New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Adding Github (actions) support #414
Open
eladiw
wants to merge
4
commits into
microsoft:master
Choose a base branch
from
eladiw:feature/add_github_support
base: master
Could not load branches
Branch not found: {{ refName }}
Could not load tags
Nothing to show
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from 2 commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
There are no files selected for viewing
8 changes: 8 additions & 0 deletions
8
infra/templates/github-actions-bootstrap-iac-cicd/.envrc.template
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,8 @@ | ||
export GITHUB_TOKEN="..." | ||
export TF_VAR_location="..." | ||
export TF_VAR_prefix="..." | ||
|
||
# Backend state configuration. Uncomment after configuring backend state. | ||
# export ARM_ACCESS_KEY="..." | ||
# export ARM_ACCOUNT_NAME="..." | ||
# export ARM_CONTAINER_NAME="..." |
34 changes: 34 additions & 0 deletions
34
infra/templates/github-actions-bootstrap-iac-cicd/.gitignore
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,34 @@ | ||
# Created by https://www.toptal.com/developers/gitignore/api/terraform | ||
# Edit at https://www.toptal.com/developers/gitignore?templates=terraform | ||
|
||
### Terraform ### | ||
# Local .terraform directories | ||
**/.terraform/* | ||
|
||
# .tfstate files | ||
*.tfstate | ||
*.tfstate.* | ||
|
||
# Crash log files | ||
crash.log | ||
|
||
# Ignore any .tfvars files that are generated automatically for each Terraform run. Most | ||
# .tfvars files are managed as part of configuration and so should be included in | ||
# version control. | ||
# | ||
# example.tfvars | ||
|
||
# Ignore override files as they are usually used to override resources locally and so | ||
# are not checked in | ||
override.tf | ||
override.tf.json | ||
*_override.tf | ||
*_override.tf.json | ||
|
||
# Include override files you do wish to add to version control using negated pattern | ||
# !example_override.tf | ||
|
||
# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan | ||
# example: *tfplan* | ||
|
||
# End of https://www.toptal.com/developers/gitignore/api/terraform |
192 changes: 192 additions & 0 deletions
192
infra/templates/github-actions-bootstrap-iac-cicd/README.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,192 @@ | ||
# Bootstrap for Terraform deployments through Github actions into Azure | ||
|
||
This directory contains [Terraform](https://www.terraform.io/) templates that can bootstrap Azure and Github resources in a way that enables running robust CICD of [Terraform](https://www.terraform.io/) templates using [Github CICD](https://github.com/features/actions). After applying this template, automated CI of terraform deployments should **just work**. | ||
|
||
> **Note**: This template is intended to be used alongside the CICD pipeline for infrastructure using Github. | ||
|
||
At a high level, this template aims to: | ||
|
||
* Deploy Azure Dependencies required for automated CICD of Terraform deployments | ||
* Configure variables in Github required for automated CICD of Terraform deployments | ||
* Configure dependencies for each a multistage (`dev`, `integration`, `prod`, etc...) Terraform deployment | ||
|
||
> **Note**: This template only sets up the **dependencies** needed to do a production ready infrastructure deployment, such as backend state, deployment credentials, Azure Contianer Reigstry and Github variables. | ||
|
||
There are many things deployed by this template, including: | ||
|
||
* Backend state storage account | ||
* Backend state containers for this deployment | ||
* ACR for storing docker images | ||
* Github variables needed for all deployments | ||
* For each deployment environment | ||
* Backend state container | ||
* Service principal used for deployments to that environment | ||
* Resource group | ||
* Role based security | ||
|
||
## Identities/Credentials Configured | ||
|
||
This template will generate some credentials, which are enumarated blow: | ||
|
||
| Description | Reason | Notes | | ||
