Azure Migration Strategy

Azure migration strategy

Explanation page: what moves to Azure, in what order, and why rproxy is the instrument each time. Mechanics of the pieces already on Azure: Azure Hosting (eagle-public bundle, eagle-admin), Eagle Search (search backend), Eagle DEMI (DEMI).

Scope

• eagle-public is served from Azure Front Door behind rproxy. Done.
• Search is served from Azure AI Search through demi-api in both test and prod. Done.
• DEMI is the central data store for EPIC and replaces eagle-api endpoint by endpoint. DEMI has a test estate (c4b0a8-test-rg) and a prod estate (rg-demi-prod, subscription c4b0a8-prod). Resource tables: Eagle DEMI.
• eagle-api stays on OpenShift until DEMI has absorbed its surface. Porting Express + MongoDB to Azure is work that gets deleted later.
• eagle-admin is served from an Azure storage static website behind Front Door on test and prod. Dev has no admin app, and the OpenShift hosting is retired. eagle-admin calls eagle-api, which stays on OpenShift. Mechanics: Front Door Per-App Split.

Order

1. eagle-public hosting. Done.
2. Search read path. Done.
3. API surface to DEMI, read paths first. Each path is one rproxy upstream switch, revertible on its own. eagle-api pushes to DEMI. The only writer into Eagle is DEMI's sync-out worker, and it goes through eagle-api's API; nothing writes Eagle Mongo directly.
4. rproxy last. It only disappears once nothing behind it runs on OpenShift, at which point Front Door rules take over its routing.

Why rproxy is the instrument

The public hostname never moves. projects.eao.gov.bc.ca resolves to the OpenShift router and route/prod-external terminates TLS. Each cutover is one upstream value in the rproxy Helm values, reverted by one oc set env or one helm upgrade: no DNS TTL, no certificate re-issue.

What is a rewrite, not a migration

• Cosmos NoSQL is not MongoDB. Eagle's read model leans on aggregation pipelines (addProjectLookupAggrs in eagle-api/api/helpers/aggregators.js runs $lookup/$unwind against the List collection to populate ObjectId references such as applicableRegulation). There is nothing to port; the shape is redesigned around Cosmos access patterns or denormalised at write time.
• Write paths need a home first. ENGAGE pushes comment periods to DEMI (PUT /engage/engagements/:engagementId), and DEMI's sync-out writes them into eagle-api (/api/commentperiod). eagle-api cannot retire until the Eagle consumer of sync-out is removed. See ENGAGE–EAGLE Integration.

Constraints on every step

• Azure has no dev. Test (staging) and prod only. Each Azure repo has a staging workflow and a tag-driven prod workflow (see Deployment Pipeline).
• Azure Static Web Apps is ruled out. The Resource-Locations policy on bcgov-managed-lz-live has no region in common with the staticSites region list. Storage $web behind Front Door is the pattern.
• Detection is built, not inherited. rproxy stays healthy when an Azure upstream fails, so OpenShift notices nothing. Each Azure path needs an outside-in check on the public hostname that matches content, not status. eagle-public has one (alerting off); see Azure Hosting.
• CI cannot hold a broad built-in role. An ABAC condition on the c4b0a8 management group denies roleAssignments/write for Owner, Contributor and User Access Administrator. Edge Bicep deploys from eagle-edge CI under a custom role, eagle-edge-deployer-<env>.

Related

• Architecture Overview
• Reverse Proxy