Merge branch 'main' into marrobi/issue4099

microsoft · Nov 13, 2024 · ddee1a7 · ddee1a7
2 parents 77fafe8 + 158dce1
commit ddee1a7
Show file tree

Hide file tree

Showing 19 changed files with 67 additions and 59 deletions.
diff --git a/Makefile b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: bootstrap-init mgmt-deploy mgmt-destroy build-api-image push-api-image deploy-tre destroy-tre letsencrypt
+.PHONY: bootstrap-init mgmt-deploy mgmt-destroy build-api-image push-api-image tre-deploy tre-destroy letsencrypt
 .DEFAULT_GOAL := help
 
 SHELL:=/bin/bash

diff --git a/core/terraform/.terraform.lock.hcl b/core/terraform/.terraform.lock.hcl
diff --git a/core/terraform/airlock/service_bus.tf b/core/terraform/airlock/service_bus.tf
@@ -3,35 +3,35 @@ resource "azurerm_servicebus_queue" "step_result" {
   name         = local.step_result_queue_name
   namespace_id = var.airlock_servicebus.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 resource "azurerm_servicebus_queue" "status_changed" {
   name         = local.status_changed_queue_name
   namespace_id = var.airlock_servicebus.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 resource "azurerm_servicebus_queue" "scan_result" {
   name         = local.scan_result_queue_name
   namespace_id = var.airlock_servicebus.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 resource "azurerm_servicebus_queue" "data_deletion" {
   name         = local.data_deletion_queue_name
   namespace_id = var.airlock_servicebus.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 resource "azurerm_servicebus_topic" "blob_created" {
   name         = local.blob_created_topic_name
   namespace_id = var.airlock_servicebus.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 resource "azurerm_servicebus_subscription" "airlock_processor" {

diff --git a/core/terraform/api-webapp.tf b/core/terraform/api-webapp.tf
@@ -85,8 +85,8 @@ resource "azurerm_linux_web_app" "api" {
     ftps_state                                    = "Disabled"
 
     application_stack {
-      docker_image     = "${local.docker_registry_server}/${var.api_image_repository}"
-      docker_image_tag = local.version
+      docker_registry_url = "https://${local.docker_registry_server}"
+      docker_image_name   = "${var.api_image_repository}:${local.version}"
     }
 
     cors {

diff --git a/core/terraform/cosmos_mongo.tf b/core/terraform/cosmos_mongo.tf
@@ -1,12 +1,12 @@
 resource "azurerm_cosmosdb_account" "mongo" {
-  name                      = "cosmos-mongo-${var.tre_id}"
-  location                  = azurerm_resource_group.core.location
-  resource_group_name       = azurerm_resource_group.core.name
-  offer_type                = "Standard"
-  kind                      = "MongoDB"
-  enable_automatic_failover = false
-  mongo_server_version      = 4.2
-  ip_range_filter           = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
+  name                       = "cosmos-mongo-${var.tre_id}"
+  location                   = azurerm_resource_group.core.location
+  resource_group_name        = azurerm_resource_group.core.name
+  offer_type                 = "Standard"
+  kind                       = "MongoDB"
+  automatic_failover_enabled = false
+  mongo_server_version       = 4.2
+  ip_range_filter            = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
 
   capabilities {
     name = "EnableServerless"
@@ -93,7 +93,7 @@ resource "azurerm_private_endpoint" "mongo" {
 
 resource "azurerm_key_vault_secret" "cosmos_mongo_connstr" {
   name         = "porter-db-connection-string"
-  value        = azurerm_cosmosdb_account.mongo.connection_strings[0]
+  value        = azurerm_cosmosdb_account.mongo.primary_mongodb_connection_string
   key_vault_id = azurerm_key_vault.kv.id
   tags         = local.tre_core_tags
   depends_on = [

diff --git a/core/terraform/json-to-env.sh b/core/terraform/json-to-env.sh
@@ -29,6 +29,10 @@ jq -r '
             "path": "keyvault_uri",
             "env_var": "KEYVAULT_URI"
         },
+        {
+            "path": "keyvault_resource_id",
+            "env_var": "KEYVAULT_RESOURCE_ID"
+        },
         {
             "path": "azure_tre_fqdn",
             "env_var": "FQDN"

diff --git a/core/terraform/network/network.tf b/core/terraform/network/network.tf
@@ -27,7 +27,7 @@ resource "azurerm_subnet" "app_gw" {
   virtual_network_name                          = azurerm_virtual_network.core.name
   resource_group_name                           = var.resource_group_name
   address_prefixes                              = [local.app_gw_subnet_address_prefix]
-  private_endpoint_network_policies_enabled     = false
+  private_endpoint_network_policies             = "Disabled"
   private_link_service_network_policies_enabled = true
   depends_on                                    = [azurerm_subnet.azure_firewall]
 }
@@ -37,7 +37,7 @@ resource "azurerm_subnet" "web_app" {
   virtual_network_name                          = azurerm_virtual_network.core.name
   resource_group_name                           = var.resource_group_name
   address_prefixes                              = [local.web_app_subnet_address_prefix]
-  private_endpoint_network_policies_enabled     = false
+  private_endpoint_network_policies             = "Disabled"
   private_link_service_network_policies_enabled = true
   depends_on                                    = [azurerm_subnet.app_gw]
 
