Skip to content
This repository has been archived by the owner on Sep 12, 2023. It is now read-only.

Updates to WL Spoke #107

Merged
merged 1 commit into from
Oct 12, 2022
Merged

Updates to WL Spoke #107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions src/bicep/enclaves/enclave-scca-hubspoke-aks/deploy.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,19 +85,18 @@ module modAKSWorkload '../../workloads/wl-aks-spoke/deploy.bicep' = {
params: {
parRequired: parRequired
parLocation: parLocation
parTags: parTags
parFirewallPrivateIPAddress: modHubSpoke.outputs.firewallPrivateIPAddress
parTags: parTags
parHubFirewallPolicyName: modHubSpoke.outputs.firewallPolicyName
parHubResourceGroupName: modHubSpoke.outputs.hub.resourceGroupName
parHubSubscriptionId: modHubSpoke.outputs.hub.subscriptionId
parHubVirtualNetworkName: modHubSpoke.outputs.hub.virtualNetworkName
parHubVirtualNetworkResourceId: modHubSpoke.outputs.hub.virtualNetworkResourceId
parWorkload: parAksWorkload
parWorkloadSpoke: parAksWorkload
parContainerRegistry: parContainerRegistry
parKubernetesCluster: parKubernetesCluster
parLogAnalyticsWorkspaceName: modHubSpoke.outputs.logAnalyticsWorkspaceName
parLogAnalyticsWorkspaceResourceId: modHubSpoke.outputs.logAnalyticsWorkspaceResourceId
parWorkloadLogStorageAccountAccess: parWorkloadLogStorageAccountAccess
parWorkloadStorageAccountAccess: parWorkloadLogStorageAccountAccess
parSourceAddresses: parSourceAddresses
}
}
}
40 changes: 36 additions & 4 deletions src/bicep/enclaves/enclave-scca-hubspoke-aks/parameters/deploy.parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,12 +95,44 @@
},
"parAksWorkload": {
"value": {
"name": "aks",
"shortName": "aks",
"name": "app",
"shortName": "app",
"subscriptionId": "<<subscriptionId>>",
"enableDdosProtectionPlan": false,
"network": {
"virtualNetworkAddressPrefix": "10.0.125.0/26",
"subnetAddressPrefix": "10.0.125.0/26"
"subnetAddressPrefix": "10.0.125.0/26",
"virtualNetworkDiagnosticsLogs": [],
"virtualNetworkDiagnosticsMetrics": [],
"networkSecurityGroupRules": [],
"NetworkSecurityGroupDiagnosticsLogs": [
"NetworkSecurityGroupEvent",
"NetworkSecurityGroupRuleCounter"
],
"subnetServiceEndpoints": [
{
"service": "Microsoft.Storage"
}
],
"subnets": [
{
"name": "app",
"addressPrefix": ""
}
],
"routeTable": {
"disableBgpRoutePropagation": false,
"routes": [
{
"name": "wl-routetable",
"properties": {
"addressPrefix": "0.0.0.0/0",
"nextHopIpAddress": "<<FirewallPrivateIPAddress>>",
"nextHopType": "VirtualAppliance"
}
}
]
}
}
}
},
Expand Down Expand Up @@ -298,4 +330,4 @@
}
}
}
}
}
112 changes: 80 additions & 32 deletions src/bicep/overlays/management-services/workloadSpoke/deploy.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,22 +46,9 @@ param parRequired object
@description('Required tags values used with all resources.')
param parTags object

@description('The subscription ID for the Workload Network and resources. It defaults to the deployment subscription.')
param parWorkloadSubscriptionId string = subscription().subscriptionId

@description('The region to deploy resources into. It defaults to the deployment location.')
param parLocation string = deployment().location

@minLength(3)
@maxLength(12)
@description('Prefix value which will be the workload name. Default: workload')
param parWorkloadName string = 'workload'

@minLength(3)
@maxLength(12)
@description('Prefix value which will be the workload name. Default: wk1')
param parWorkloadShortName string = 'wk1'

// RESOURCE NAMING PARAMETERS

@description('A suffix to use for naming deployments uniquely. It defaults to the Bicep resolution of the "utcNow()" function.')
Expand All @@ -72,17 +59,79 @@ param parDeploymentNameSuffix string = utcNow()
@description('The subscription ID for the Hub Network.')
param parHubSubscriptionId string

// Hub Resource Group Name
// (JSON Parameter)
// ---------------------------
// "parHubResourceGroupName": {
// "value": "anoa-eastus-platforms-hub-rg"
// }
@description('The resource group name for the Hub Network.')
param parHubResourceGroupName string

