Skip to content

Commit af6ed73

Browse files
marrobimarrobi
committed
Update to work with latest changes.
1 parent dbd3b15 commit af6ed73

File tree

8 files changed

+44
-31
lines changed

8 files changed

+44
-31
lines changed

‎Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,7 @@ deploy-shared-service:
311311
&& ${MAKEFILE_DIR}/devops/scripts/deploy_shared_service.sh $${PROPS}
312312

313313
firewall-install:
314+
$(MAKE) migrate-firewall-state
314315
. ${MAKEFILE_DIR}/devops/scripts/check_dependencies.sh env \
315316
&& $(MAKE) bundle-build bundle-publish bundle-register deploy-shared-service \
316317
DIR=${MAKEFILE_DIR}/templates/shared_services/firewall/ BUNDLE_TYPE=shared_service

‎core/terraform/.terraform.lock.hcl‎

Lines changed: 13 additions & 13 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎core/terraform/data.tf‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@ resource "random_string" "unique_id" {
88
min_numeric = 4
99
}
1010

11+
data "azurerm_storage_account" "mgmt_storage" {
12+
name = var.mgmt_storage_account_name
13+
resource_group_name = var.mgmt_resource_group_name
14+
}
15+
1116
data "azurerm_container_registry" "mgmt_acr" {
1217
name = var.acr_name
1318
resource_group_name = var.mgmt_resource_group_name
@@ -37,4 +42,4 @@ data "azurerm_monitor_diagnostic_categories" "sb" {
3742
depends_on = [
3843
azurerm_servicebus_namespace.sb
3944
]
40-
}
45+
}

‎core/terraform/firewall/firewall.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ resource "azurerm_firewall" "fw" {
3737
tags = var.tre_core_tags
3838
ip_configuration {
3939
name = "fw-ip-configuration"
40-
subnet_id = data.azurerm_subnet.firewall.id
40+
subnet_id = var.firewall_subnet_id
4141
public_ip_address_id = var.firewall_force_tunnel_ip != "" ? null : azurerm_public_ip.fwtransit[0].id
4242
}
4343

‎core/terraform/firewall/import_state.sh‎

Lines changed: 16 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@ fi
1414

1515
set -e
1616

17+
# shellcheck disable=SC1091
18+
source "$(dirname "$0")/../../../devops/scripts/mgmtstorage_enable_public_access.sh"
19+
1720
# Initialise state for Terraform
1821
terraform init -input=false -backend=true -reconfigure -upgrade \
1922
-backend-config="resource_group_name=${TF_VAR_mgmt_resource_group_name}" \
@@ -65,7 +68,7 @@ if [[ "${FIREWALL_SKU}" == "Basic" ]]; then
6568
import_if_exists module.firewall.azurerm_public_ip.fwmanagement[0] "/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/publicIPAddresses/pip-fw-management-${TRE_ID}"
6669
fi
6770

68-
import_if_exists module.firewall.azurerm_public_ip.fwtransit "/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/publicIPAddresses/pip-fw-${TRE_ID}"
71+
import_if_exists module.firewall.azurerm_public_ip.fwtransit[0] "/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/publicIPAddresses/pip-fw-${TRE_ID}"
6972

7073
# Firewall policy
7174
import_if_exists module.firewall.azurerm_firewall_policy.root "/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/firewallPolicies/fw-policy-${TRE_ID}"
@@ -82,20 +85,20 @@ import_if_exists module.firewall.azurerm_monitor_diagnostic_setting.firewall \
8285
import_if_exists azurerm_route_table.rt \
8386
"/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/routeTables/rt-${TRE_ID}"
8487

85-
import_if_exists azurerm_subnet_route_table_association.rt_shared_subnet_association \
86-
"/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/SharedSubnet"
88+
# import_if_exists azurerm_subnet_route_table_association.rt_shared_subnet_association \
89+
# "/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/SharedSubnet"
8790

