chore(merge): iterations - merge main into main-iterations (#2787)

* chore(deployment-script): changed feature to main-iterations (#2715) Co-authored-by: Zain Kassam <zkassam@ukexportfinance.gov.uk> * chore(remove-script-prefix): package.json - Remove --prefix (#2708) * chore(main): release 2.10.0 (#2722) * chore(main): release 2.10.0 * chore(cspell): fix typos --------- Co-authored-by: ttbarnes <tony@tonybarnes.me> * fix(EMS-3560): update az cli to v2 (#2720) * fix(EMS-3560): update az cli to v2 * fix(EMS-3560): update az cli to v2 * fix(durable-functions): updated szenius/set-timezone GHA plugin to v2 * fix(durable-functions): updated szenius/set-timezone GHA plugin to v2 --------- Co-authored-by: Abhi Markan <amarkan@ukexportfinance.gov.uk> Co-authored-by: ttbarnes <tony@tonybarnes.me> * chore(main): release 2.10.1 (#2724) * feat(EMS-3502-3567-3568): content updates - contact details (#2721) * feat(EMS-3502-3567-3568): content updates - contact us * feat(EMS-3502-3567-3568): content updates - email links * feat(EMS-3502-3567-3568): content updates - email links * feat(EMS-3502-3567-3568): content updates - email links * feat(EMS-3502-3567-3568): dry cypress selectors * feat(EMS-3502-3567-3568): dry cypress selectors * feat(EMS-3502-3567-3568): content updates - email links * feat(EMS-3502-3567-3568): revert content string change * chore(main): release 2.11.0 (#2725) * fix(EMS-3439-3504): uk goods or services, application submission email copy fixes (#2728) * feat(EMS-2186): added key vault * fix(EMS-2186): added tags to Key Vault * fix(EMS-2186): azure IaC fix * fix(EMS-2186): azure IaC fix * fix(EMS-2186): azure IaC fix * fix(EMS-2186): added tags to Key Vault * chore(main): release 2.11.1 (#2732) * fix(EMS-3590-3591-3423): header link, integrity hashes (#2738) * fix(EMS-3590): update insurance header link * fix(EMS-3591-3423): update integrity hashes * chore(EMS-3533): update start url redirect * fix(EMS-3533): revert start page redirect * chore(e2e): dry route const * chore(main): release 2.11.2 (#2740) * style(EMS-3574): problem with service - content iterations (#2741) * feat(EMS-3587-3425): contact page - content iterations (#2742) * feat(EMS-3587): contact page - content iterations * chore(EMS-3587): remove commented code * fix(EMS-3425): password reset - update label text * fix(EMS-3425): password reset - update label text * chore(main): release 2.12.0 (#2743) * fix(DTFS2-7284): fixed private endpoint * fix(EMS-2186): removed purge protection * chore(deps): bump dependencies (#2755) * fix(EMS-2186): removed * from flag * fix(EM-2186): fixed conditional deployment * chore(main): release 2.12.1 (#2757) * chore(mysql-version): mysql - Version (#2758) * chore(mysql-version): downgraded to 8.0.21 * chore(mysql-version): added to cspell * chore(mysql-version): bumped dependency * chore(mysql-version): downgrade to 8.0 * chore(mysql-version): bump deps * chore(mysql-version): bump deps --------- Co-authored-by: Zain Kassam <zkassam@ukexportfinance.gov.uk> * fix(EMS-3604): no PDF - Anti-bribery code of conduct - Incorrect link (#2768) * chore(main): release 2.12.2 (#2769) * feat(EMS-3606): added missing environment variables * chore(main): release 2.13.0 (#2779) * feat(EMS-3610): changed wording for export contract agent question * chore(main): release 2.14.0 (#2784) * feat(EMS-3535): changes to anti-bribery and corruption definitions (#2778) Co-authored-by: Zain Kassam <zkassam@ukexportfinance.gov.uk> * chore(main): release 2.15.0 (#2786) --------- Co-authored-by: zainZzKk <51957827+Zainzzkk@users.noreply.github.com> Co-authored-by: Zain Kassam <zkassam@ukexportfinance.gov.uk> Co-authored-by: Abhi Markan <32125108+abhi-markan@users.noreply.github.com> Co-authored-by: Abhi Markan <amarkan@ukexportfinance.gov.uk>
UK-Export-Finance · Jul 23, 2024 · 25a4450 · 25a4450
1 parent 133f5f5
commit 25a4450
Show file tree

