Skip to content

Commit

Permalink
Merge branch 'main' into users/alsehr/utl
Browse files Browse the repository at this point in the history
  • Loading branch information
AlexanderSehr authored Sep 5, 2024
2 parents 90f4f3b + af7aabd commit ba942d9
Show file tree
Hide file tree
Showing 474 changed files with 105,813 additions and 15,417 deletions.
2 changes: 2 additions & 0 deletions .gitattributes
Original file line number Diff line number Diff line change
@@ -1,2 +1,4 @@
* text=auto
*.bicep text eol=lf
*.ps1 text eol=lf
*.sh text eol=lf
2 changes: 2 additions & 0 deletions .github/CODEOWNERS
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
/scripts/ @Azure/bicep-admins @Azure/avm-core-team-technical-bicep
/avm/ @Azure/avm-core-team-technical-bicep
/avm/utilities/ @Azure/avm-core-team-technical-bicep
/avm/ptn/aca-lza/hosting-environment/ @Azure/avm-ptn-acalza-hostingenvironment-module-owners-bicep @Azure/avm-module-reviewers-bicep
/avm/ptn/ai-platform/baseline/ @Azure/avm-ptn-aiplatform-baseline-module-owners-bicep @Azure/avm-module-reviewers-bicep
/avm/ptn/authorization/policy-assignment/ @Azure/avm-ptn-authorization-policyassignment-module-owners-bicep @Azure/avm-module-reviewers-bicep
/avm/ptn/authorization/resource-role-assignment/ @Azure/avm-ptn-authorization-resourceroleassignment-module-owners-bicep @Azure/avm-module-reviewers-bicep
Expand All @@ -11,6 +12,7 @@
#/avm/ptn/avd-lza/management-plane/ @Azure/avm-ptn-avd-lza-managementplane-module-owners-bicep @Azure/avm-module-reviewers-bicep
#/avm/ptn/avd-lza/networking/ @Azure/avm-ptn-avd-lza-networking-module-owners-bicep @Azure/avm-module-reviewers-bicep
#/avm/ptn/avd-lza/session-hosts/ @Azure/avm-ptn-avd-lza-sessionhosts-module-owners-bicep @Azure/avm-module-reviewers-bicep
/avm/ptn/azd/container-apps/ @Azure/avm-ptn-azd-containerapps-module-owners-bicep @Azure/avm-module-reviewers-bicep
/avm/ptn/deployment-script/import-image-to-acr/ @Azure/avm-ptn-deploymentscript-importimagetoacr-module-owners-bicep @Azure/avm-module-reviewers-bicep
/avm/ptn/finops-toolkit/finops-hub/ @Azure/avm-ptn-finopstoolkit-finopshub-module-owners-bicep @Azure/avm-module-reviewers-bicep
/avm/ptn/lz/sub-vending/ @Azure/avm-ptn-lz-subvending-module-owners-bicep @Azure/avm-module-reviewers-bicep
Expand Down
2 changes: 2 additions & 0 deletions .github/ISSUE_TEMPLATE/avm_module_issue.yml
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ body:
description: Which existing AVM module is this issue related to?
options:
- ""
- "avm/ptn/aca-lza/hosting-environment"
- "avm/ptn/ai-platform/baseline"
- "avm/ptn/authorization/policy-assignment"
- "avm/ptn/authorization/resource-role-assignment"
Expand All @@ -46,6 +47,7 @@ body:
# - "avm/ptn/avd-lza/management-plane"
# - "avm/ptn/avd-lza/networking"
# - "avm/ptn/avd-lza/session-hosts"
- "avm/ptn/azd/container-apps"
- "avm/ptn/deployment-script/import-image-to-acr"
- "avm/ptn/finops-toolkit/finops-hub"
- "avm/ptn/lz/sub-vending"
Expand Down
37 changes: 37 additions & 0 deletions .github/actions/templates/avm-validateModuleDeployment/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,7 @@ runs:
AdditionalParameters = @{}
}
# Add custom parameters as needed
if($moduleTemplatePossibleParameters -contains 'resourceLocation') {
$functionInput.AdditionalParameters += @{
resourceLocation = '${{ steps.get-resource-location.outputs.resourceLocation }}'
Expand All @@ -219,6 +220,24 @@ runs:
}
}
# Fetch & add custom secrets, if any
# -----------------------------------
$keyVaultName = "${{ env.CI_KEY_VAULT_NAME }}"
if(-not [String]::IsNullOrEmpty($keyVaultName)) {
# Note: This action requires at least 'Key Vault Secrets User' permissions
$customKeyVaultSecrets = Get-AzKeyVaultSecret -VaultName $keyVaultName | Where-Object { $_.Name -match '^CI-.+' }
foreach($customSecret in $customKeyVaultSecrets) {
$formattedName = $customSecret.Name -replace '^CI-' # e.g. 'CI-mySecret' -> 'mySecret'
if($moduleTemplatePossibleParameters -contains $formattedName) {
Write-Verbose ('Setting value for parameter [{0}]' -f $formattedName) -Verbose
$functionInput.AdditionalParameters += @{
$formattedName = (Get-AzKeyVaultSecret -VaultName $keyVaultName -Name $customSecret.Name).SecretValue
}
}
}
}
Write-Verbose 'Invoke task with' -Verbose
Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
Expand Down Expand Up @@ -280,6 +299,24 @@ runs:
}
}
# Fetch & add custom secrets, if any
# -----------------------------------
$keyVaultName = "${{ env.CI_KEY_VAULT_NAME }}"
if(-not [String]::IsNullOrEmpty($keyVaultName)) {
# Note: This action requires at least 'Key Vault Secrets User' permissions
$customKeyVaultSecrets = Get-AzKeyVaultSecret -VaultName $keyVaultName | Where-Object { $_.Name -match '^CI-.+' }
foreach($customSecret in $customKeyVaultSecrets) {
$formattedName = $customSecret.Name -replace '^CI-' # e.g. 'CI-mySecret' -> 'mySecret'
if($moduleTemplatePossibleParameters -contains $formattedName) {
Write-Verbose ('Setting value for parameter [{0}]' -f $formattedName) -Verbose
$functionInput.AdditionalParameters += @{
$formattedName = (Get-AzKeyVaultSecret -VaultName $keyVaultName -Name $customSecret.Name).SecretValue
}
}
}
}
Write-Verbose 'Invoke task with' -Verbose
Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
Expand Down
90 changes: 90 additions & 0 deletions .github/workflows/avm.ptn.aca-lza.hosting-environment.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,90 @@
name: "avm.ptn.aca-lza.hosting-environment"