88-
import_if_exists azurerm_subnet_route_table_association.rt_resource_processor_subnet_association \
89-
"/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/ResourceProcessorSubnet"
91+
# import_if_exists azurerm_subnet_route_table_association.rt_resource_processor_subnet_association \
92+
# "/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/ResourceProcessorSubnet"
9093

91-
import_if_exists azurerm_subnet_route_table_association.rt_web_app_subnet_association \
92-
"/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/WebAppSubnet"
94+
# import_if_exists azurerm_subnet_route_table_association.rt_web_app_subnet_association \
95+
# "/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/WebAppSubnet"
9396

94-
import_if_exists azurerm_subnet_route_table_association.rt_airlock_processor_subnet_association \
95-
"/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/AirlockProcessorSubnet"
97+
# import_if_exists azurerm_subnet_route_table_association.rt_airlock_processor_subnet_association \
98+
# "/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/AirlockProcessorSubnet"
9699

97-
import_if_exists azurerm_subnet_route_table_association.rt_airlock_storage_subnet_association \
98-
"/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/AirlockStorageSubnet"
100+
# import_if_exists azurerm_subnet_route_table_association.rt_airlock_storage_subnet_association \
101+
# "/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/AirlockStorageSubnet"
99102

100-
import_if_exists azurerm_subnet_route_table_association.rt_airlock_events_subnet_association \
101-
"/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/AirlockEventsSubnet"
103+
# import_if_exists azurerm_subnet_route_table_association.rt_airlock_events_subnet_association \
104+
# "/subscriptions/${ARM_SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_ID}/providers/Microsoft.Network/virtualNetworks/vnet-${TRE_ID}/subnets/AirlockEventsSubnet"

‎core/terraform/firewall/remove_state.sh‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ echo "REMOVING STATE FOR FIREWALL..."
88

99
set -e
1010

11+
# shellcheck disable=SC1091
12+
source "$(dirname "$0")/../../../devops/scripts/mgmtstorage_enable_public_access.sh"
13+
1114
terraform init -input=false -backend=true -reconfigure -upgrade \
1215
-backend-config="resource_group_name=${TF_VAR_mgmt_resource_group_name}" \
1316
-backend-config="storage_account_name=${TF_VAR_mgmt_storage_account_name}" \
@@ -41,9 +44,10 @@ remove_if_present azurerm_subnet_route_table_association.rt_airlock_events_subne
4144
remove_if_present azurerm_firewall_network_rule_collection.core
4245

4346
# firewall.tf
44-
remove_if_present azurerm_public_ip.fwtransit
47+
remove_if_present azurerm_public_ip.fwtransit[0]
4548
remove_if_present azurerm_public_ip.fwmanagement[0]
4649
remove_if_present azurerm_firewall.fw
4750
remove_if_present azurerm_monitor_diagnostic_categories.firewall
4851
remove_if_present azurerm_monitor_diagnostic_setting.firewall
52+
remove_if_present azurerm_firewall_policy_rule_collection_group.core
4953
remove_if_present azurerm_firewall_policy.root

‎core/terraform/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@ module "resource_processor_vmss_porter" {
194194
service_bus_namespace_fqdn = local.service_bus_namespace_fqdn
195195
service_bus_resource_request_queue = azurerm_servicebus_queue.workspacequeue.name
196196
service_bus_deployment_status_update_queue = azurerm_servicebus_queue.service_bus_deployment_status_update_queue.name
197-
mgmt_storage_account_name = var.mgmt_storage_account_name
197+
mgmt_storage_account_id = data.azurerm_storage_account.mgmt_storage.id
198198
mgmt_resource_group_name = var.mgmt_resource_group_name
199199
terraform_state_container_name = var.terraform_state_container_name
200200
key_vault_name = azurerm_key_vault.kv.name

‎core/terraform/network/outputs.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ output "azure_firewall_subnet_id" {
1111
}
1212

1313
output "firewall_management_subnet_id" {
14-
value = azurerm_subnet.firewall_management.id
14+
value = local.subnet_ids_map["AzureFirewallManagementSubnet"]
1515
}
1616

1717
output "app_gw_subnet_id" {

0 commit comments

Comments
 (0)