Skip to content

Commit 983d40a

Browse files
patrickmoore-ncpatrickmoore-nc
committed
feat: Hub infrastructure bootstrap bicep
1 parent 9217eb8 commit 983d40a

21 files changed

+458
-11
lines changed

‎.gitleaksignore‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,15 @@ infrastructure/terraform/resource_group_init/main.bicep:generic-api-key:32
1111
infrastructure/terraform/resource_group_init/main.bicep:generic-api-key:33
1212
infrastructure/terraform/resource_group_init/storage.bicep:generic-api-key:59
1313
infrastructure/terraform/resource_group_init/keyVault.bicep:generic-api-key:10
14+
infrastructure/bootstrap/core.bicep:generic-api-key:10
15+
infrastructure/bootstrap/core.bicep:generic-api-key:11
16+
infrastructure/bootstrap/core.bicep:generic-api-key:12
17+
infrastructure/bootstrap/core.bicep:generic-api-key:13
18+
infrastructure/bootstrap/core.bicep:generic-api-key:14
19+
infrastructure/bootstrap/main.bicep:generic-api-key:29
20+
infrastructure/bootstrap/main.bicep:generic-api-key:30
21+
infrastructure/bootstrap/main.bicep:generic-api-key:31
22+
infrastructure/bootstrap/main.bicep:generic-api-key:32
23+
infrastructure/bootstrap/main.bicep:generic-api-key:33
24+
infrastructure/bootstrap/modules/storage.bicep:generic-api-key:59
25+
infrastructure/bootstrap/modules/keyVault.bicep:generic-api-key:10

infrastructure/terraform/resource_group_init/core.bicep renamed to infrastructure/bootstrap/core.bicep

File renamed without changes.

‎infrastructure/bootstrap/environments/live/hub.bicepparam‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
using '../../hub.bicep'
2+
3+
param hubType = 'live'
4+
param vnetAddressPrefixes = [
5+
'10.21.0.0/16'
6+
]
7+
param devopsSubnetAddressPrefix = '10.21.1.0/24'
8+
param devopsInfrastructureId = ''

‎infrastructure/bootstrap/environments/live/variables.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
AZURE_SUBSCRIPTION="name"
2+
BOOTSTRAP=hub
3+
HUB_TYPE=live

‎infrastructure/bootstrap/environments/nonlive/hub.bicepparam‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
using '../../hub.bicep'
2+
3+
param hubType = 'nonlive'
4+
param vnetAddressPrefixes = [
5+
'10.11.0.0/16'
6+
]
7+
param devopsSubnetAddressPrefix = '10.11.1.0/24'
8+
param devopsInfrastructureId = ''

‎infrastructure/bootstrap/environments/nonlive/variables.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
AZURE_SUBSCRIPTION="Digital Screening DToS - Sandbox"
2+
BOOTSTRAP=hub
3+
HUB_TYPE=nonlive

‎infrastructure/bootstrap/hub.bicep‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/*
2+
Root Bicep file for deploying Hub subscription bootstrap resources needed for Terraform to continue:
3+
- Private VNet
4+
- Managed DevOps Pool (for VNet-integrated ADO build agents)
5+
- Managed Identity for Terraform
6+
- Blob Storage Account with Container, Private Endpoint, and public access disabled
7+
- Private DNS for Storage Account Private Endpoint
8+
9+
Subscription pre-requisites:
10+
- az provider register --namespace 'Microsoft.DevOpsInfrastructure'
11+
- az provider register --namespace 'Microsoft.DevCenter'
12+
13+
Run once, deployment of the Managed DevOps Pool will fail.
14+
Manually Grant 'Reader' and 'Network Contributor' RBAC roles to the Service Principal 'DevopsInfrastructure' on the VNet resource.
15+
Re-run, it will succeed. This cannot be automated in bicep, the object ID (which needs to be resolved from the appId) will be considered invalid.
16+
*/
17+
18+
targetScope = 'subscription'
19+
20+
param devopsSubnetAddressPrefix string
21+
// param enableSoftDelete bool
22+
param hubType string // live / nonlive
23+
param region string = 'uksouth'
24+
param regionShortName string = 'uks'
25+
param vnetAddressPrefixes array
26+
27+
// var keyVaultName = 'kv-lungcs-${envConfig}-inf'
28+
29+
var devopsSubnetName = 'sn-hub-${hubType}-${regionShortName}-devops'
30+
var devCenterName = 'devc-hub-${hubType}-${regionShortName}'
31+
var devCenterProjectName = 'prj-hub-${hubType}-${regionShortName}'
32+
var poolName = 'private-pool-hub-${hubType}-${regionShortName}'
33+
var resourceGroupName = 'rg-hub-${hubType}-${regionShortName}-bootstrap'
34+
var virtualNetworkName = 'vnet-hub-${hubType}-${regionShortName}'
35+
36+
// var miADOtoAZname = 'mi-${appShortName}-${envConfig}-adotoaz-uks'
37+
// var miGHtoADOname = 'mi-${appShortName}-${envConfig}-ghtoado-uks'
38+
39+
resource bootstrapRG 'Microsoft.Resources/resourceGroups@2025-04-01' = {
40+
name: resourceGroupName
41+
location: region
42+
}
43+
44+
@description('Virtual Network Deployment')
45+
module virtualNetwork 'modules/virtualNetwork.bicep' = {
46+
scope: bootstrapRG
47+
params: {
48+
name: virtualNetworkName
49+
addressPrefixes: vnetAddressPrefixes
50+
}
51+
}
52+
53+
@description('Managed DevOps Pool Deployment')
54+
module managedDevopsPool 'modules/managedDevopsPool.bicep' = {
55+
scope: bootstrapRG
56+
params: {
57+
adoOrg: 'nhse-pps-1'
58+
agentProfileMaxAgentLifetime: '00.04:00:00'
59+
devCenterName: devCenterName
60+
devCenterProjectName: devCenterProjectName
61+
devopsSubnetName: devopsSubnetName
62+
devopsSubnetAddressPrefix: devopsSubnetAddressPrefix
63+
poolName: poolName
64+
virtualNetworkId: virtualNetwork.outputs.id
65+
virtualNetworkName: virtualNetwork.outputs.name
66+
}
67+
}

