[Team Kraken] Deployment Procedure Runbook

Deploy Azure Resources using DevOps pipeline

DevOps pipeline prerequisite

• A “Service Connection” is required for each resource group and environment. This needs to be requested from TC Cloud Team.

• Requires Document Service URL from Team Ninja Turtles

• Azure ObjectID of the team who has to access the keyvault’s

1. Review bicep deployment files (azuredeploy. *) under project repository folder AzureDeployment

   1. Review sku values for resources and update as necessary. The sku values are inside of bicep templates in repository: Infrastructure/AzureDeployment/azuredeploy.*.bicep

   2. In the same bicep files optionally set deployment flag to false if the associated resource did not need to be deployed. It is set to true by default.

2. Configure the variables for each azure resource deployment DevOps pipelines

   1. Edit DevOps pipelines under Pipelines → All → Azure Deployment folder

   2. Configure variables listed for each deployment pipeline in Appendix section 1. For secured variables, need to re-create the value and check “Keep this value secret” checkbox after adding the value

3. Run the first deployment pipeline Azure Resources Deployment 1 (Initial). This will create container registry, keyvault and app service plan resources

4. Create a folder by environment name in DevOps pipeline and clone/create DevOps CI/CD pipelines in TK and TNT DevOps project.

5. Configure new cloned/created DevOps CI/CD pipelines for specified resource groups, container image name and container image tag. Then build the pipelines. Please refer to the Appendix section 2 for the container name, image name and image tag.

6. Update the deployment pipeline variables and run the remaining two: Azure Resources Deployment 2 (Safsecsur) and Azure Resources Deployment 3 (Eregistry). Verify the resources has been deployed successfully in Azure Portal → Resource Group → Deployments

7. Add keyvault secrets used for applications from created resources. Please refer to the Appendix section 3 for the required application secrets (Optional: Configure Access Policies in the KeyVault)

8. Create a Variable group in DevOps → Pipelines → Library. Toggle “Link Secrets” option, select appropriate Azure subscription → KeyVault name, add all the necessary keys and save the variable group

9. Repeat above step in TNT project

10. Add workmanagementservice appservice outbound IP addresses to Postgresql server connection security (Optional: Have to do this for documentmanagement service too)

11. Run Vesselregistry and document service database script

12. On all appservices, need to turn off & on continuous integration, save it. This should be done in order to create a webhook in container registry

13. Disable public access to blob on storageaccount

14. Add/Create a “Diagnostics Settings” to all the appservices on Azure portal

15. Turn-on Identity in document api appservice and add the object id to safsecsur keyvault access policy

16. Link and save the new variable group in all the DevOps CI/CD pipelines

17. Make sure to use the correct branch(Develop/Master) on all the DevOps CI/CD pipelines

18. Migrate LOV Azure Cosmos DB data using Microsoft tool or Console App

19. Create Application Registration for Vessel Registration internal and external websites. Please refer to below Application Registration section.

20. Run DevOps CI/CD pipelines of TK and TNT again and verify the applications runs as expected.

21. Configure the App Configuration Resource [Applicable only for the NCD / PCP Environments] after completing the deployment of Azure Resources Deployment 1 (Initial) and Azure Resources Deployment 2 (Safsecsur).

    1. In the [nprd/prod]-vrappconfig App Configuration / Settings / Identity / System assigned → Copy the Object (principal) ID

    2. In the [environment]eregistrykv / Settings / Keys → Click the Generate/Import button, and use the following configuration:

       1. Options: Generate

       2. Name: [nprd / prod]-vr-appconfiguration-key

       3. Key type: RSA

       4. RSA key size 4096

       5. Enabled: Yes

    3. Under [environment]eregistrykv / Settings / Access policies → Click the Add Access Policy and apply the following settings

       1. Key permissions → Get, Unwrap, Wrap

       2. Select principal → Search for the Object (principal) ID you copied from step a

    4. In the [nprd/prod]-vrappconfig App Configuration / Settings / Encryption → Check the “Customer Managed Key“ and apply the following settings:

       1. Identity: System assigned

       2. Encryption Key: Select from Key Vault

       3. Key Vault:

          1. Subscription: NPRD / PROD

          2. Key vault: [environment]eregistrykv

          3. Key: [nprd / prod]-vr-appconfiguration-key

       4. Ensure you save the encryption settings

Application Registration

Script execution prerequisite

• Install the Azure AD Module

• Make sure you have Application Developer Role

• Make sure you have Local Machine administrative rights

• Make sure KeyVault exists and permission to write to it

• Make sure you have the ability to configure Enterprise Applications in Azure AD

• Make sure you have the ability to grant admin consent in App Registrations

Running the script

The script directory that you were given should contain the following content:

• [Optional] Specify the configuration file path or the script will default to the app-registration-configuration.json in the same directory as the main.ps1 script file.

  • If the configuration file is not in the same directory, then the absolute path must be provided, and theisAbsolutePath switch parameter must be passed to the script

• [Optional] You can specify the Tenant/Directory Id, otherwise, the script will use the current directory your user account is logged in under.

Run PowerShell in administrator mode navigate to the script folder, and execute the following commands:

If not providing the Tenant Id to the script:

If providing the Tenant Id to the script:

Post Script Execution

• In the newly created Vessel Registry App Registration → Manage → API permissions → click on the Grant admin consent

Appendix

Section1: Variables for Azure resource deployment

Section2: Container Registry related name for app servicesncd|nct|nca|pcp

• Container Registry Name: '{environmentName}safsecsurcr' e.g 'ncdsafsecsurcr'

• Container Registry Image Name: '{environmentName}safsecsur-{servicename}'

• Container Registry Image Tag: 'safsecsur-{servicename}'

EnvironmentName:

TargetEnvironment:

ApplicationGroup:

ApplicationName:

Section 3: Application Secrets

App Registration Flowchart

• Script reads the contents of the app-registration-configuration.json and loops over each one of them

  • Script associates owners with the app registration if there are any

  • Script assigns oauth2 permissions with the app registration if there are any

  • Script links any required resource permissions to the app registration

  • Script adds any oauth2 redirect uris to the app registration

  • Script adds certificates or secrets(currently only secrets) to the app registration

  • Repeats the process for each app registration

Open