[Team Kraken] Deployment Procedure Runbook

Deploy Azure Resources using DevOps pipeline

DevOps pipeline prerequisite

• A “Service Connection” is required for each resource group and environment. This needs to be requested from TC Cloud Team.

• Requires Document Service URL from Team Ninja Turtles

• Azure ObjectID of the team who has to access the keyvault’s

1. Review bicep deployment files (azuredeploy. *) under project repository folder AzureDeployment

   1. Review sku values for resources and update as necessary. The sku values are inside of bicep templates in repository: Infrastructure/AzureDeployment/azuredeploy.*.bicep

   2. In the same bicep files optionally set deployment flag to false if the associated resource did not need to be deployed. It is set to true by default.

2. Configure the variables for each azure resource deployment DevOps pipelines

   1. Edit DevOps pipelines under Pipelines → All → Azure Deployment folder

   2. Configure variables listed for each deployment pipeline in Appendix section 1. For secured variables, need to re-create the value and check “Keep this value secret” checkbox after adding the value

3. Run the first deployment pipeline Azure Resources Deployment 1 (Initial). This will create container registry, keyvault and app service plan resources

4. Create a folder by environment name in DevOps pipeline and clone/create DevOps CI/CD pipelines for Vessel Registry and Shared (Dsd Marine) app services.

5. Configure new cloned/created DevOps CI/CD pipelines for specified resource groups, container image name and container image tag. Then build the pipelines. Please refer to the Appendix section 2 for the container name, image name and image tag.

6. Update the deployment pipeline variables and run the remaining two: Azure Resources Deployment 2 (Safsecsur) and Azure Resources Deployment 3 (Eregistry). Verify the resources has been deployed successfully in Azure Portal → Resource Group → Deployments

7. Add keyvault secrets used for applications from created resources. Please refer to the Appendix section 3 for the required application secrets (Optional: Configure Access Policies in the KeyVault)

8. Create a Variable group in DevOps → Pipelines → Library. Toggle “Link Secrets” option, select appropriate Azure subscription → KeyVault name, add all the necessary keys and save the variable group

9. Add workmanagementservice appservice outbound IP addresses to Postgresql server connection security

10. Link and save the new variable group in all the DevOps CI/CD pipelines

11. Make sure to use the correct branch(Develop/Master) on all the DevOps CI/CD pipelines

12. Migrate LOV Azure Cosmos DB data using Microsoft tool or Console App

13. Create Application Registration for Vessel Registration internal and external websites. Please refer to below Application Registration section.

14. Run DevOps CI/CD pipelines again and verify the applications runs as expected.

Application Registration

Script execution prerequisite

• Install the Azure AD Module

• Make sure you have Application Developer Role

• Make sure you have Local Machine administrative rights

• Make sure KeyVault exists and permission to write to it

• Make sure you have the ability to configure Enterprise Applications in Azure AD

• Make sure you have the ability to grant admin consent in App Registrations

Running the script

The script directory that you were given should contain the following content:

• [Optional] Specify the configuration file path or the script will default to the app-registration-configuration.json in the same directory as the main.ps1 script file.

  • If the configuration file is not in the same directory, then the absolute path must be provided, and theisAbsolutePath switch parameter must be passed to the script

• [Optional] You can specify the Tenant/Directory Id, otherwise, the script will use the current directory your user account is logged in under.

Run PowerShell in administrator mode navigate to the script folder, and execute the following commands:

If not providing the Tenant Id to the script:

.\main.ps1 -environment ['nca', 'ncd', 'nct', 'pcp']

If providing the Tenant Id to the script:

.\main.ps1 -environment ['nca', 'ncd', 'nct', 'pcp'] -tenantId [Guid]

Post Script Execution

• In the newly created Vessel Registry App Registration → Manage → API permissions → click on the Grant admin consent

Appendix

Section1: Variables for Azure resource deployment

Section2: Container Registry related name for app servicesncd|nct|nca|pcp

• Container Registry Name: '{environmentName}{applicationGroup}cr' e.g 'ncdsafsecsurcr'

• Container Registry Image Name: '{environmentName}{applicationGroup}-{applicationName}'

• Container Registry Image Name: '{applicationGroup}-{applicationName}'

EnvironmentName:

ApplicationGroup:

ApplicationName:

Section 3: Application Secrets

App Registration Flowchart

• Script reads the contents of the app-registration-configuration.json and loops over each one of them

  • Script associates owners with the app registration if there are any

  • Script assigns oauth2 permissions with the app registration if there are any

  • Script links any required resource permissions to the app registration

  • Script adds any oauth2 redirect uris to the app registration

  • Script adds certificates or secrets(currently only secrets) to the app registration

  • Repeats the process for each app registration