = "345594581768"
 dspp_core_account_id              = "603871901111"
diff --git a/infrastructure/instance/environments/dev/internal-qa/variables.tfvars b/infrastructure/instance/environments/dev/internal-qa/variables.tfvars
@@ -0,0 +1,7 @@
+environment                       = "dev"
+immunisation_account_id           = "345594581768"
+dspp_core_account_id              = "603871901111"
+pds_environment                   = "int"
+batch_error_notifications_enabled = false
+create_mesh_processor             = false
+has_sub_environment_scope         = true
diff --git a/infrastructure/instance/environments/preprod/int-blue/variables.tfvars b/infrastructure/instance/environments/preprod/int-blue/variables.tfvars
@@ -3,5 +3,5 @@ immunisation_account_id           = "084828561157"
 dspp_core_account_id              = "603871901111"
 pds_environment                   = "int"
 batch_error_notifications_enabled = true
-create_mesh_processor             = false
+create_mesh_processor             = true
 has_sub_environment_scope         = false
diff --git a/infrastructure/instance/environments/preprod/int-green/variables.tfvars b/infrastructure/instance/environments/preprod/int-green/variables.tfvars
@@ -3,5 +3,5 @@ immunisation_account_id           = "084828561157"
 dspp_core_account_id              = "603871901111"
 pds_environment                   = "int"
 batch_error_notifications_enabled = true
-create_mesh_processor             = false
+create_mesh_processor             = true
 has_sub_environment_scope         = false
diff --git a/infrastructure/mesh/README.md b/infrastructure/mesh/README.md
@@ -1,7 +1,7 @@
 # Important
 
 The Mesh module is not idempotent, which is why it is kept separate from the main infrastructure folder. Each time the module is applied, it triggers the recreation of various AWS resources related to the Mesh configuration.
-There is 1 mesh mailbox for int that currently resides in the dev AWS account. This should be moved to the new INT AWS account once it becomes active.
+There is 1 mesh mailbox for MESH int that currently resides in the preprod AWS account.
 
 ## Running terraform
 
diff --git a/infrastructure/mesh/environments/preprod/variables.tfvars b/infrastructure/mesh/environments/preprod/variables.tfvars
@@ -0,0 +1,5 @@
+aws_environment     = "preprod"
+imms_account_id     = "084828561157"
+mesh_environment    = "integration"
+mesh_mailbox_ids    = ["X26OT303"]
+mesh_dlq_mailbox_id = "X26OT304"
diff --git a/infrastructure/proxies/live/apiproxy/targets/target.xml b/infrastructure/proxies/live/apiproxy/targets/target.xml
@@ -36,7 +36,7 @@
     <SSLInfo>
       <Enabled>true</Enabled>
       <ClientAuthEnabled>true</ClientAuthEnabled>
-      <KeyStore>ref://imms-client</KeyStore>
+      <KeyStore>ref://{{ KEYSTORE_REF | default('imms-client') }}</KeyStore>
       <KeyAlias>cert</KeyAlias>
     </SSLInfo>
     <Properties>
diff --git a/manifest_template.yml b/manifest_template.yml
@@ -18,6 +18,28 @@ APIGEE_ENVIRONMENTS:
           enabled: false
         spikeArrest:
           enabled: false
+  - name: internal-qa
+    has_mock_auth: true
+    display_name_suffix: Internal Quality Assurance
+    ratelimiting:
+      immunisation-fhir-api-internal-qa:
+        quota:
+          enabled: true
+          limit: 6000
+          interval: 1
+          timeunit: minute
+        spikeArrest:
+          enabled: true
+          ratelimit: 6000pm # 100 requests per second
+      app:
+        quota:
+          enabled: true
+          limit: 3000
+          interval: 1
+          timeunit: minute
+        spikeArrest:
+          enabled: true
+          ratelimit: 3000pm # 50 requests per second
   - name: internal-dev-sandbox
     display_name_suffix: Internal Development Sandbox
     # Ratelimiting is currently disabled for all sandbox environments

Original file line number	Diff line number	Diff line change
`@@ -149,10 +149,12 @@`
`149`	`149`	`},`
`150`	`150`	`{`
`151`	`151`	`"supplier": "EVA",`
	`152`	`+ "permissions": ["COVID.CUD"],`
`152`	`153`	`"ods_codes": ["8HA94"]`
`153`	`154`	`},`
`154`	`155`	`{`
`155`	`156`	`"supplier": "SONAR",`
	`157`	`+ "permissions": ["FLU.CD"],`
`156`	`158`	`"ods_codes": ["8HK48"]`
`157`	`159`	`}`
`158`	`160`	`]`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+# TODO - once DEV int -> PREPROD migration complete, please destroy env and delete this file.`
`1`	`2`	`environment = "dev"`
`2`	`3`	`immunisation_account_id = "345594581768"`
`3`	`4`	`dspp_core_account_id = "603871901111"`