Ees 4807 small tweaks after merge #4725

duncan-at-hiveit · 2024-03-28T14:35:32Z

This PR:

changes Container App Environment to be internal rather than having a Public IP address, in preparation for adding an Application Gateway in front, as requested by the Security Architecture group.
adds in a conditional flag to omit the Container App from deployment until a user-assigned managed identity has been created and assigned the AcrPull role.
swaps out the conditional inclusion of chunks of YAML in the pipeline for different environments (which turned out not to be working!) with "condition" property on Stages based on the current branch.
removes PSQL VNet integration in favour of enabling public SQL access to whitelisted IP address ranges, as per existing SQL Server setups. In the future this will be resolved for VNet traffic by EES-5052, by adding a Private Endpoint linking PSQL to the VNet.
adds additional necessary subnets to the main ARM template's control.
adds new appsettings to Container App, and SQL connection string secret creation for Admin, Publisher and Data Processor.
amends the initial migration of the Container App to allow all PSQL db users to have access to future tables as well as initial ones.

Optimisation flag for PSQL

I've added a flag for effectively skipping the PSQL stage of the deploy, as currently it seems that PSQL attempts to update every single time that we do a Public API Inf deploy, which leads to at least 5 minutes extra deploy time and at worst about 13 minutes extra. We need to work out what is causing it to redeploy each time even when nothing has changed. It may be down to the child "databases" and "firewallRules" resources, which could potentially be solved by moving them out into top-level resources in the postgres module rather than as child resources, but haven't investigated yet.

…onditionally including stages in pipeline based on variable values, as this turned out to not be working correctly

…y if the user-assigned Managed Identity has been created yet

… allow the ARM template to control the VNet and all subnets, and have the Bicep template look them up

…for provision by the VNet. Updating Container App Environment subnet to allow greater IP range. Switching Container App Environment to be internal by default to prevent the creaton of an unprotected Public IP Address.

…ntainer Apps initial migration

…rmissions for future tables created in the public_data db to various Managed Identity users

…eploy with a single "deployContainerApp" flag instead

…ss PSQL. Added flag to avoid unnecessary PSQL deploys if possible. Added more connection strings to Key Vault and amended KV secret names to reflect existing naming conventions.

…prior to merging back into dev. Removing references to EES-5052 from Bicep files as we will be replacing VNet integration with Private Endpoint as part of the EES-5052 work.

benoutram · 2024-05-03T09:54:14Z

infrastructure/templates/public-api/main.bicep

+// Note that this has been added temporarily to avoid 10+ minute deploys where it appears that PSQL will redeploy even if no changes exist in
+// this deploy from the previous one.
+@description('Does the PostgreSQL Flexible Server require any updates? False by default to avoid unnecessarily lengthy deploys.')
+param updatePsqlFlexibleServer bool = false


As discussed, we could create a new ticket to investigate this and tidy it up, or create an overarching tidy-up ticket to begin listing any stuff like this that still needs looking at.

I've created https://dfedigital.atlassian.net/browse/EES-5128 to cover this, and added some TODOs to the codebase to reference it.

benoutram · 2024-05-03T10:08:58Z

infrastructure/templates/public-api/main.bicep

+resource apiContainerAppManagedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' existing = if (deployContainerApp) {
+  name: apiContainerAppManagedIdentityName
 }


Could this be inside the containerApp module rather than in main?

I've created https://dfedigital.atlassian.net/browse/EES-5128 to cover this, and added a TODO to the codebase to reference it.

benoutram · 2024-05-03T10:11:29Z

infrastructure/templates/public-api/main.bicep

+        name: 'ParquetFiles__BasePath'
+        value: 'data/public-api-parquet'


I think we need a new ticket creating on configuring this Azure File Share at some point, in order to mount the data directory.

I've created https://dfedigital.atlassian.net/browse/EES-5127 to cover this.

benoutram · 2024-05-03T10:12:37Z

infrastructure/templates/public-api/main.bicep

+  dependsOn: [
+    postgreSqlServerModule
+  ]


Just wondering if this is still required? If deployContainerApp is true and updatePsqlFlexibleServer is false would this work?

Yeah, so this is in the situation where updatePsqlFlexibleServer is false. In that case, it's dependent on postgreSqlServerModule being complete before continuing - we have to be explicit about the dependency because we're not using any actual values from the postgreSqlServerModule output in this definition.

If updatePsqlFlexibleServer is true, postgreSqlServerModule will be undefined, and any undefined references in the dependsOn array get ignored, so this module can just deploy immediately.