| --- | --- | --- | | ||
| ACR Push/Pull | Needed by the pipeline that builds the base image used by all of the infrastructure CICD in Github | N/A | | ||
| Environment Deploy | Needed by each environment to execute a deployment of resources into Azure | One generated for each environment | | ||
|
||
## Usage | ||
|
||
There are a few use cases for the code in this repository. The sections below outline the usage for each of those cases | ||
|
||
### First Time Setup | ||
|
||
Among the many resources provisioned by this template is the [Backend Configuration](https://www.terraform.io/docs/backends/index.html) that hosts the [Terraform State](https://www.terraform.io/docs/state/index.html) for this template, as well as the state for each deployment. | ||
|
||
Because of this, we cannot have the backend state configured for the initial deployment of this template. These steps will take you through the following: | ||
|
||
* Initial deployment of this template | ||
* Enable the backend state for this deployment | ||
|
||
#### Requirements | ||
|
||
* `terraform` will need to be installed. Version `v0.12.28` or newer is recommended | ||
* A shell environment, preferrably bash | ||
* A Github personal access token. Instructions for generating one can be found [here](https://docs.github.com/en/github/authenticating-to-github/keeping-your-account-and-data-secure/creating-a-personal-access-token). The token will need the `workflow` permission. | ||
* An Azure subscription | ||
|
||
#### Deployment Steps | ||
|
||
**Disable backend state** | ||
|
||
For the first deployment, the contents of `backend.tf` will need to be commented out. Don't worry -- we'll uncomment this later. | ||
|
||
**Configure your environment** | ||
```bash | ||
# Required to configure variables in Github | ||
export GITHUB_TOKEN="..." | ||
|
||
# The location in which to provision Azure resources | ||
export TF_VAR_location="..." | ||
|
||
# The prefix used for naming resources in Azure | ||
export TF_VAR_prefix="..." | ||
|
||
# Log into the Azure CLI | ||
az login | ||
|
||
# Set your default subscription - this will dictate where resources will be provisioned | ||
az account set --subscription "<your subscription ID>" | ||
``` | ||
|
||
**Run the deployment** | ||
|
||
> **Note**: If you see a log about `Initializing the backend...`, make sure that you followed the steps to disable the backend state. | ||
|
||
```bash | ||
# Initialize the Terraform environment | ||
terraform init | ||
|
||
# See what the deployment will do. No changes will be applied, but you can review the changes that will be applied in the next step | ||
terraform plan | ||
|
||
# Deploy the changes | ||
terraform apply | ||
``` | ||
|
||
**Enable backend state** | ||
|
||
Enabling backend state will store the deployment state in Azure. This will allow others to run the deployment without you needing to worry about the state configuration. | ||
|
||
Start by uncommenting the contents of `backend.tf`, then run the following: | ||
|
||
```bash | ||
export ARM_ACCESS_KEY=$(terraform output backend-state-account-key) | ||
export ARM_ACCOUNT_NAME=$(terraform output backend-state-account-name) | ||
export ARM_CONTAINER_NAME=$(terraform output backend-state-bootstrap-container-name) | ||
|
||
# Initialize the deployment with the backend | ||
terraform init -backend-config "storage_account_name=${ARM_ACCOUNT_NAME}" -backend-config "container_name=${ARM_CONTAINER_NAME}" | ||
``` | ||
|
||
You should see something along the lines of the following, to which you want to answer `yes`: | ||
|
||
```bash | ||
Do you want to copy existing state to the new backend? | ||
``` | ||
|
||
If things work, you will see the following message and the state file should end up in Azure: | ||
|
||
```bash | ||
Successfully configured the backend "azurerm"! Terraform will automatically | ||
use this backend unless the backend configuration changes. | ||
``` | ||
|
||
### Deploying the Infrastructure | ||
|
||