// Hub Virtual Network Name
// (JSON Parameter)
// ---------------------------
// "parHubVirtualNetworkName": {
// "value": "anoa-eastus-platforms-hub-vnet"
// }
@description('The virtual network name for the Hub Network.')
param parHubVirtualNetworkName string

// Hub Virtual Network Resource Id
// (JSON Parameter)
// ---------------------------
// "parHubVirtualNetworkResourceId": {
// "value": "/subscriptions/xxxxxxxx-xxxxxx-xxxxx-xxxxxx-xxxxxx/resourceGroups/anoa-eastus-platforms-hub-rg/providers/Microsoft.Network/virtualNetworks/anoa-eastus-platforms-hub-vnet/subnets/anoa-eastus-platforms-hub-vnet"
// }
@description('The virtual network resource Id for the Hub Network.')
param parHubVirtualNetworkResourceId string

// WORKLOAD NETWORK PARAMETERS

// WORKLOAD PARAMETERS
// Example (JSON)
// -----------------------------
// "parWorkloadSpoke": {
// "value": {
// "name": "app",
// "shortName": "app",
// "subscriptionId": "<<subscriptionId>>",
// "enableDdosProtectionPlan": false,
// "network": {
// "virtualNetworkAddressPrefix": "10.0.125.0/26",
// "subnetAddressPrefix": "10.0.125.0/26",
// "virtualNetworkDiagnosticsLogs": [],
// "virtualNetworkDiagnosticsMetrics": [],
// "networkSecurityGroupRules": [],
// "NetworkSecurityGroupDiagnosticsLogs": [
// "NetworkSecurityGroupEvent",
// "NetworkSecurityGroupRuleCounter"
// ],
// "subnetServiceEndpoints": [
// {
// "service": "Microsoft.Storage"
// }
// ],
// "subnets": [
// {
// "name": "app",
// "addressPrefix": ""
// }
// ],
// "routeTable": {
// "disableBgpRoutePropagation": false,
// "routes": [
// {
// "name": "wl-routetable",
// "properties": {
// "addressPrefix": "0.0.0.0/0",
// "nextHopIpAddress": "<<FirewallPrivateIPAddress>>",
// "nextHopType": "VirtualAppliance"
// }
// }
// ]
// }
// }
// }
// }
@description('Required values used with the workload, Please review the Read Me for required parameters')
param parWorkloadSpoke object

Expand All @@ -91,6 +140,13 @@ param parWorkloadSpoke object
@description('The Storage Account SKU to use for log storage. It defaults to "Standard_GRS". See https://docs.microsoft.com/en-us/rest/api/storagerp/srp_sku_types for valid settings.')
param parLogStorageSkuName string = 'Standard_GRS'

// LOGGING PARAMETERS
// Log Analytics Workspace Resource Id
// (JSON Parameter)
// ---------------------------
// "parLogAnalyticsWorkspaceResourceId": {
// "value": "/subscriptions/xxxxxxxx-xxxxxx-xxxxx-xxxxxx-xxxxxx/resourceGroups/anoa-eastus-platforms-hub-rg/providers/Microsoft.Network/virtualNetworks/anoa-eastus-platforms-hub-vnet/subnets/anoa-eastus-platforms-hub-vnet"
// }
@description('Log Analytics Workspace Resource Id Needed for NSG, VNet and Activity Logging')
param parLogAnalyticsWorkspaceResourceId string

Expand All @@ -100,14 +156,6 @@ param parLogAnalyticsWorkspaceName string
@description('Enable this setting if this network is on a different subscriptiom as the Hub. Will give conflict errors if on same sub as the Hub')
param parEnableActivityLogging bool = false

// ROUTE TABLE

@description('An array of Route Table routes to apply to the Workload Virtual Network. If custom routes are enabled, over write the default. it See https://docs.microsoft.com/en-us/azure/templates/microsoft.network/routetables/routes?tabs=bicep#routepropertiesformat for valid settings.')
param parRouteTableRoutes array = []

@description('Switch which allows Bgp Route Propagation. Default: false')
param parDisableBgpRoutePropagation bool = false

// STORAGE ACCOUNTS RBAC
@description('Account for access to Storage')
param parWorkloadStorageAccountAccess object
Expand All @@ -134,11 +182,11 @@ var varDdosNamingConvention = replace(varNamingConvention, varResourceToken, 'dd