on:
workflow_dispatch:
inputs:
staticValidation:
type: boolean
description: "Execute static validation"
required: false
default: true
deploymentValidation:
type: boolean
description: "Execute deployment validation"
required: false
default: true
removeDeployment:
type: boolean
description: "Remove deployed module"
required: false
default: true
customLocation:
type: string
description: "Default location overwrite (e.g., eastus)"
required: false
default: 'northeurope'
push:
branches:
- main
- avm-ptn-acalza-hostingenvironment
paths:
- ".github/actions/templates/avm-**"
- ".github/workflows/avm.template.module.yml"
- ".github/workflows/avm.ptn.aca-lza.hosting-environment.yml"
- "avm/ptn/aca-lza/hosting-environment/**"
- "avm/utilities/pipelines/**"
- "!avm/utilities/pipelines/platform/**"
- "!*/**/README.md"

env:
modulePath: "avm/ptn/aca-lza/hosting-environment"
workflowPath: ".github/workflows/avm.ptn.aca-lza.hosting-environment.yml"

concurrency:
group: ${{ github.workflow }}

jobs:
###########################
# Initialize pipeline #
###########################
job_initialize_pipeline:
runs-on: ubuntu-latest
name: "Initialize pipeline"
steps:
- name: "Checkout"
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: "Set input parameters to output variables"
id: get-workflow-param
uses: ./.github/actions/templates/avm-getWorkflowInput
with:
workflowPath: "${{ env.workflowPath}}"
- name: "Get module test file paths"
id: get-module-test-file-paths
uses: ./.github/actions/templates/avm-getModuleTestFiles
with:
modulePath: "${{ env.modulePath }}"
outputs:
workflowInput: ${{ steps.get-workflow-param.outputs.workflowInput }}
moduleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.moduleTestFilePaths }}
psRuleModuleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.psRuleModuleTestFilePaths }}
modulePath: "${{ env.modulePath }}"

