[#DEVEX-116] Create Dev APIM and bind OpenAPI specs and default Policy #22

BurnedMarshal · 2024-06-11T16:08:33Z

A test development APIM is created under DEV-IO subscription.
Created all the related resources.
Use default empty policy for product and api.
The function OpenAPI specification are divided into internal and external. The internal spec describe how the API are implemented al the application level, instead the external describe as the API are served outside the APIM.
Updated the pipeline to handle the new environment dev/italynorth for the resources.

Krusty93 · 2024-06-12T14:33:55Z

.github/workflows/pr_infra.yaml

@@ -10,7 +10,7 @@ on:
      - ready_for_review
    paths:
      # Trigger the workflow when resources are modified
-      - "infra/resources/**"
+      - "infra/resources/prod/westeurope/**"


Please get rid of line 25 as well

yep, we need to remove the region parameter (westeurope) which is not used in the new workflow

Krusty93 · 2024-06-12T14:34:11Z

.github/workflows/pr_infra_dev.yaml

+      ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
+    with:
+      environment: dev
+      region: italynorth


Krusty93 · 2024-06-12T14:37:58Z

infra/repository/locals.tf

-    "ARM_SUBSCRIPTION_ID" = data.azurerm_subscription.current.subscription_id
+    "ARM_TENANT_ID"           = data.azurerm_client_config.current.tenant_id,
+    "ARM_SUBSCRIPTION_ID"     = data.azurerm_subscription.current.subscription_id
+    "ARM_DEV_SUBSCRIPTION_ID" = data.azurerm_subscription.dev.subscription_id


we need another identity and another github environment to manage DEV-IO as current identities have roles on PROD-IO only

why dx-typescript runners have roles on PROD-IO ?

we have moved the state into DEV-ENGINEERING subscription

Krusty93 · 2024-06-12T14:39:57Z

infra/resources/dev/italynorth/api.tf

+  subscription_required = false # Public API
+
+  content_format = "openapi"
+  content_value = templatefile("../../../../apps/azure-functions-api/api/external.yaml",


Not sure if it works, probably you need to use ${path.module} or anything similar

does this update the resource during apply if the content changes?

Krusty93 · 2024-06-12T14:40:02Z

infra/resources/dev/italynorth/api.tf

+    }
+  )
+
+  xml_content = file("../../../../apps/azure-functions-api/api/policy/default.xml")


infra/resources/dev/italynorth/keyvault.tf

Krusty93 · 2024-06-12T14:50:55Z

infra/resources/dev/italynorth/keyvault.tf

@@ -0,0 +1,18 @@
+resource "azurerm_resource_group" "sec_rg" {


I wouldn't use another resource group

Krusty93 · 2024-06-12T14:52:20Z

infra/resources/dev/italynorth/apim.tf

+  publisher_email           = data.azurerm_key_vault_secret.apim_publisher_email.value
+  notification_sender_email = data.azurerm_key_vault_secret.apim_publisher_email.value
+  sku_name                  = "Developer_1"
+  virtual_network_type      = "Internal"


Do we need a private endpoint here?

infra/resources/dev/italynorth/monitor.tf

gunzip · 2024-06-12T15:09:54Z

infra/repository/locals.tf

-    "ARM_SUBSCRIPTION_ID" = data.azurerm_subscription.current.subscription_id
+    "ARM_TENANT_ID"           = data.azurerm_client_config.current.tenant_id,
+    "ARM_SUBSCRIPTION_ID"     = data.azurerm_subscription.current.subscription_id
+    "ARM_DEV_SUBSCRIPTION_ID" = data.azurerm_subscription.dev.subscription_id


why dx-typescript runners have roles on PROD-IO ?

gunzip · 2024-06-12T15:10:33Z

infra/repository/main.tf

@@ -32,3 +32,7 @@ provider "github" {
 data "azurerm_client_config" "current" {}

 data "azurerm_subscription" "current" {}
+
+data "azurerm_subscription" "dev" {
+  subscription_id = "a4e96bcd-59dc-4d66-b2f7-5547ad157c12" # DEV-IO


use DEV-ENGINEERING

gunzip · 2024-06-12T15:12:05Z

infra/resources/dev/italynorth/api.tf

+  subscription_required = false # Public API
+
+  content_format = "openapi"
+  content_value = templatefile("../../../../apps/azure-functions-api/api/external.yaml",


does this update the resource during apply if the content changes?

sonarqubecloud · 2024-06-13T12:41:37Z

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarCloud

gunzip · 2024-06-25T08:40:32Z

.github/workflows/pr_infra.yaml

@@ -10,7 +10,7 @@ on:
      - ready_for_review
    paths:
      # Trigger the workflow when resources are modified
-      - "infra/resources/**"
+      - "infra/resources/prod/westeurope/**"


yep, we need to remove the region parameter (westeurope) which is not used in the new workflow

gunzip · 2024-06-25T08:40:41Z

.github/workflows/pr_infra_dev.yaml

+      ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
+    with:
+      environment: dev
+      region: italynorth