infrastructure/terraform/resource_group_init/main.bicep renamed to infrastructure/bootstrap/main.bicep

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ resource managedIdentityRG 'Microsoft.Resources/resourceGroups@2024-11-01' exist
5151
}
5252

5353
// Create the managed identity assumed by Azure devops to connect to Azure
54-
module managedIdentiyADOtoAZ 'managedIdentity.bicep' = {
54+
module managedIdentiyADOtoAZ 'modules/managedIdentity.bicep' = {
5555
scope: managedIdentityRG
5656
params: {
5757
name: miADOtoAZname
@@ -60,7 +60,7 @@ module managedIdentiyADOtoAZ 'managedIdentity.bicep' = {
6060
}
6161

6262
// Create the managed identity assumed by Github actions to trigger Azure devops pipelines
63-
module managedIdentiyGHtoADO 'managedIdentity.bicep' = {
63+
module managedIdentiyGHtoADO 'modules/managedIdentity.bicep' = {
6464
scope: managedIdentityRG
6565
params: {
6666
name: miGHtoADOname
@@ -84,7 +84,7 @@ resource readerAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' =
8484
}
8585

8686
// Create the storage account, blob service and container
87-
module terraformStateStorageAccount 'storage.bicep' = {
87+
module terraformStateStorageAccount 'modules/storage.bicep' = {
8888
scope: storageAccountRG
8989
params: {
9090
storageLocation: region
@@ -96,23 +96,23 @@ module terraformStateStorageAccount 'storage.bicep' = {
9696
}
9797

9898
// Retrieve storage private DNS zone
99-
module storagePrivateDNSZone 'dns.bicep' = {
99+
module storagePrivateDNSZone 'modules/dns.bicep' = {
100100
scope: privateDNSZoneRG
101101
params: {
102102
resourceServiceType: 'storage'
103103
}
104104
}
105105

106106
// Retrieve key vault private DNS zone
107-
module keyVaultPrivateDNSZone 'dns.bicep' = {
107+
module keyVaultPrivateDNSZone 'modules/dns.bicep' = {
108108
scope: privateDNSZoneRG
109109
params: {
110110
resourceServiceType: 'keyVault'
111111
}
112112
}
113113

114114
// Create private endpoint and register DNS
115-
module storageAccountPrivateEndpoint 'privateEndpoint.bicep' = {
115+
module storageAccountPrivateEndpoint 'modules/privateEndpoint.bicep' = {
116116
scope: privateEndpointResourceGroup
117117
params: {
118118
hub: hubMap[envConfig]
@@ -141,7 +141,7 @@ resource infraRG 'Microsoft.Resources/resourceGroups@2024-11-01' = {
141141
}
142142

143143
// Private endpoint for infra key vault
144-
module kvPrivateEndpoint 'privateEndpoint.bicep' = {
144+
module kvPrivateEndpoint 'modules/privateEndpoint.bicep' = {
145145
scope: resourceGroup(infraResourceGroupName)
146146
params: {
147147
hub: hubMap[envConfig]
@@ -154,7 +154,7 @@ module kvPrivateEndpoint 'privateEndpoint.bicep' = {
154154
}
155155

156156
// Use a module to deploy Key Vault into the infra RG
157-
module keyVaultModule 'keyVault.bicep' = {
157+
module keyVaultModule 'modules/keyVault.bicep' = {
158158
name: 'keyVaultDeployment'
159159
scope: resourceGroup(infraResourceGroupName)
160160
params: {

infrastructure/terraform/resource_group_init/dns.bicep renamed to infrastructure/bootstrap/modules/dns.bicep

File renamed without changes.

infrastructure/terraform/resource_group_init/keyVault.bicep renamed to infrastructure/bootstrap/modules/keyVault.bicep

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
param enableSoftDelete bool
32
param keyVaultName string
43
param miPrincipalId string

0 commit comments

Comments
 (0)