Hide file tree

Showing 19 changed files with 436 additions and 349 deletions.
diff --git a/.cspell.json b/.cspell.json
@@ -60,6 +60,7 @@
         "Curncy",
         "datafixes",
         "Dockerised",
+        "DTFS",
         "dtos",
         "EASS",
         "ecgd",
@@ -148,6 +149,7 @@
         "Useds",
         "venv",
         "VNET",
+        "vnets",
         "XLSX"
     ],
     "dictionaries": [

diff --git a/.github/workflows/deployment.yml b/.github/workflows/deployment.yml
@@ -59,7 +59,6 @@ jobs:
     name: Database 💾
     needs: setup
     environment: ${{ needs.setup.outputs.environment }}
-    if: ${{ '1' == vars.DATABASE }}
     env:
       ENVIRONMENT: ${{ needs.setup.outputs.environment }}
     runs-on: [self-hosted, EXIP, deployment]
@@ -81,12 +80,14 @@ jobs:
             az configure --defaults group=rg-${{ env.PRODUCT }}-${{ github.ref_name }}-${{ vars.VERSION }}
 
       - name: Extension ➕
+        if: ${{ '1' == vars.DATABASE }}
         uses: azure/cli@v2
         with:
           inlineScript: |
             az config set extension.use_dynamic_install=yes_without_prompt
 
       - name: Import ⬇
+        if: ${{ '1' == vars.DATABASE }}
         uses: azure/cli@v2
         with:
           inlineScript: |

diff --git a/.github/workflows/infrastructure.yml b/.github/workflows/infrastructure.yml
@@ -165,6 +165,12 @@ jobs:
             --address-prefixes ${{ vars.VNET_SUBNET_PRIVATE_PREFIX }} \
             --vnet-name vnet-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }}
 
+            az network vnet subnet create \
+            --name snet-keyvault-${{ env.PRODUCT }}-${{ vars.VERSION }} \
+            --address-prefixes ${{ vars.VNET_SUBNET_KEYVAULT_PREFIX }} \
+            --vnet-name vnet-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
+            --service-endpoints Microsoft.KeyVault
+
       - name: VNET Peer - AMI 🔀
         uses: azure/cli@v2
         with:
@@ -365,6 +371,17 @@ jobs:
           inlineScript: |
             az extension add --name front-door
 
+      - name: Key Vault 🔑
+        uses: azure/cli@v2
+        with:
+          inlineScript: |
+            az keyvault create \
+            --name kv-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
+            --default-action Deny \
+            --public-network-access Disabled \
+            --network-acls-ips ${{ secrets.WAF_ALLOWED_IP }} \
+            --network-acls-vnets $(az network vnet subnet list --vnet-name vnet-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} --query '[?contains(name, `keyvault`)].id' -o tsv)
+
       - name: Private endpoint 🔏
         uses: azure/cli@v2
         with:
@@ -389,6 +406,16 @@ jobs:
             --group-id sites \
             --tags ${{ env.TAGS }}
 
+            #Key Vault
+            az network private-endpoint create \
+            --name private-endpoint-keyvault-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
+            --private-connection-resource-id $(az keyvault show --name kv-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} --query id -o tsv) \
+            --connection-name private-link-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
+            --subnet snet-private-${{ env.PRODUCT }}-${{ vars.VERSION }} \
+            --vnet-name vnet-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
+            --group-id vault \
+            --tags ${{ env.TAGS }}
+
       - name: Private DNS 🌍
         uses: azure/cli@v2
         with:
@@ -441,7 +468,7 @@ jobs:
             --private-link-location ${{ vars.REGION }} \
             --private-link-resource $(az webapp show --name app-${{ env.PRODUCT }}-ui-${{ env.TARGET }}-${{ vars.VERSION }} --query id -o tsv) \
             --private-link-request-message '${{ env.PRODUCT }}-ui-${{ env.TARGET }}-${{ vars.VERSION }}' \
-            --private-link-sub-resource-type $(az network private-link-resource list --id $(az webapp show --name app-${{ env.PRODUCT }}-ui-${{ env.TARGET }}-${{ vars.VERSION }} --query id -o tsv) --query [].name -o tsv) \
+            --private-link-sub-resource-type $(az network private-link-resource list --id $(az webapp show --name app-${{ env.PRODUCT }}-ui-${{ env.TARGET }}-${{ vars.VERSION }} --query id -o tsv) --query '[]'.name -o tsv) \
             --origin-group-name ui \
             --profile-name frontdoor-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
             --enabled-state Enabled
@@ -491,8 +518,8 @@ jobs:
             # Associate FD
             az afd security-policy create \
             --security-policy-name security-policy-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
-            --waf-policy $(az network front-door waf-policy list --query [].id -o tsv) \
-            --domains $(az afd endpoint list --profile-name frontdoor-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} --query [].id -o tsv) \
+            --waf-policy $(az network front-door waf-policy list --query '[]'.id -o tsv) \
+            --domains $(az afd endpoint list --profile-name frontdoor-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} --query '[]'.id -o tsv) \
             --profile-name frontdoor-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }}
 