@@ -57,8 +57,8 @@ resource "azurerm_subnet" "shared" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.shared_services_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.web_app]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.web_app]
 }
 
 resource "azurerm_subnet" "resource_processor" {
@@ -67,8 +67,8 @@ resource "azurerm_subnet" "resource_processor" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.resource_processor_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.shared]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.shared]
 }
 
 resource "azurerm_subnet" "airlock_processor" {
@@ -77,8 +77,8 @@ resource "azurerm_subnet" "airlock_processor" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.airlock_processor_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.resource_processor]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.resource_processor]
 
   delegation {
     name = "delegation"
@@ -100,8 +100,8 @@ resource "azurerm_subnet" "airlock_notification" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.airlock_notifications_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.airlock_processor]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.airlock_processor]
 
   delegation {
     name = "delegation"
@@ -120,8 +120,8 @@ resource "azurerm_subnet" "airlock_storage" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.airlock_storage_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.airlock_notification]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.airlock_notification]
 }
 
 resource "azurerm_subnet" "airlock_events" {
@@ -130,8 +130,8 @@ resource "azurerm_subnet" "airlock_events" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.airlock_events_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.airlock_storage]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.airlock_storage]
 
   # Eventgrid CAN'T send messages over private endpoints, hence we need to allow service endpoints to the service bus
   # We are using service endpoints + managed identity to send these messaages

diff --git a/core/terraform/outputs.tf b/core/terraform/outputs.tf
@@ -30,6 +30,10 @@ output "keyvault_uri" {
   value = azurerm_key_vault.kv.vault_uri
 }
 
+output "keyvault_resource_id" {
+  value = azurerm_key_vault.kv.id
+}
+
 output "service_bus_resource_id" {
   value = azurerm_servicebus_namespace.sb.id
 }
@@ -59,7 +63,7 @@ output "state_store_endpoint" {
 }
 
 output "cosmosdb_mongo_endpoint" {
-  value     = azurerm_cosmosdb_account.mongo.connection_strings[0]
+  value     = azurerm_cosmosdb_account.mongo.primary_sql_connection_string
   sensitive = true
 }
 

diff --git a/core/terraform/servicebus.tf b/core/terraform/servicebus.tf
@@ -36,8 +36,8 @@ resource "azurerm_servicebus_queue" "workspacequeue" {
   name         = "workspacequeue"
   namespace_id = azurerm_servicebus_namespace.sb.id
 
-  enable_partitioning = false
-  requires_session    = true # use sessions here to make sure updates to each resource happen in serial, in order
+  partitioning_enabled = false
+  requires_session     = true # use sessions here to make sure updates to each resource happen in serial, in order
 }
 
 resource "azurerm_servicebus_queue" "service_bus_deployment_status_update_queue" {
@@ -48,8 +48,8 @@ resource "azurerm_servicebus_queue" "service_bus_deployment_status_update_queue"
   # Cosmos is the final destination of the messages where 2048 is the limit.
   max_message_size_in_kilobytes = 2048 # default=1024
 
-  enable_partitioning = false
-  requires_session    = true
+  partitioning_enabled = false
+  requires_session     = true
 }
 
 resource "azurerm_private_dns_zone" "servicebus" {

diff --git a/core/terraform/statestore.tf b/core/terraform/statestore.tf
@@ -1,12 +1,12 @@
 resource "azurerm_cosmosdb_account" "tre_db_account" {
-  name                      = "cosmos-${var.tre_id}"
-  location                  = azurerm_resource_group.core.location
-  resource_group_name       = azurerm_resource_group.core.name
-  offer_type                = "Standard"
-  kind                      = "GlobalDocumentDB"
-  enable_automatic_failover = false
-  ip_range_filter           = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
-  tags                      = local.tre_core_tags
+  name                       = "cosmos-${var.tre_id}"
+  location                   = azurerm_resource_group.core.location
+  resource_group_name        = azurerm_resource_group.core.name
+  offer_type                 = "Standard"
+  kind                       = "GlobalDocumentDB"
+  automatic_failover_enabled = false
+  ip_range_filter            = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
+  tags                       = local.tre_core_tags
 