Now that Azure and Github have been configured to support the Terraform deployment, you will need to do the following to actually deploy the environment. | ||
|
||
**Trigger IAC Pipeline** | ||
|
||
You are now ready to kick off a deployment of the IAC pipeline! You can do this through the Github actions UI. | ||
|
||
### Rotate Service Principal Passwords | ||
|
||
If the need arises to rotate the credentials for any of the generated service principals, the following command can be used to quickly rotate the credentials and also update all configuration in Github: | ||
|
||
```bash | ||
# configure environment (.envrc.template) | ||
|
||
az login | ||
az account set --subscription "<your subscription ID>" | ||
|
||
terraform init -backend-config "storage_account_name=${ARM_ACCOUNT_NAME}" -backend-config "container_name=${ARM_CONTAINER_NAME}" | ||
|
||
# `taint` all passwords - this triggers Terraform to regenerate these and update all dependent configuration | ||
terraform state list | grep random_password | xargs -L 1 terraform taint | ||
terraform plan | ||
|
||
# Note: this command might fail due to the rapid create/delete on Azure resources. If it fails, re-running it | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Curious on why this would fail? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. copied as is from the Gitlab readme file. I think this can be removed from both versions. wdyt? |
||
# should solve the issue | ||
terraform apply | ||
``` | ||
|
||
Done! | ||
|
||
|
||
### Adding a new environment | ||
|
||
Now that Azure and Github have been configured to deploy resources through Terraform, you can easily configure Azure and Github to support new application stages (environments) by using the `environment` module. | ||
|
||
> **Note**: This will only set up Azure and Github to support a new environment. The environment will need to be deployed using the infrastructure deployments project (not covered here). | ||
|
||
This guide will take you through configuring Azure and Github to support a new `pre-prod` environment. | ||
|
||
**Add a new environment** | ||
|
||
You will need to open `azure.tf` to configure a new environment. A new environment can be configured by adding the following to the bottom of the file: | ||
|
||
```hcl | ||
module "preprod" { | ||
source = "./environment" | ||
acr_id = azurerm_container_registry.acr.id | ||
environment_name = "preprod" | ||
location = var.location | ||
subscription_id = data.azurerm_client_config.current.subscription_id | ||
backend_storage_account_name = azurerm_storage_account.ci.name | ||
prefix = var.prefix | ||
} | ||
``` | ||
|
||
You will then need to execute the following: | ||
|
||
```bash | ||
# configure environment (.envrc.template) | ||
|
||
az login | ||
az account set --subscription "<your subscription ID>" | ||
|
||
terraform init -backend-config "storage_account_name=${ARM_ACCOUNT_NAME}" -backend-config "container_name=${ARM_CONTAINER_NAME}" | ||
terraform plan | ||
terraform apply | ||
``` | ||
|
||
Done! |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,39 @@ | ||
resource "azurerm_container_registry" "acr" { | ||
name = format("acr%s", random_string.rand.result) | ||
resource_group_name = azurerm_resource_group.ci.name | ||
location = azurerm_resource_group.ci.location | ||
sku = "Basic" | ||
} | ||
|
||
resource "azuread_application" "acr" { | ||
name = format("acr-push-%s", random_string.rand.result) | ||
} | ||
|
||
resource "azuread_service_principal" "acr" { | ||
application_id = azuread_application.acr.application_id | ||
} | ||
|
||
resource "random_password" "acr" { | ||
length = 35 | ||
upper = true | ||
lower = true | ||
special = false | ||
} | ||
|
||
resource "azuread_service_principal_password" "acr" { | ||
service_principal_id = azuread_service_principal.acr.id | ||
value = random_password.acr.result | ||
end_date_relative = "2400h" | ||
} | ||
|
||
resource "azurerm_role_assignment" "acr_push" { | ||
scope = azurerm_container_registry.acr.id | ||
role_definition_name = "AcrPush" | ||
principal_id = azuread_service_principal.acr.id | ||
} | ||
|
||