             # Custom rule - RL
@@ -649,11 +676,11 @@ jobs:
             COMPANIES_HOUSE_API_KEY='${{ secrets.COMPANIES_HOUSE_API_KEY }}' \
             JWT_SIGNING_KEY='${{ secrets.JWT_SIGNING_KEY }}' \
             UNDERWRITING_TEAM_EMAIL='${{ secrets.UNDERWRITING_TEAM_EMAIL }}' \
-            FEEDBACK_EMAIL_RECIPIENT='${{ secrets.FEEDBACK_EMAIL_RECIPIENT }}'
-            CRON_SCHEDULE_UNVERIFIED_ACCOUNT='${{ secrets.CRON_SCHEDULE_UNVERIFIED_ACCOUNT }}'
-            CRON_SCHEDULE_INACTIVE_APPLICATION='${{ secrets.CRON_SCHEDULE_INACTIVE_APPLICATION }}'
-            CRON_SCHEDULE_SUBMISSION_DEADLINE_REMINDER_EMAIL='${{ secrets.CRON_SCHEDULE_SUBMISSION_DEADLINE_REMINDER_EMAIL }}'
-            APPLICATION_URL='${{ secrets.APPLICATION_URL }}'
+            FEEDBACK_EMAIL_RECIPIENT='${{ secrets.FEEDBACK_EMAIL_RECIPIENT }}' \
+            CRON_SCHEDULE_UNVERIFIED_ACCOUNT='${{ secrets.CRON_SCHEDULE_UNVERIFIED_ACCOUNT }}' \
+            CRON_SCHEDULE_INACTIVE_APPLICATION='${{ secrets.CRON_SCHEDULE_INACTIVE_APPLICATION }}' \
+            CRON_SCHEDULE_SUBMISSION_DEADLINE_REMINDER_EMAIL='${{ secrets.CRON_SCHEDULE_SUBMISSION_DEADLINE_REMINDER_EMAIL }}' \
+            APPLICATION_URL='${{ vars.APPLICATION_URL }}'
 
       - name: Extension ➕
         uses: azure/cli@v2
@@ -670,7 +697,7 @@ jobs:
           inlineScript: |
             az webapp connection create mysql-flexible \
             --source-id $(az webapp show --name app-${{ env.PRODUCT }}-api-${{ env.TARGET }}-${{ vars.VERSION }} --query id -o tsv) \
-            --target-id $(az mysql flexible-server list --query [].id -o tsv)/databases/${{ env.PRODUCT }} \
+            --target-id $(az mysql flexible-server list --query '[]'.id -o tsv)/databases/${{ env.PRODUCT }} \
             --connection webapp_api_mysqlflexible_${{ env.PRODUCT }}_${{ env.TARGET }}_${{ vars.VERSION }} \
             --secret name=${{ secrets.MYSQL_USER }} secret=${{ secrets.MYSQL_PASSWORD }} \
             --client-type nodejs
@@ -769,13 +796,13 @@ jobs:
             --record-set-name  "@" \
             --zone ${{ vars.DOMAIN_QUOTE }} \
             --value ${{ vars.CA_VERIFICATION }} \
-            --if-none-match "*"
+            --if-none-match
 
             az network dns record-set txt add-record \
             --record-set-name  "@" \
             --zone ${{ vars.DOMAIN_INSURANCE }} \
             --value ${{ vars.CA_VERIFICATION }} \
-            --if-none-match "*"
+            --if-none-match
 