##############################
# Call reusable workflow #
##############################
call-workflow-passing-data:
name: "Run"
permissions:
id-token: write # For OIDC
contents: write # For release tags
needs:
- job_initialize_pipeline
uses: ./.github/workflows/avm.template.module.yml
with:
workflowInput: "${{ needs.job_initialize_pipeline.outputs.workflowInput }}"
moduleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.moduleTestFilePaths }}"
psRuleModuleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.psRuleModuleTestFilePaths }}"
modulePath: "${{ needs.job_initialize_pipeline.outputs.modulePath}}"
secrets: inherit
88 changes: 88 additions & 0 deletions .github/workflows/avm.ptn.azd.container-apps.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,88 @@
name: "avm.ptn.azd.container-apps"

on:
workflow_dispatch:
inputs:
staticValidation:
type: boolean
description: "Execute static validation"
required: false
default: true
deploymentValidation:
type: boolean
description: "Execute deployment validation"
required: false
default: true
removeDeployment:
type: boolean
description: "Remove deployed module"
required: false
default: true
customLocation:
type: string
description: "Default location overwrite (e.g., eastus)"
required: false
push:
branches:
- main
paths:
- ".github/actions/templates/avm-**"
- ".github/workflows/avm.template.module.yml"
- ".github/workflows/avm.ptn.azd.container-apps.yml"
- "avm/ptn/azd/container-apps/**"
- "avm/utilities/pipelines/**"
- "!avm/utilities/pipelines/platform/**"
- "!*/**/README.md"

env:
modulePath: "avm/ptn/azd/container-apps"
workflowPath: ".github/workflows/avm.ptn.azd.container-apps.yml"

concurrency:
group: ${{ github.workflow }}

jobs:
###########################
# Initialize pipeline #
###########################
job_initialize_pipeline:
runs-on: ubuntu-latest
name: "Initialize pipeline"
steps:
- name: "Checkout"
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: "Set input parameters to output variables"
id: get-workflow-param
uses: ./.github/actions/templates/avm-getWorkflowInput
with:
workflowPath: "${{ env.workflowPath}}"
- name: "Get module test file paths"
id: get-module-test-file-paths
uses: ./.github/actions/templates/avm-getModuleTestFiles
with:
modulePath: "${{ env.modulePath }}"
outputs:
workflowInput: ${{ steps.get-workflow-param.outputs.workflowInput }}
moduleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.moduleTestFilePaths }}
psRuleModuleTestFilePaths: ${{ steps.get-module-test-file-paths.outputs.psRuleModuleTestFilePaths }}
modulePath: "${{ env.modulePath }}"

##############################
# Call reusable workflow #
##############################
call-workflow-passing-data:
name: "Run"
permissions:
id-token: write # For OIDC
contents: write # For release tags
needs:
- job_initialize_pipeline
uses: ./.github/workflows/avm.template.module.yml
with:
workflowInput: "${{ needs.job_initialize_pipeline.outputs.workflowInput }}"
moduleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.moduleTestFilePaths }}"
psRuleModuleTestFilePaths: "${{ needs.job_initialize_pipeline.outputs.psRuleModuleTestFilePaths }}"
modulePath: "${{ needs.job_initialize_pipeline.outputs.modulePath}}"
secrets: inherit
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:
# Initialize pipeline #
###########################
job_initialize_pipeline:
runs-on: ubuntu-20.04
runs-on: ubuntu-latest
name: "Initialize pipeline"
steps:
- name: "Checkout"
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/avm.res.web.hosting-environment.yml
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:
# Initialize pipeline #
###########################
job_initialize_pipeline:
runs-on: ubuntu-20.04
runs-on: ubuntu-latest
name: "Initialize pipeline"
steps:
- name: "Checkout"
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/avm.template.module.yml
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ env:
ARM_MGMTGROUP_ID: "${{ secrets.ARM_MGMTGROUP_ID }}"
ARM_TENANT_ID: "${{ secrets.ARM_TENANT_ID }}"
TOKEN_NAMEPREFIX: "${{ secrets.TOKEN_NAMEPREFIX }}"
CI_KEY_VAULT_NAME: "${{ vars.CI_KEY_VAULT_NAME }}"