Suggested change

region: italynorth

gunzip · 2024-06-25T08:41:28Z

infra/repository/locals.tf

-    "ARM_SUBSCRIPTION_ID" = data.azurerm_subscription.current.subscription_id
+    "ARM_TENANT_ID"           = data.azurerm_client_config.current.tenant_id,
+    "ARM_SUBSCRIPTION_ID"     = data.azurerm_subscription.current.subscription_id
+    "ARM_DEV_SUBSCRIPTION_ID" = data.azurerm_subscription.dev.subscription_id


we have moved the state into DEV-ENGINEERING subscription

gunzip · 2024-06-25T08:42:24Z

infra/resources/dev/italynorth/api.tf

+  protocols   = ["http", "https"]
+  product_ids = [module.apim_product_example_api.product_id]
+
+  service_url = null


what's this? (I'd add a comment)

gunzip · 2024-06-25T08:43:59Z

infra/resources/dev/italynorth/apim.tf

+  ]
+}
+
+resource "azurerm_network_security_group" "nsg_apim" {


I'd add a comment on what's happening here

gunzip · 2024-06-25T08:44:20Z

infra/resources/dev/italynorth/apim.tf

+  allocation_method   = "Static"
+  sku                 = "Standard"
+  domain_name_label   = "apimdx"
+  zones               = ["1", "2", "3"]


what's this?

gunzip · 2024-06-25T08:45:24Z

infra/resources/dev/italynorth/apim.tf

+        default_ssl_binding = false
+        host_name           = format("%s-apim-api.azure-api.net", local.project)
+        key_vault_id        = null
+      },
+    ]
+    developer_portal = null
+    management       = null
+    portal           = null


I'd add some comments to clarify the reason of this params

gunzip · 2024-06-25T08:46:32Z

infra/resources/dev/italynorth/apim.tf

+
+  autoscale = local.apim_autoscale
+
+  alerts_enabled = local.apim_alerts_enabled


as an example? probably. A nice to have would be to have this logic inside a more abstract APIM module (with presets for autoscaling + preconfigured alerts)

gunzip · 2024-06-25T08:47:16Z

infra/resources/dev/italynorth/main.tf

+    resource_group_name  = "terraform-state-rg"
+    storage_account_name = "tfdevdx"
+    container_name       = "terraform-state"
+    key                  = "dx-typescript.resources.dev.italynorth.tfstate"


[#DEVEX-116] Create Dev APIM and bind OpenAPI specs and default Policy

fb98270

Krusty93 reviewed Jun 12, 2024

View reviewed changes

gunzip reviewed Jun 12, 2024

View reviewed changes

[#DEVEX-116] Use the right naming convention for resources

e1979ca

gunzip reviewed Jun 25, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[#DEVEX-116] Create Dev APIM and bind OpenAPI specs and default Policy #22

[#DEVEX-116] Create Dev APIM and bind OpenAPI specs and default Policy #22

BurnedMarshal commented Jun 11, 2024

Krusty93 Jun 12, 2024

gunzip Jun 25, 2024

Krusty93 Jun 12, 2024

Krusty93 Jun 12, 2024

gunzip Jun 12, 2024

gunzip Jun 25, 2024

Krusty93 Jun 12, 2024

gunzip Jun 12, 2024

Krusty93 Jun 12, 2024

Krusty93 Jun 12, 2024

Krusty93 Jun 12, 2024

gunzip Jun 12, 2024

gunzip Jun 12, 2024 •

edited

Loading

gunzip Jun 12, 2024

sonarqubecloud bot commented Jun 13, 2024

gunzip Jun 25, 2024

gunzip Jun 25, 2024

gunzip Jun 25, 2024

gunzip Jun 25, 2024

gunzip Jun 25, 2024

gunzip Jun 25, 2024

gunzip Jun 25, 2024

gunzip Jun 25, 2024

gunzip Jun 25, 2024

		@@ -0,0 +1,18 @@
		resource "azurerm_resource_group" "sec_rg" {


		autoscale = local.apim_autoscale

		alerts_enabled = local.apim_alerts_enabled

[#DEVEX-116] Create Dev APIM and bind OpenAPI specs and default Policy #22

Are you sure you want to change the base?

[#DEVEX-116] Create Dev APIM and bind OpenAPI specs and default Policy #22

Conversation

BurnedMarshal commented Jun 11, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gunzip Jun 12, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sonarqubecloud bot commented Jun 13, 2024

Quality Gate failed

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gunzip Jun 12, 2024 •

edited

Loading