adding Github (actions) support

infra/templates/github-actions-bootstrap-iac-cicd/.envrc.template

@@ -0,0 +1,8 @@
+export GITHUB_TOKEN="..."
+export TF_VAR_location="..."
+export TF_VAR_prefix="..."
+
+# Backend state configuration. Uncomment after configuring backend state.
+# export ARM_ACCESS_KEY="..."
+# export ARM_ACCOUNT_NAME="..."
+# export ARM_CONTAINER_NAME="..."

infra/templates/github-actions-bootstrap-iac-cicd/.gitignore

@@ -0,0 +1,34 @@
+# Created by https://www.toptal.com/developers/gitignore/api/terraform
+# Edit at https://www.toptal.com/developers/gitignore?templates=terraform
+
+### Terraform ###
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+
+# Ignore any .tfvars files that are generated automatically for each Terraform run. Most
+# .tfvars files are managed as part of configuration and so should be included in
+# version control.
+#
+# example.tfvars
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# End of https://www.toptal.com/developers/gitignore/api/terraform

infra/templates/github-actions-bootstrap-iac-cicd/README.md

@@ -0,0 +1,192 @@
+# Bootstrap for Terraform deployments through Github actions into Azure
+
+This directory contains [Terraform](https://www.terraform.io/) templates that can bootstrap Azure and Github resources in a way that enables running robust CICD of [Terraform](https://www.terraform.io/) templates using [Github CICD](https://github.com/features/actions). After applying this template, automated CI of terraform deployments should **just work**.
+
+> **Note**: This template is intended to be used alongside the CICD pipeline for infrastructure using Github.
+
+At a high level, this template aims to:
+
+* Deploy Azure Dependencies required for automated CICD of Terraform deployments
+* Configure variables in Github required for automated CICD of Terraform deployments
+* Configure dependencies for each a multistage (`dev`, `integration`, `prod`, etc...) Terraform deployment
+
+> **Note**: This template only sets up the **dependencies** needed to do a production ready infrastructure deployment, such as backend state, deployment credentials, Azure Contianer Reigstry and Github variables.
+
+There are many things deployed by this template, including:
+
+* Backend state storage account
+* Backend state containers for this deployment
+* ACR for storing docker images
+* Github variables needed for all deployments
+* For each deployment environment
+  * Backend state container
+  * Service principal used for deployments to that environment
+  * Resource group
+  * Role based security
+
+## Identities/Credentials Configured
+
+This template will generate some credentials, which are enumarated blow:
+
+| Description | Reason | Notes |
+| ---         | ---    | ---   |
+| ACR Push/Pull | Needed by the pipeline that builds the base image used by all of the infrastructure CICD in Github | N/A |
+| Environment Deploy | Needed by each environment to execute a deployment of resources into Azure | One generated for each environment |
+
+## Usage
+
+There are a few use cases for the code in this repository. The sections below outline the usage for each of those cases
+
+### First Time Setup
+
+Among the many resources provisioned by this template is the [Backend Configuration](https://www.terraform.io/docs/backends/index.html) that hosts the [Terraform State](https://www.terraform.io/docs/state/index.html) for this template, as well as the state for each deployment.
+
+Because of this, we cannot have the backend state configured for the initial deployment of this template. These steps will take you through the following:
+
+* Initial deployment of this template
+* Enable the backend state for this deployment
+
+#### Requirements
+
+* `terraform` will need to be installed. Version `v0.12.28` or newer is recommended
+* A shell environment, preferrably bash
+* A Github personal access token. Instructions for generating one can be found [here](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token). The token will need the `workflow` permission.
+* An Azure subscription
+
+#### Deployment Steps
+
+**Disable backend state**
+
+For the first deployment, the contents of `backend.tf` will need to be commented out. Don't worry -- we'll uncomment this later.
+
+**Configure your environment**
+```bash
+# Required to configure variables in Github
+export GITHUB_TOKEN="..."
+
+# The location in which to provision Azure resources
+export TF_VAR_location="..."
+
+# The prefix used for naming resources in Azure