       - name: CAA records
         uses: azure/cli@v2
@@ -865,8 +892,8 @@ jobs:
           inlineScript: |
             az monitor diagnostic-settings create \
             --name frontdoor-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
-            --resource $(az monitor log-analytics workspace list --query [].id -o tsv) \
-            --workspace $(az monitor log-analytics workspace list --query [].id -o tsv) \
+            --resource $(az monitor log-analytics workspace list --query '[]'.id -o tsv) \
+            --workspace $(az monitor log-analytics workspace list --query '[]'.id -o tsv) \
             --logs "[{categoryGroup:allLogs,enabled:true}]" \
             --metrics "[{category:allMetrics,enabled:true}]"
 
@@ -914,8 +941,19 @@ jobs:
           inlineScript: |
             az monitor diagnostic-settings create \
             --name frontdoor-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
-            --resource $(az afd profile list --query [].id -o tsv) \
-            --workspace $(az monitor log-analytics workspace list --query [].id -o tsv) \
+            --resource $(az afd profile list --query '[]'.id -o tsv) \
+            --workspace $(az monitor log-analytics workspace list --query '[]'.id -o tsv) \
+            --logs "[{categoryGroup:allLogs,enabled:true}]" \
+            --metrics "[{category:allMetrics,enabled:true}]"
+
+      - name: Key Vault 🔑
+        uses: azure/cli@v2
+        with:
+          inlineScript: |
+            az monitor diagnostic-settings create \
+            --name frontdoor-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
+            --resource $(az keyvault show --name kv-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} --query id -o tsv) \
+            --workspace $(az monitor log-analytics workspace list --query '[]'.id -o tsv) \
             --logs "[{categoryGroup:allLogs,enabled:true}]" \
             --metrics "[{category:allMetrics,enabled:true}]"
 
@@ -925,16 +963,23 @@ jobs:
           inlineScript: |
             # UI
             az monitor diagnostic-settings create \
-            --name frontdoor-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
-            --resource $(az network nic list --query ['?contains(name, `ui`)'].id -o tsv) \
-            --workspace $(az monitor log-analytics workspace list --query [].id -o tsv) \
+            --name webapp-ui-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
+            --resource $(az network nic list --query '[?contains(name, `ui`)]'.id -o tsv) \
+            --workspace $(az monitor log-analytics workspace list --query '[]'.id -o tsv) \
             --metrics "[{category:allMetrics,enabled:true}]"
 
             # API
             az monitor diagnostic-settings create \
-            --name frontdoor-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
-            --resource $(az network nic list --query ['?contains(name, `api`)'].id -o tsv) \
-            --workspace $(az monitor log-analytics workspace list --query [].id -o tsv) \
+            --name webapp-api-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
+            --resource $(az network nic list --query '[?contains(name, `api`)]'.id -o tsv) \
+            --workspace $(az monitor log-analytics workspace list --query '[]'.id -o tsv) \
+            --metrics "[{category:allMetrics,enabled:true}]"
+
+            # KV
+            az monitor diagnostic-settings create \
+            --name kv-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
+            --resource $(az network nic list --query '[?contains(name, `key`)]'.id -o tsv) \
+            --workspace $(az monitor log-analytics workspace list --query '[]'.id -o tsv) \
             --metrics "[{category:allMetrics,enabled:true}]"
 
   # 7. Various alerts
@@ -1008,8 +1053,8 @@ jobs:
             --name alert-healthcheck-${{ env.PRODUCT }}-${{ env.TARGET }}-${{ vars.VERSION }} \
             --description "1 minute health check" \
             --condition  "avg 'OriginHealthPercentage' <= 99.0 where OriginGroup includes ui" \
-            --scope $(az afd profile list --query [].id -o tsv) \
-            --action $(az monitor action-group list --query [].id -o tsv) \
+            --scope $(az afd profile list --query '[]'.id -o tsv) \
+            --action $(az monitor action-group list --query '[]'.id -o tsv) \
             --auto-mitigate true \
             --severity 0 \
             --tags ${{ env.TAGS }}