// WORKLOAD NAMES

var varWorkloadName = parWorkloadName
var varWorkloadShortName = parWorkloadShortName
var varWorkloadName = parWorkloadSpoke.name
var varWorkloadShortName = parWorkloadSpoke.shortName
var varWorkloadResourceGroupName = replace(varResourceGroupNamingConvention, varNameToken, varWorkloadName)
var varWorkloadLogStorageAccountShortName = replace(varStorageAccountNamingConvention, varNameToken, replace(varWorkloadShortName, '-', ''))
var varWorkloadLogStorageAccountUniqueName = replace(varWorkloadLogStorageAccountShortName, 'unique_storage_token', uniqueString(parWorkloadSubscriptionId, parLocation, parRequired.deployEnvironment, parRequired.orgPrefix))
var varWorkloadLogStorageAccountUniqueName = replace(varWorkloadLogStorageAccountShortName, 'unique_storage_token', uniqueString(parWorkloadSpoke.subscriptionId, parLocation, parRequired.deployEnvironment, parRequired.orgPrefix))
var varWorkloadLogStorageAccountName = take(varWorkloadLogStorageAccountUniqueName, 23)
var varWorkloadVirtualNetworkName = replace(varVirtualNetworkNamingConvention, varNameToken, varWorkloadName)
var varWorkloadNetworkSecurityGroupName = replace(varNetworkSecurityGroupNamingConvention, varNameToken, varWorkloadName)
Expand All @@ -162,7 +210,7 @@ module modTags '../../../azresources/Modules/Microsoft.Resources/tags/az.resourc

module modWorkloadResourceGroup '../../../azresources/Modules/Microsoft.Resources/resourceGroups/az.resource.groups.bicep' = {
name: 'deploy-${varWorkloadShortName}-rg-${parDeploymentNameSuffix}'
scope: subscription(parWorkloadSubscriptionId)
scope: subscription(parWorkloadSpoke.subscriptionId)
params: {
name: varWorkloadResourceGroupName
location: parLocation
Expand Down Expand Up @@ -222,8 +270,8 @@ module modWorkloadRouteTable '../../../azresources/Modules/Microsoft.Network/rou
location: parLocation
tags: modTags.outputs.tags

routes: parRouteTableRoutes
disableBgpRoutePropagation: parDisableBgpRoutePropagation
routes: parWorkloadSpoke.network.routeTable.routes
disableBgpRoutePropagation: parWorkloadSpoke.network.routeTable.disableBgpRoutePropagation
}
dependsOn: [
modWorkloadResourceGroup
Expand Down Expand Up @@ -264,11 +312,11 @@ module modWorkloadVirtualNetwork '../../../azresources/Modules/Microsoft.Network

module modWorkloadVirtualNetworkPeerings '../../../azresources/hub-spoke-core/peering/spoke/anoa.lz.spoke.network.peering.bicep' = {
name: 'deploy-hub-peerings-${varWorkloadShortName}-${parLocation}-${parDeploymentNameSuffix}'
scope: resourceGroup(parWorkloadSubscriptionId, varWorkloadResourceGroupName)
scope: resourceGroup(parWorkloadSpoke.subscriptionId, varWorkloadResourceGroupName)
params: {
parHubVirtualNetworkName: parHubVirtualNetworkName
parHubVirtualNetworkResourceId: parHubVirtualNetworkResourceId
parSpokeName: parWorkloadName
parSpokeName: parWorkloadSpoke.name
parSpokeResourceGroupName: modWorkloadResourceGroup.outputs.name
parSpokeVirtualNetworkName: modWorkloadVirtualNetwork.outputs.name
}
Expand All @@ -281,7 +329,7 @@ module modHubToWorkloadVirtualNetworkPeering '../../../azresources/hub-spoke-cor
parHubVirtualNetworkName: parHubVirtualNetworkName
parSpokes: [
{
name: parWorkloadName
name: parWorkloadSpoke.name
virtualNetworkResourceId: modWorkloadVirtualNetwork.outputs.resourceId
virtualNetworkName: modWorkloadVirtualNetwork.outputs.name
}
Expand Down
42 changes: 21 additions & 21 deletions src/bicep/overlays/management-services/workloadSpoke/parameters/deploy.parameters.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,41 +38,41 @@
"service": "Microsoft.Storage"
}
],
"subnets": [
{
"name": "app",
"addressPrefix": ""
}
],
"routes": [