…cket

benoutram approved these changes Mar 28, 2024

View reviewed changes

duncan-at-hiveit force-pushed the EES-4807-small-tweaks-after-merge branch 8 times, most recently from 0441b9d to 10a342c Compare March 28, 2024 17:20

duncan-at-hiveit force-pushed the EES-4807-small-tweaks-after-merge branch 6 times, most recently from 082d603 to 027c418 Compare April 8, 2024 15:28

duncan-at-hiveit force-pushed the EES-4807-small-tweaks-after-merge branch 4 times, most recently from 5c1fff4 to d016e5d Compare April 16, 2024 12:28

duncan-at-hiveit force-pushed the EES-4807-small-tweaks-after-merge branch 9 times, most recently from 26bdbfe to ed004c8 Compare May 2, 2024 11:24

duncan-at-hiveit added 2 commits May 2, 2024 13:15

EES-4807 - adjusting pipeline to use conditional stages rather than c…

d49756c

…onditionally including stages in pipeline based on variable values, as this turned out to not be working correctly

EES-4807 - added flag to conditionally roll out the Container App onl…

7f00882

…y if the user-assigned Managed Identity has been created yet

duncan-at-hiveit added 4 commits May 2, 2024 13:15

EES-4807 - adding maintenance firewall ranges to PSQL

f2ed73a

EES-4807 - making change equivalent to recent ARM template change, to…

6dc0b70

… allow the ARM template to control the VNet and all subnets, and have the Bicep template look them up

EES-4807 - adding Publisher managed identity to public_data db via Co…

0937a88

…ntainer Apps initial migration

duncan-at-hiveit force-pushed the EES-4807-small-tweaks-after-merge branch 2 times, most recently from 96f76d0 to 7cb0043 Compare May 2, 2024 12:37

EES-4807 - amended Public Data DB initial migration to grant table pe…

254d5fc

…rmissions for future tables created in the public_data db to various Managed Identity users

duncan-at-hiveit force-pushed the EES-4807-small-tweaks-after-merge branch from 7cb0043 to 254d5fc Compare May 2, 2024 13:03

duncan-at-hiveit added 2 commits May 2, 2024 14:11

EES-4807 - swapped 3-stage deploy controlled by 2 flags for 2-stage d…

41185b9

…eploy with a single "deployContainerApp" flag instead

EES-4807 - swapped 3-stage deploy controlled by 2 flags for 2-stage d…

d131e6c

…eploy with a single "deployContainerApp" flag instead

duncan-at-hiveit force-pushed the EES-4807-small-tweaks-after-merge branch 2 times, most recently from 19375c1 to 669a617 Compare May 2, 2024 14:23

EES-4807 - adding Publisher subnet to list of subnets allowed to acce…

443d061

…ss PSQL. Added flag to avoid unnecessary PSQL deploys if possible. Added more connection strings to Key Vault and amended KV secret names to reflect existing naming conventions.

duncan-at-hiveit force-pushed the EES-4807-small-tweaks-after-merge branch 2 times, most recently from 9abf33a to cb5c52f Compare May 2, 2024 15:22

EES-4807 - adding missing MiniProfiler iand ParquetFiles configuration

c1ffdd4

duncan-at-hiveit force-pushed the EES-4807-small-tweaks-after-merge branch 3 times, most recently from b46e2e1 to 3d299d8 Compare May 3, 2024 07:53

EES-4807 - adding PSQL subnet to ARM template control

1d36f57

duncan-at-hiveit force-pushed the EES-4807-small-tweaks-after-merge branch 2 times, most recently from 1507d1a to 1d36f57 Compare May 3, 2024 08:46

EES-4807 - returning target branch for Public API Infra build to dev …

3356200

…prior to merging back into dev. Removing references to EES-5052 from Bicep files as we will be replacing VNet integration with Private Endpoint as part of the EES-5052 work.

duncan-at-hiveit force-pushed the EES-4807-small-tweaks-after-merge branch from 24e8fa3 to 3356200 Compare May 3, 2024 08:52

benoutram reviewed May 3, 2024

View reviewed changes

EES-4807 - adding various TODOs referencing infrastructure cleanup ti…

391ea02

…cket

benoutram self-requested a review May 3, 2024 10:36

benoutram approved these changes May 3, 2024

View reviewed changes

duncan-at-hiveit merged commit 92fdf5d into dev May 3, 2024
4 of 7 checks passed

duncan-at-hiveit deleted the EES-4807-small-tweaks-after-merge branch May 3, 2024 10:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Ees 4807 small tweaks after merge #4725

Ees 4807 small tweaks after merge #4725

duncan-at-hiveit commented Mar 28, 2024 •

edited

Loading

benoutram May 3, 2024

duncan-at-hiveit May 3, 2024

benoutram May 3, 2024

duncan-at-hiveit May 3, 2024

benoutram May 3, 2024

duncan-at-hiveit May 3, 2024

benoutram May 3, 2024

duncan-at-hiveit May 3, 2024

		name: 'ParquetFiles__BasePath'
		value: 'data/public-api-parquet'

Ees 4807 small tweaks after merge #4725

Ees 4807 small tweaks after merge #4725

Conversation

duncan-at-hiveit commented Mar 28, 2024 • edited Loading

Optimisation flag for PSQL

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

duncan-at-hiveit commented Mar 28, 2024 •

edited

Loading