Merge branch 'main' into 4002-cmk-support

microsoft · Nov 19, 2024 · e3e2d6c · e3e2d6c
2 parents 25322d7 + 16dff47
commit e3e2d6c
Show file tree

Hide file tree

Showing 25 changed files with 86 additions and 76 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -10,6 +10,8 @@ ENHANCEMENTS:
 * Split log entries with [Log chunk X of Y] for better readability. ([[#3992](https://github.com/microsoft/AzureTRE/issues/3992)
 * Expose APP_SERVICE_SKU build variable to allow enablement of App Gateway WAF ([#4111](https://github.com/microsoft/AzureTRE/pull/4111))
 * Update Terraform to use Azure AD authentication rather than storage account keys ([#4103](https://github.com/microsoft/AzureTRE/issues/4103))
+* Update obsolete Terraform properties ([#4136](https://github.com/microsoft/AzureTRE/issues/4136))
+* Update Guacamole version and dependencies ([#4140](https://github.com/microsoft/AzureTRE/issues/4140))
 
 BUG FIXES:
 - Update KeyVault references in API to use the version so Terraform cascades the update ([#4112](https://github.com/microsoft/AzureTRE/pull/4112))

diff --git a/Makefile b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: bootstrap-init mgmt-deploy mgmt-destroy build-api-image push-api-image deploy-tre destroy-tre letsencrypt
+.PHONY: bootstrap-init mgmt-deploy mgmt-destroy build-api-image push-api-image tre-deploy tre-destroy letsencrypt
 .DEFAULT_GOAL := help
 
 SHELL:=/bin/bash

diff --git a/core/terraform/airlock/service_bus.tf b/core/terraform/airlock/service_bus.tf
@@ -3,35 +3,35 @@ resource "azurerm_servicebus_queue" "step_result" {
   name         = local.step_result_queue_name
   namespace_id = var.airlock_servicebus.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 resource "azurerm_servicebus_queue" "status_changed" {
   name         = local.status_changed_queue_name
   namespace_id = var.airlock_servicebus.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 resource "azurerm_servicebus_queue" "scan_result" {
   name         = local.scan_result_queue_name
   namespace_id = var.airlock_servicebus.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 resource "azurerm_servicebus_queue" "data_deletion" {
   name         = local.data_deletion_queue_name
   namespace_id = var.airlock_servicebus.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 resource "azurerm_servicebus_topic" "blob_created" {
   name         = local.blob_created_topic_name
   namespace_id = var.airlock_servicebus.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 resource "azurerm_servicebus_subscription" "airlock_processor" {

diff --git a/core/terraform/api-webapp.tf b/core/terraform/api-webapp.tf
@@ -85,8 +85,8 @@ resource "azurerm_linux_web_app" "api" {
     ftps_state                                    = "Disabled"
 
     application_stack {
-      docker_image     = "${local.docker_registry_server}/${var.api_image_repository}"
-      docker_image_tag = local.version
+      docker_registry_url = "https://${local.docker_registry_server}"
+      docker_image_name   = "${var.api_image_repository}:${local.version}"
     }
 
     cors {

diff --git a/core/terraform/cosmos_mongo.tf b/core/terraform/cosmos_mongo.tf
@@ -1,12 +1,12 @@
 resource "azurerm_cosmosdb_account" "mongo" {
-  name                      = "cosmos-mongo-${var.tre_id}"
-  location                  = azurerm_resource_group.core.location
-  resource_group_name       = azurerm_resource_group.core.name
-  offer_type                = "Standard"
-  kind                      = "MongoDB"
-  enable_automatic_failover = false
-  mongo_server_version      = 4.2
-  ip_range_filter           = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
+  name                       = "cosmos-mongo-${var.tre_id}"
+  location                   = azurerm_resource_group.core.location
+  resource_group_name        = azurerm_resource_group.core.name
+  offer_type                 = "Standard"
+  kind                       = "MongoDB"
+  automatic_failover_enabled = false
+  mongo_server_version       = 4.2
+  ip_range_filter            = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
 