+export TF_VAR_prefix="..."
+
+# Log into the Azure CLI
+az login
+
+# Set your default subscription - this will dictate where resources will be provisioned
+az account set --subscription "<your subscription ID>"
+```
+
+**Run the deployment**
+
+> **Note**: If you see a log about `Initializing the backend...`, make sure that you followed the steps to disable the backend state.
+
+```bash
+# Initialize the Terraform environment
+terraform init
+
+# See what the deployment will do. No changes will be applied, but you can review the changes that will be applied in the next step
+terraform plan
+
+# Deploy the changes
+terraform apply
+```
+
+**Enable backend state**
+
+Enabling backend state will store the deployment state in Azure. This will allow others to run the deployment without you needing to worry about the state configuration.
+
+Start by uncommenting the contents of `backend.tf`, then run the following:
+
+```bash
+export ARM_ACCESS_KEY=$(terraform output backend-state-account-key)
+export ARM_ACCOUNT_NAME=$(terraform output backend-state-account-name)
+export ARM_CONTAINER_NAME=$(terraform output backend-state-bootstrap-container-name)
+
+# Initialize the deployment with the backend
+terraform init -backend-config "storage_account_name=${ARM_ACCOUNT_NAME}" -backend-config "container_name=${ARM_CONTAINER_NAME}"
+```
+
+You should see something along the lines of the following, to which you want to answer `yes`:
+
+```bash
+Do you want to copy existing state to the new backend?
+```
+
+If things work, you will see the following message and the state file should end up in Azure:
+
+```bash
+Successfully configured the backend "azurerm"! Terraform will automatically
+use this backend unless the backend configuration changes.
+```
+
+### Deploying the Infrastructure
+
+Now that Azure and Github have been configured to support the Terraform deployment, you will need to do the following to actually deploy the environment.
+
+**Trigger IAC Pipeline**
+
+You are now ready to kick off a deployment of the IAC pipeline! You can do this through the Github actions UI.
+
+### Rotate Service Principal Passwords
+
+If the need arises to rotate the credentials for any of the generated service principals, the following command can be used to quickly rotate the credentials and also update all configuration in Github:
+
+```bash
+# configure environment (.envrc.template)
+
+az login
+az account set --subscription "<your subscription ID>"
+
+terraform init -backend-config "storage_account_name=${ARM_ACCOUNT_NAME}" -backend-config "container_name=${ARM_CONTAINER_NAME}"
+
+# `taint` all passwords - this triggers Terraform to regenerate these and update all dependent configuration
+terraform state list | grep random_password | xargs -L 1 terraform taint
+terraform plan
+
+# Note: this command might fail due to the rapid create/delete on Azure resources. If it fails, re-running it
+#       should solve the issue
+terraform apply
+```
+
+Done!
+
+
+### Adding a new environment
+
+Now that Azure and Github have been configured to deploy resources through Terraform, you can easily configure Azure and Github to support new application stages (environments) by using the `environment` module.
+
+> **Note**: This will only set up Azure and Github to support a new environment. The environment will need to be deployed using the infrastructure deployments project (not covered here).
+
+This guide will take you through configuring Azure and Github to support a new `pre-prod` environment.
+
+**Add a new environment**
+
+You will need to open `azure.tf` to configure a new environment. A new environment can be configured by adding the following to the bottom of the file:
+
+```hcl
+module "preprod" {
+  source                        = "./environment"
+  acr_id                        = azurerm_container_registry.acr.id
+  environment_name              = "preprod"
+  location                      = var.location
+  subscription_id               = data.azurerm_client_config.current.subscription_id
+  backend_storage_account_name  = azurerm_storage_account.ci.name
+  prefix                        = var.prefix
+}
+```
+
+You will then need to execute the following:
+
+```bash
+# configure environment (.envrc.template)
+
+az login
+az account set --subscription "<your subscription ID>"
+
+terraform init -backend-config "storage_account_name=${ARM_ACCOUNT_NAME}" -backend-config "container_name=${ARM_CONTAINER_NAME}"
+terraform plan
+terraform apply
+```
+
+Done!