jobs:
#########################
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/platform.ci-tests.yml
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:
# Removal #
###############
job_run_tests:
runs-on: ubuntu-20.04
runs-on: ubuntu-latest
name: "Run CI tests"
needs:
- job_initialize_pipeline
Expand Down
43 changes: 34 additions & 9 deletions .github/workflows/platform.deployment.history.cleanup.yml
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,11 @@ jobs:
# Removal #
###############
job_cleanup_subscription_deployments:
runs-on: ubuntu-20.04
runs-on: ubuntu-latest
name: "Remove Subscription deployments"
environment: avm-validation
permissions:
id-token: write # For OIDC
needs:
- job_initialize_pipeline
if: ${{ (fromJson(needs.job_initialize_pipeline.outputs.workflowInput)).handleSubscriptionScope == 'true' }}
Expand All @@ -62,10 +65,17 @@ jobs:
- name: Set environment
uses: ./.github/actions/templates/avm-setEnvironment

# [Azure login] task(s)
# ------------------------------
# Supports both OIDC and service principal with secret
# 'creds' will be ignored if 'client-id', 'subscription-id' or 'tenant-id' is set
- name: Azure Login
uses: azure/login@v2
with:
creds: ${{ secrets.AZURE_CREDENTIALS }}
client-id: ${{ secrets.VALIDATE_CLIENT_ID }}
tenant-id: ${{ secrets.VALIDATE_TENANT_ID }}
subscription-id: ${{ secrets.VALIDATE_SUBSCRIPTION_ID }}
enable-AzPSSession: true

- name: Remove deployments
Expand All @@ -87,8 +97,11 @@ jobs:
azPSVersion: "latest"

job_cleanup_managementGroup_deployments:
runs-on: ubuntu-20.04
runs-on: ubuntu-latest
name: "Remove Management Group deployments"
environment: avm-validation
permissions:
id-token: write # For OIDC
needs:
- job_initialize_pipeline
if: ${{ (fromJson(needs.job_initialize_pipeline.outputs.workflowInput)).handleManagementGroupScope == 'true' }}
Expand All @@ -101,10 +114,17 @@ jobs:
- name: Set environment
uses: ./.github/actions/templates/avm-setEnvironment

# [Azure login] task(s)
# ------------------------------
# Supports both OIDC and service principal with secret
# 'creds' will be ignored if 'client-id', 'subscription-id' or 'tenant-id' is set
- name: Azure Login
uses: azure/login@v2
with:
creds: ${{ secrets.AZURE_CREDENTIALS }}
client-id: ${{ secrets.VALIDATE_CLIENT_ID }}
tenant-id: ${{ secrets.VALIDATE_TENANT_ID }}
subscription-id: ${{ secrets.VALIDATE_SUBSCRIPTION_ID }}
enable-AzPSSession: true

- name: Remove deployments
Expand All @@ -114,13 +134,18 @@ jobs:
# Load used functions
. (Join-Path $env:GITHUB_WORKSPACE 'avm' 'utilities' 'pipelines' 'platform' 'deploymentRemoval' 'Clear-ManagementGroupDeploymentHistory.ps1')
$functionInput = @{
ManagementGroupId = '${{ secrets.ARM_MGMTGROUP_ID }}'
maxDeploymentRetentionInDays = '${{ (fromJson(needs.job_initialize_pipeline.outputs.workflowInput)).maxDeploymentRetentionInDays }}'
}
$mgmtGroupIdInput = '${{ (fromJson(needs.job_initialize_pipeline.outputs.workflowInput)).customManagementGroupId }}'
Write-Verbose "Invoke task with" -Verbose
Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
foreach($mgmtGroupId in @('${{ secrets.ARM_MGMTGROUP_ID }}', 'bicep-lz-vending-automation-child')) {
Write-Verbose "Processing mgmtGroupId [$mgmtGroupId]" -Verbose
$functionInput = @{
ManagementGroupId = $mgmtGroupId
maxDeploymentRetentionInDays = '${{ (fromJson(needs.job_initialize_pipeline.outputs.workflowInput)).maxDeploymentRetentionInDays }}'
}
Clear-ManagementGroupDeploymentHistory @functionInput
Write-Verbose "Invoke task with" -Verbose
Write-Verbose ($functionInput | ConvertTo-Json | Out-String) -Verbose
Clear-ManagementGroupDeploymentHistory @functionInput
}
azPSVersion: "latest"
Loading

0 comments on commit ba942d9

Please sign in to comment.