   capabilities {
     name = "EnableServerless"
@@ -93,7 +93,7 @@ resource "azurerm_private_endpoint" "mongo" {
 
 resource "azurerm_key_vault_secret" "cosmos_mongo_connstr" {
   name         = "porter-db-connection-string"
-  value        = azurerm_cosmosdb_account.mongo.connection_strings[0]
+  value        = azurerm_cosmosdb_account.mongo.primary_mongodb_connection_string
   key_vault_id = azurerm_key_vault.kv.id
   tags         = local.tre_core_tags
   depends_on = [

diff --git a/core/terraform/json-to-env.sh b/core/terraform/json-to-env.sh
@@ -29,6 +29,10 @@ jq -r '
             "path": "keyvault_uri",
             "env_var": "KEYVAULT_URI"
         },
+        {
+            "path": "keyvault_resource_id",
+            "env_var": "KEYVAULT_RESOURCE_ID"
+        },
         {
             "path": "azure_tre_fqdn",
             "env_var": "FQDN"

diff --git a/core/terraform/network/network.tf b/core/terraform/network/network.tf
@@ -27,7 +27,7 @@ resource "azurerm_subnet" "app_gw" {
   virtual_network_name                          = azurerm_virtual_network.core.name
   resource_group_name                           = var.resource_group_name
   address_prefixes                              = [local.app_gw_subnet_address_prefix]
-  private_endpoint_network_policies_enabled     = false
+  private_endpoint_network_policies             = "Disabled"
   private_link_service_network_policies_enabled = true
   depends_on                                    = [azurerm_subnet.azure_firewall]
 }
@@ -37,7 +37,7 @@ resource "azurerm_subnet" "web_app" {
   virtual_network_name                          = azurerm_virtual_network.core.name
   resource_group_name                           = var.resource_group_name
   address_prefixes                              = [local.web_app_subnet_address_prefix]
-  private_endpoint_network_policies_enabled     = false
+  private_endpoint_network_policies             = "Disabled"
   private_link_service_network_policies_enabled = true
   depends_on                                    = [azurerm_subnet.app_gw]
 
@@ -57,8 +57,8 @@ resource "azurerm_subnet" "shared" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.shared_services_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.web_app]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.web_app]
 }
 
 resource "azurerm_subnet" "resource_processor" {
@@ -67,8 +67,8 @@ resource "azurerm_subnet" "resource_processor" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.resource_processor_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.shared]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.shared]
 }
 
 resource "azurerm_subnet" "airlock_processor" {
@@ -77,8 +77,8 @@ resource "azurerm_subnet" "airlock_processor" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.airlock_processor_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.resource_processor]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.resource_processor]
 
   delegation {
     name = "delegation"
@@ -100,8 +100,8 @@ resource "azurerm_subnet" "airlock_notification" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.airlock_notifications_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.airlock_processor]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.airlock_processor]
 
   delegation {
     name = "delegation"
@@ -120,8 +120,8 @@ resource "azurerm_subnet" "airlock_storage" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.airlock_storage_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.airlock_notification]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.airlock_notification]
 }
 
 resource "azurerm_subnet" "airlock_events" {
@@ -130,8 +130,8 @@ resource "azurerm_subnet" "airlock_events" {
   resource_group_name  = var.resource_group_name
   address_prefixes     = [local.airlock_events_subnet_address_prefix]
   # notice that private endpoints do not adhere to NSG rules
-  private_endpoint_network_policies_enabled = false
-  depends_on                                = [azurerm_subnet.airlock_storage]
+  private_endpoint_network_policies = "Disabled"
+  depends_on                        = [azurerm_subnet.airlock_storage]
 