infra/templates/github-actions-bootstrap-iac-cicd/acr.tf

@@ -0,0 +1,39 @@
+resource "azurerm_container_registry" "acr" {
+  name                = format("acr%s", random_string.rand.result)
+  resource_group_name = azurerm_resource_group.ci.name
+  location            = azurerm_resource_group.ci.location
+  sku                 = "Basic"
+}
+
+resource "azuread_application" "acr" {
+  name = format("acr-push-%s", random_string.rand.result)
+}
+
+resource "azuread_service_principal" "acr" {
+  application_id = azuread_application.acr.application_id
+}
+
+resource "random_password" "acr" {
+  length  = 35
+  upper   = true
+  lower   = true
+  special = false
+}
+
+resource "azuread_service_principal_password" "acr" {
+  service_principal_id = azuread_service_principal.acr.id
+  value                = random_password.acr.result
+  end_date_relative    = "2400h"
+}
+
+resource "azurerm_role_assignment" "acr_push" {
+  scope                = azurerm_container_registry.acr.id
+  role_definition_name = "AcrPush"
+  principal_id         = azuread_service_principal.acr.id
+}
+
+resource "azurerm_role_assignment" "acr_pull" {
+  scope                = azurerm_container_registry.acr.id
+  role_definition_name = "AcrPull"
+  principal_id         = azuread_service_principal.acr.id
+}

infra/templates/github-actions-bootstrap-iac-cicd/azure.tf

@@ -0,0 +1,59 @@
+resource "random_string" "rand" {
+  length  = 4
+  special = false
+  number  = false
+  upper   = false
+}
+
+resource "azurerm_resource_group" "ci" {
+  name     = format("rg-%s-ci", var.prefix)
+  location = var.location
+}
+
+resource "azurerm_storage_account" "ci" {
+  name                = format("backendstate%s", random_string.rand.result)
+  resource_group_name = azurerm_resource_group.ci.name
+  location            = azurerm_resource_group.ci.location
+
+  min_tls_version          = "TLS1_2"
+  account_tier             = "Standard"
+  account_replication_type = "LRS"
+}
+
+resource "azurerm_storage_container" "tfstate" {
+  name                  = "tfstate-terraform-bootstrap"
+  storage_account_name  = azurerm_storage_account.ci.name
+  container_access_type = "private"
+}
+
+data "azurerm_client_config" "current" {}
+
+module "dev" {
+  source                       = "./environment"
+  acr_id                       = azurerm_container_registry.acr.id
+  environment_name             = "dev"
+  location                     = var.location
+  subscription_id              = data.azurerm_client_config.current.subscription_id
+  backend_storage_account_name = azurerm_storage_account.ci.name
+  prefix                       = var.prefix
+}
+
+module "integration" {
+  source                        = "./environment"
+  acr_id                        = azurerm_container_registry.acr.id
+  environment_name              = "integration"
+  location                      = var.location
+  subscription_id               = data.azurerm_client_config.current.subscription_id
+  backend_storage_account_name  = azurerm_storage_account.ci.name
+  prefix                        = var.prefix
+}
+
+module "prod" {
+  source                        = "./environment"
+  acr_id                        = azurerm_container_registry.acr.id
+  environment_name              = "prod"
+  location                      = var.location
+  subscription_id               = data.azurerm_client_config.current.subscription_id
+  backend_storage_account_name  = azurerm_storage_account.ci.name
+  prefix                        = var.prefix
+}

infra/templates/github-actions-bootstrap-iac-cicd/backend.tf

@@ -0,0 +1,5 @@
+terraform {
+  backend "azurerm" {
+    key = "tf-bootstrap.tfstate"
+  }
+}

infra/templates/github-actions-bootstrap-iac-cicd/environment/azure.tf

@@ -0,0 +1,44 @@
+locals {
+  full_name = format("%s-%s", var.prefix, var.environment_name)
+}
+
+resource "azurerm_resource_group" "rg" {
+  location = var.location
+  name     = "rg-${local.full_name}"
+  tags = {
+    environment = var.environment_name
+  }
+}
+
+resource "azuread_application" "app" {
+  name = "sp-${local.full_name}"
+}
+
+resource "azuread_service_principal" "sp" {
+  application_id = azuread_application.app.application_id
+}
+
+resource "random_password" "sp" {
+  length  = 35
+  upper   = true
+  lower   = true
+  special = false
+}
+
+resource "azuread_service_principal_password" "sp" {
+  service_principal_id = azuread_service_principal.sp.id
+  value                = random_password.sp.result
+  end_date_relative    = "2400h"
+}
+
+resource "azurerm_role_assignment" "rg-owner" {
+  scope                = azurerm_resource_group.rg.id
+  role_definition_name = "Owner"
+  principal_id         = azuread_service_principal.sp.id
+}
+
+resource "azurerm_storage_container" "tfstate" {
+  name                  = format("tfstate-%s", var.environment_name)
+  storage_account_name  = var.backend_storage_account_name
+  container_access_type = "private"
+}