   dynamic "capabilities" {
     # We can't change an existing cosmos

diff --git a/devops/scripts/setup_local_debugging.sh b/devops/scripts/setup_local_debugging.sh
@@ -15,6 +15,7 @@ private_env_path="./core/private.env"
 : "${EVENT_GRID_AIRLOCK_NOTIFICATION_TOPIC_RESOURCE_ID?"Check EVENT_GRID_AIRLOCK_NOTIFICATION_TOPIC_RESOURCE_ID is defined in ${private_env_path}"}"
 : "${KEYVAULT_URI?"Check KEYVAULT_URI is defined in ${private_env_path}"}"
 : "${KEYVAULT?"Check KEYVAULT is defined in ${private_env_path}"}"
+: "${KEYVAULT_RESOURCE_ID?"Check KEYVAULT_RESOURCE_ID is defined in ${private_env_path}"}"
 
 set -o pipefail
 set -o nounset
@@ -135,13 +136,11 @@ az role assignment create \
     --assignee "${RP_TESTING_SP_APP_ID}" \
     --scope "${SERVICE_BUS_RESOURCE_ID}"
 
-
 # Assign get permissions on the keyvault
-az keyvault set-policy \
-  --name "${KEYVAULT}" \
-  --spn "${RP_TESTING_SP_APP_ID}" \
-  --secret-permissions get
-
+az role assignment create \
+    --role "Key Vault Secrets User" \
+    --assignee "${RP_TESTING_SP_APP_ID}" \
+    --scope "${KEYVAULT_RESOURCE_ID}"
 
 # Write the appId and secret to the private.env file which is used for RP debugging
 # First check if the env vars are there already and delete them

diff --git a/templates/shared_services/airlock_notifier/porter.yaml b/templates/shared_services/airlock_notifier/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-shared-service-airlock-notifier
-version: 1.0.5
+version: 1.0.6
 description: "A shared service notifying on Airlock Operations"
 registry: azuretre
 dockerfile: Dockerfile.tmpl

diff --git a/templates/shared_services/airlock_notifier/terraform/airlock_notifier.tf b/templates/shared_services/airlock_notifier/terraform/airlock_notifier.tf
@@ -14,7 +14,7 @@ resource "azurerm_servicebus_queue" "notifications_queue" {
   name         = "notifications"
   namespace_id = data.azurerm_servicebus_namespace.core.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 /* The notification queue needs to be subscribed to the notification event-grid */

diff --git a/templates/shared_services/firewall/porter.yaml b/templates/shared_services/firewall/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-shared-service-firewall
-version: 1.2.4
+version: 1.2.6
 description: "An Azure TRE Firewall shared service"
 dockerfile: Dockerfile.tmpl
 registry: azuretre

diff --git a/templates/shared_services/firewall/terraform/routetable.tf b/templates/shared_services/firewall/terraform/routetable.tf
@@ -2,7 +2,7 @@ resource "azurerm_route_table" "rt" {
   name                          = "rt-${var.tre_id}"
   resource_group_name           = local.core_resource_group_name
   location                      = data.azurerm_resource_group.rg.location
-  disable_bgp_route_propagation = false
+  bgp_route_propagation_enabled = true
   tags                          = local.tre_shared_service_tags
 
   lifecycle { ignore_changes = [tags] }

diff --git a/templates/workspace_services/azureml/porter.yaml b/templates/workspace_services/azureml/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-service-azureml
-version: 0.8.14
+version: 0.8.15
 description: "An Azure TRE service for Azure Machine Learning"
 registry: azuretre
 dockerfile: Dockerfile.tmpl

diff --git a/templates/workspace_services/azureml/terraform/network.tf b/templates/workspace_services/azureml/terraform/network.tf
@@ -275,7 +275,7 @@ resource "azurerm_route_table" "aml" {
   name                          = "rt-aml-${var.tre_id}-${local.short_service_id}"
   resource_group_name           = data.azurerm_resource_group.ws.name
   location                      = data.azurerm_resource_group.ws.location
-  disable_bgp_route_propagation = false
+  bgp_route_propagation_enabled = true
   tags                          = local.tre_workspace_service_tags
 
   lifecycle { ignore_changes = [tags] }

diff --git a/templates/workspace_services/databricks/porter.yaml b/templates/workspace_services/databricks/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-service-databricks
-version: 1.0.7
+version: 1.0.8
 description: "An Azure TRE service for Azure Databricks."
 registry: azuretre
 dockerfile: Dockerfile.tmpl

diff --git a/templates/workspace_services/databricks/terraform/network.tf b/templates/workspace_services/databricks/terraform/network.tf
@@ -131,7 +131,7 @@ resource "azurerm_route_table" "rt" {
   name                          = local.route_table_name
   location                      = data.azurerm_resource_group.ws.location
   resource_group_name           = data.azurerm_resource_group.ws.name
-  disable_bgp_route_propagation = false
+  bgp_route_propagation_enabled = true
 
   tags = local.tre_workspace_service_tags
   lifecycle { ignore_changes = [tags] }