   # Eventgrid CAN'T send messages over private endpoints, hence we need to allow service endpoints to the service bus
   # We are using service endpoints + managed identity to send these messaages

diff --git a/core/terraform/outputs.tf b/core/terraform/outputs.tf
@@ -30,6 +30,10 @@ output "keyvault_uri" {
   value = azurerm_key_vault.kv.vault_uri
 }
 
+output "keyvault_resource_id" {
+  value = azurerm_key_vault.kv.id
+}
+
 output "service_bus_resource_id" {
   value = azurerm_servicebus_namespace.sb.id
 }
@@ -59,7 +63,7 @@ output "state_store_endpoint" {
 }
 
 output "cosmosdb_mongo_endpoint" {
-  value     = azurerm_cosmosdb_account.mongo.connection_strings[0]
+  value     = azurerm_cosmosdb_account.mongo.primary_sql_connection_string
   sensitive = true
 }
 

diff --git a/core/terraform/servicebus.tf b/core/terraform/servicebus.tf
@@ -36,8 +36,8 @@ resource "azurerm_servicebus_queue" "workspacequeue" {
   name         = "workspacequeue"
   namespace_id = azurerm_servicebus_namespace.sb.id
 
-  enable_partitioning = false
-  requires_session    = true # use sessions here to make sure updates to each resource happen in serial, in order
+  partitioning_enabled = false
+  requires_session     = true # use sessions here to make sure updates to each resource happen in serial, in order
 }
 
 resource "azurerm_servicebus_queue" "service_bus_deployment_status_update_queue" {
@@ -48,8 +48,8 @@ resource "azurerm_servicebus_queue" "service_bus_deployment_status_update_queue"
   # Cosmos is the final destination of the messages where 2048 is the limit.
   max_message_size_in_kilobytes = 2048 # default=1024
 
-  enable_partitioning = false
-  requires_session    = true
+  partitioning_enabled = false
+  requires_session     = true
 }
 
 resource "azurerm_private_dns_zone" "servicebus" {

diff --git a/core/terraform/statestore.tf b/core/terraform/statestore.tf
@@ -1,12 +1,12 @@
 resource "azurerm_cosmosdb_account" "tre_db_account" {
-  name                      = "cosmos-${var.tre_id}"
-  location                  = azurerm_resource_group.core.location
-  resource_group_name       = azurerm_resource_group.core.name
-  offer_type                = "Standard"
-  kind                      = "GlobalDocumentDB"
-  enable_automatic_failover = false
-  ip_range_filter           = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
-  tags                      = local.tre_core_tags
+  name                       = "cosmos-${var.tre_id}"
+  location                   = azurerm_resource_group.core.location
+  resource_group_name        = azurerm_resource_group.core.name
+  offer_type                 = "Standard"
+  kind                       = "GlobalDocumentDB"
+  automatic_failover_enabled = false
+  ip_range_filter            = "${local.azure_portal_cosmos_ips}${var.enable_local_debugging ? ",${local.myip}" : ""}"
+  tags                       = local.tre_core_tags
 
   dynamic "capabilities" {
     # We can't change an existing cosmos

diff --git a/core/version.txt b/core/version.txt
@@ -1 +1 @@
-__version__ = "0.11.0"
+__version__ = "0.11.1"
diff --git a/devops/scripts/setup_local_debugging.sh b/devops/scripts/setup_local_debugging.sh
@@ -15,6 +15,7 @@ private_env_path="./core/private.env"
 : "${EVENT_GRID_AIRLOCK_NOTIFICATION_TOPIC_RESOURCE_ID?"Check EVENT_GRID_AIRLOCK_NOTIFICATION_TOPIC_RESOURCE_ID is defined in ${private_env_path}"}"
 : "${KEYVAULT_URI?"Check KEYVAULT_URI is defined in ${private_env_path}"}"
 : "${KEYVAULT?"Check KEYVAULT is defined in ${private_env_path}"}"
+: "${KEYVAULT_RESOURCE_ID?"Check KEYVAULT_RESOURCE_ID is defined in ${private_env_path}"}"
 
 set -o pipefail
 set -o nounset
@@ -135,13 +136,11 @@ az role assignment create \
     --assignee "${RP_TESTING_SP_APP_ID}" \
     --scope "${SERVICE_BUS_RESOURCE_ID}"
 