]
"subnets": [],
"routeTable": {
"disableBgpRoutePropagation": false,
"routes": [
{
"name": "wl-routetable",
"properties": {
"addressPrefix": "0.0.0.0/0",
"nextHopIpAddress": "10.0.100.4",
"nextHopType": "VirtualAppliance"
}
}
]
}
}
}
},
"parHubSubscriptionId": {
"value": "xxxxxxxx-xxxxxx-xxxxx-xxxxxx-xxxxxx"
"value": "<<subscriptionId>>"
},
"parHubResourceGroupName": {
"value": "anoa-eastus-workload-hub-rg"
"value": "anoa-eastus-dev-hub-rg"
},
"parHubVirtualNetworkName": {
"value": "anoa-eastus-workload-hub-vnet"
"value": "anoa-eastus-dev-hub-vnet"
},
"parHubVirtualNetworkResourceId": {
"value": "/subscriptions/xxxxxxxx-xxxxxx-xxxxx-xxxxxx-xxxxxx/resourceGroups/anoa-eastus-workload-hub-rg/providers/Microsoft.Network/virtualNetworks/anoa-eastus-workload-hub-vnet"
"value": "/subscriptions/<<subscriptionId>>/resourceGroups/anoa-eastus-dev-hub-rg/providers/Microsoft.Network/virtualNetworks/anoa-eastus-dev-hub-vnet"
},
"parLogAnalyticsWorkspaceResourceId": {
"value": "/subscriptions/xxxxxxxx-xxxxxx-xxxxx-xxxxxx-xxxxxx/resourcegroups/anoa-eastus-workload-logging-rg/providers/microsoft.operationalinsights/workspaces/anoa-eastus-workload-logging-log"
"value": "/subscriptions/<<subscriptionId>>/resourcegroups/anoa-eastus-dev-logging-rg/providers/microsoft.operationalinsights/workspaces/anoa-eastus-dev-logging-log"
},
"parLogAnalyticsWorkspaceName": {
"value": "anoa-eastus-workload-logging-log"
},
"parDeployddosProtectionPlan": {
"value": {
"enable": false
}
},
"value": "anoa-eastus-dev-logging-log"
},
"parWorkloadStorageAccountAccess": {
"value": {
"enableRoleAssignmentForStorageAccount": false,
Expand Down
8 changes: 4 additions & 4 deletions src/bicep/platforms/lz-platform-scca-hub-1spoke/deployment.azcli
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@

# AZ CLI
# AZ CLI Examples

# Create Base64 script value
script64=$(cat script.sh | base64)

# Hub/Spoke - Change variables to match your deployment
az deployment sub create --name deploy-hubspoke-aks-network --location EastUS --template-file deploy.bicep --parameters @parameters/deploy.parameters.json --subscription <<subscriptionId>>
az deployment sub create --name deploy-hub1spoke-network --location EastUS --template-file deploy.bicep --parameters @parameters/deploy.parameters.json --subscription <<subscriptionId>>

# Clean Up
# Delete Resource Locks - Change variables to match your deployment
Expand All @@ -26,7 +26,7 @@ az group delete -n anoa-eastus-aks-sharedservices-rg -y
az group delete -n anoa-eastus-aks-artifacts-rg -y

# Delete Deployments - Change variables to match your deployment
az deployment sub delete -n deploy-hubspoke-aks-network
az deployment sub delete -n deploy-hub1spoke-network

# AZ PowerShell
# Hub/Spoke - Change variables to match your deployment
Expand All @@ -42,4 +42,4 @@ Remove-AzResourceGroup -Name anoa-eastus-aks-sharedservices-rg
Remove-AzResourceGroup -Name anoa-eastus-aks-artifacts-rg

# Delete Deployments - Change variables to match your deployment
Remove-AzSubscriptionDeployment -Name deploy-hubspoke-aks-network
Remove-AzSubscriptionDeployment -Name deploy-hub1spoke-network
18 changes: 18 additions & 0 deletions src/bicep/workloads/wl-aks-spoke/deploy.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,12 +59,30 @@ param parWorkloadSpoke object
@description('The subscription ID for the Hub Network.')
param parHubSubscriptionId string

// Hub Resource Group Name
// (JSON Parameter)
// ---------------------------
// "parHubResourceGroupName": {
// "value": "anoa-eastus-platforms-hub-rg"
// }
@description('The resource group name for the Hub Network.')
param parHubResourceGroupName string

// Hub Virtual Network Name
// (JSON Parameter)
// ---------------------------
// "parHubResourceGroupName": {
// "value": "anoa-eastus-platforms-hub-rg"
// }
@description('The virtual network name for the Hub Network.')
param parHubVirtualNetworkName string

// Hub Virtual Network Resource Id
// (JSON Parameter)
// ---------------------------
// "parHubVirtualNetworkResourceId": {
// "value": "/subscriptions/xxxxxxxx-xxxxxx-xxxxx-xxxxxx-xxxxxx/resourceGroups/anoa-eastus-platforms-hub-rg/providers/Microsoft.Network/virtualNetworks/anoa-eastus-platforms-hub-vnet/subnets/anoa-eastus-platforms-hub-vnet"
// }
@description('The virtual network resource Id for the Hub Network.')
param parHubVirtualNetworkResourceId string

Expand Down