resource "azurerm_role_assignment" "acr_pull" { | ||
scope = azurerm_container_registry.acr.id | ||
role_definition_name = "AcrPull" | ||
principal_id = azuread_service_principal.acr.id | ||
} |
59 changes: 59 additions & 0 deletions
59
infra/templates/github-actions-bootstrap-iac-cicd/azure.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,59 @@ | ||
resource "random_string" "rand" { | ||
length = 4 | ||
special = false | ||
number = false | ||
upper = false | ||
} | ||
|
||
resource "azurerm_resource_group" "ci" { | ||
name = format("rg-%s-ci", var.prefix) | ||
location = var.location | ||
} | ||
|
||
resource "azurerm_storage_account" "ci" { | ||
name = format("backendstate%s", random_string.rand.result) | ||
resource_group_name = azurerm_resource_group.ci.name | ||
location = azurerm_resource_group.ci.location | ||
|
||
min_tls_version = "TLS1_2" | ||
account_tier = "Standard" | ||
account_replication_type = "LRS" | ||
} | ||
|
||
resource "azurerm_storage_container" "tfstate" { | ||
name = "tfstate-terraform-bootstrap" | ||
storage_account_name = azurerm_storage_account.ci.name | ||
container_access_type = "private" | ||
} | ||
|
||
data "azurerm_client_config" "current" {} | ||
|
||
module "dev" { | ||
source = "./environment" | ||
acr_id = azurerm_container_registry.acr.id | ||
environment_name = "dev" | ||
location = var.location | ||
subscription_id = data.azurerm_client_config.current.subscription_id | ||
backend_storage_account_name = azurerm_storage_account.ci.name | ||
prefix = var.prefix | ||
} | ||
|
||
module "integration" { | ||
source = "./environment" | ||
acr_id = azurerm_container_registry.acr.id | ||
environment_name = "integration" | ||
location = var.location | ||
subscription_id = data.azurerm_client_config.current.subscription_id | ||
backend_storage_account_name = azurerm_storage_account.ci.name | ||
prefix = var.prefix | ||
} | ||
|
||
module "prod" { | ||
source = "./environment" | ||
acr_id = azurerm_container_registry.acr.id | ||
environment_name = "prod" | ||
location = var.location | ||
subscription_id = data.azurerm_client_config.current.subscription_id | ||
backend_storage_account_name = azurerm_storage_account.ci.name | ||
prefix = var.prefix | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,5 @@ | ||
terraform { | ||
backend "azurerm" { | ||
key = "tf-bootstrap.tfstate" | ||
} | ||
} |
44 changes: 44 additions & 0 deletions
44
infra/templates/github-actions-bootstrap-iac-cicd/environment/azure.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,44 @@ | ||
locals { | ||
full_name = format("%s-%s", var.prefix, var.environment_name) | ||
} | ||
|
||
resource "azurerm_resource_group" "rg" { | ||
location = var.location | ||
name = "rg-${local.full_name}" | ||
tags = { | ||
environment = var.environment_name | ||
} | ||
} | ||
|
||
resource "azuread_application" "app" { | ||
name = "sp-${local.full_name}" | ||
} | ||
|
||
resource "azuread_service_principal" "sp" { | ||
application_id = azuread_application.app.application_id | ||
} | ||
|
||
resource "random_password" "sp" { | ||
length = 35 | ||
upper = true | ||
lower = true | ||
special = false | ||
} | ||
|
||
resource "azuread_service_principal_password" "sp" { | ||
service_principal_id = azuread_service_principal.sp.id | ||
value = random_password.sp.result | ||
end_date_relative = "2400h" | ||
} | ||
|
||
resource "azurerm_role_assignment" "rg-owner" { | ||
scope = azurerm_resource_group.rg.id | ||
role_definition_name = "Owner" | ||
principal_id = azuread_service_principal.sp.id | ||
} | ||
|
||
resource "azurerm_storage_container" "tfstate" { | ||
name = format("tfstate-%s", var.environment_name) | ||
storage_account_name = var.backend_storage_account_name | ||
container_access_type = "private" | ||
} |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
AFAICT, the terraform template that's being run is also creating an AAD App and SP. If that's the case then you may want to mention the developer will need owner level permissions on the az sub.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
updated