-
 # Assign get permissions on the keyvault
-az keyvault set-policy \
-  --name "${KEYVAULT}" \
-  --spn "${RP_TESTING_SP_APP_ID}" \
-  --secret-permissions get
-
+az role assignment create \
+    --role "Key Vault Secrets User" \
+    --assignee "${RP_TESTING_SP_APP_ID}" \
+    --scope "${KEYVAULT_RESOURCE_ID}"
 
 # Write the appId and secret to the private.env file which is used for RP debugging
 # First check if the env vars are there already and delete them

diff --git a/templates/shared_services/airlock_notifier/porter.yaml b/templates/shared_services/airlock_notifier/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-shared-service-airlock-notifier
-version: 1.0.5
+version: 1.0.6
 description: "A shared service notifying on Airlock Operations"
 registry: azuretre
 dockerfile: Dockerfile.tmpl

diff --git a/templates/shared_services/airlock_notifier/terraform/airlock_notifier.tf b/templates/shared_services/airlock_notifier/terraform/airlock_notifier.tf
@@ -14,7 +14,7 @@ resource "azurerm_servicebus_queue" "notifications_queue" {
   name         = "notifications"
   namespace_id = data.azurerm_servicebus_namespace.core.id
 
-  enable_partitioning = false
+  partitioning_enabled = false
 }
 
 /* The notification queue needs to be subscribed to the notification event-grid */

diff --git a/templates/shared_services/firewall/porter.yaml b/templates/shared_services/firewall/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-shared-service-firewall
-version: 1.2.4
+version: 1.2.6
 description: "An Azure TRE Firewall shared service"
 dockerfile: Dockerfile.tmpl
 registry: azuretre

diff --git a/templates/shared_services/firewall/terraform/routetable.tf b/templates/shared_services/firewall/terraform/routetable.tf
@@ -2,7 +2,7 @@ resource "azurerm_route_table" "rt" {
   name                          = "rt-${var.tre_id}"
   resource_group_name           = local.core_resource_group_name
   location                      = data.azurerm_resource_group.rg.location
-  disable_bgp_route_propagation = false
+  bgp_route_propagation_enabled = true
   tags                          = local.tre_shared_service_tags
 
   lifecycle { ignore_changes = [tags] }

diff --git a/templates/workspace_services/azureml/porter.yaml b/templates/workspace_services/azureml/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-service-azureml
-version: 0.8.14
+version: 0.8.15
 description: "An Azure TRE service for Azure Machine Learning"
 registry: azuretre
 dockerfile: Dockerfile.tmpl

diff --git a/templates/workspace_services/azureml/terraform/network.tf b/templates/workspace_services/azureml/terraform/network.tf
@@ -275,7 +275,7 @@ resource "azurerm_route_table" "aml" {
   name                          = "rt-aml-${var.tre_id}-${local.short_service_id}"
   resource_group_name           = data.azurerm_resource_group.ws.name
   location                      = data.azurerm_resource_group.ws.location
-  disable_bgp_route_propagation = false
+  bgp_route_propagation_enabled = true
   tags                          = local.tre_workspace_service_tags
 
   lifecycle { ignore_changes = [tags] }

diff --git a/templates/workspace_services/databricks/porter.yaml b/templates/workspace_services/databricks/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-service-databricks
-version: 1.0.7
+version: 1.0.8
 description: "An Azure TRE service for Azure Databricks."
 registry: azuretre
 dockerfile: Dockerfile.tmpl

diff --git a/templates/workspace_services/databricks/terraform/network.tf b/templates/workspace_services/databricks/terraform/network.tf
@@ -131,7 +131,7 @@ resource "azurerm_route_table" "rt" {
   name                          = local.route_table_name
   location                      = data.azurerm_resource_group.ws.location
   resource_group_name           = data.azurerm_resource_group.ws.name
-  disable_bgp_route_propagation = false
+  bgp_route_propagation_enabled = true
 
   tags = local.tre_workspace_service_tags
   lifecycle { ignore_changes = [tags] }

diff --git a/templates/workspace_services/guacamole/guacamole-server/docker/Dockerfile b/templates/workspace_services/guacamole/guacamole-server/docker/Dockerfile
@@ -11,9 +11,9 @@ RUN bash /tmp/maven_package_and_exit_succesfully.sh
 FROM scratch as test-results
 COPY --from=client_build /target/surefire-reports/* /
 
-FROM guacamole/guacd:1.5.3
+FROM guacamole/guacd:1.5.5
 
-ARG GUACAMOLE_AZURE_VERSION=0.3.4
+ARG GUACAMOLE_AZURE_VERSION=0.4.0
 
 ENV DEBIAN_FRONTEND=noninteractive
 
@@ -26,7 +26,7 @@ RUN apk add --update --no-cache wget openssh openjdk11-jre \
 
 ENV CATALINA_BASE=/usr/share/tomcat9/
 RUN TOMCAT_ARCHIVE="tomcat.tar.gz" && \
-    TOMCAT_VER="9.0.83" && \
+    TOMCAT_VER="9.0.97" && \
     wget -O "$TOMCAT_ARCHIVE" -N "https://archive.apache.org/dist/tomcat/tomcat-9/v${TOMCAT_VER}/bin/apache-tomcat-${TOMCAT_VER}.tar.gz" --progress=dot:giga && \
     tar xzf "$TOMCAT_ARCHIVE" && \
     rm -f "$TOMCAT_ARCHIVE" && \
@@ -57,14 +57,14 @@ RUN wget -O "${GUACAMOLE_HOME}/guacamole.war" "http://apache.org/dyn/closer.cgi?
 
 ENV OAUTH2_PROXY_HOME=/etc/oauth2-proxy
 RUN OAUTH2_PROXY_ARCHIVE=oauth2-proxy.tar.gz && \
-    wget -O "$OAUTH2_PROXY_ARCHIVE" "https://github.com/oauth2-proxy/oauth2-proxy/releases/download/v7.4.0/oauth2-proxy-v7.4.0.linux-amd64.tar.gz" --progress=dot:giga && \
+    wget -O "$OAUTH2_PROXY_ARCHIVE" "https://github.com/oauth2-proxy/oauth2-proxy/releases/download/v7.7.1/oauth2-proxy-v7.7.1.linux-amd64.tar.gz" --progress=dot:giga && \
     mkdir -p "$OAUTH2_PROXY_HOME" && \
     tar zxpf "$OAUTH2_PROXY_ARCHIVE" -C "$OAUTH2_PROXY_HOME" --strip-components=1 && \
     rm -f "$OAUTH2_PROXY_ARCHIVE"
 
 COPY ./docker/index.jsp "$CATALINA_BASE"/webapps/ROOT/index.jsp
 
-RUN wget -O "/tmp/applicationinsights-agent.jar" "https://github.com/microsoft/ApplicationInsights-Java/releases/download/3.4.18/applicationinsights-agent-3.4.18.jar" --progress=dot:giga
+RUN wget -O "/tmp/applicationinsights-agent.jar" "https://github.com/microsoft/ApplicationInsights-Java/releases/download/3.6.2/applicationinsights-agent-3.6.2.jar" --progress=dot:giga
 ENV CATALINA_OPTS="$CATALINA_OPTS -javaagent:/tmp/applicationinsights-agent.jar"
 
 ENTRYPOINT [ "/init" ]

diff --git a/templates/workspace_services/guacamole/guacamole-server/docker/version.txt b/templates/workspace_services/guacamole/guacamole-server/docker/version.txt
@@ -1 +1 @@
-__version__ = "0.8.6"
+__version__ = "0.9.0"