Skip to content

Commit f745dad

Browse files
jonnyryjonnyry
authored
Merge branch 'main' into jr/upstream-main/107-adminvm-os-image
2 parents 456580d + 0c894bf commit f745dad

File tree

18 files changed

+2116
-1848
lines changed

18 files changed

+2116
-1848
lines changed

‎.github/actions/devcontainer_run_command/action.yml

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,9 +178,19 @@ runs:
178178
- name: Run command in DevContainer
179179
shell: bash
180180
run: |
181+
# Write command to a command.sh script file
182+
cat <<EOF >> ./command.sh
183+
#!/bin/bash
184+
set -x
185+
${{ inputs.COMMAND }}
186+
EOF
187+
188+
chmod +x ./command.sh
189+
181190
docker run --rm --mount \
182191
"type=bind,src=${{ github.workspace }},dst=/workspaces/tre" \
183192
-v /var/run/docker.sock:/var/run/docker.sock \
193+
-v "./command.sh:/workspaces/tre/command.sh" \
184194
--workdir /workspaces/tre \
185195
--user vscode \
186196
-e TF_INPUT="0" \
@@ -246,4 +256,7 @@ runs:
246256
-e TF_VAR_app_gateway_sku=${{ inputs.APP_GATEWAY_SKU }} \
247257
-e E2E_TESTS_NUMBER_PROCESSES="${{ inputs.E2E_TESTS_NUMBER_PROCESSES }}" \
248258
'${{ inputs.CI_CACHE_ACR_NAME }}${{ env.ACR_DOMAIN_SUFFIX }}/tredev:${{ inputs.DEVCONTAINER_TAG }}' \
249-
bash -c "${{ inputs.COMMAND }}"
259+
bash -c -x "./command.sh"
260+
261+
# Clean up temporary script file
262+
rm ./command.sh

‎.github/workflows/deploy_tre_reusable.yml

Lines changed: 40 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -424,9 +424,14 @@ jobs:
424424
uses: ./.github/actions/devcontainer_run_command
425425
with:
426426
# Although porter publish will build automatically, our makefile build target includes logic that should run
427-
COMMAND: >-
428-
for i in {1..3}; do make bundle-build bundle-publish DIR=${{ matrix.BUNDLE_DIR }}
429-
&& ec=0 && break || ec=\$? && sleep 30; done; (exit \$ec)
427+
COMMAND: |
428+
# Loop to retry the make command up to 3 times
429+
for i in {1..3}; do
430+
make bundle-build bundle-publish DIR=${{ matrix.BUNDLE_DIR }} && ec=0 && break || ec=\$? && sleep 30;
431+
done;
432+
433+
# Exit with the last status code
434+
(exit \$ec)
430435
DEVCONTAINER_TAG: ${{ inputs.DEVCONTAINER_TAG }}
431436
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
432437
AZURE_ENVIRONMENT: ${{ vars.AZURE_ENVIRONMENT }}
@@ -470,9 +475,14 @@ jobs:
470475
uses: ./.github/actions/devcontainer_run_command
471476
with:
472477
# Although porter publish will build automatically, our makefile build target includes logic that should run
473-
COMMAND: >-
474-
for i in {1..3}; do make bundle-build bundle-publish DIR=${{ matrix.BUNDLE_DIR }}
475-
&& ec=0 && break || ec=\$? && sleep 30; done; (exit \$ec)
478+
COMMAND: |
479+
# Loop to retry the make command up to 3 times
480+
for i in {1..3}; do
481+
make bundle-build bundle-publish DIR=${{ matrix.BUNDLE_DIR }} && ec=0 && break || ec=\$? && sleep 30;
482+
done
483+
484+
# Exit with the last status code
485+
(exit \$ec)
476486
DEVCONTAINER_TAG: ${{ inputs.DEVCONTAINER_TAG }}
477487
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
478488
AZURE_ENVIRONMENT: ${{ vars.AZURE_ENVIRONMENT }}
@@ -514,9 +524,14 @@ jobs:
514524
- name: Register bundle
515525
uses: ./.github/actions/devcontainer_run_command
516526
with:
517-
COMMAND: >-
518-
for i in {1..3}; do make bundle-register DIR=${{ matrix.BUNDLE_DIR }}
519-
&& ec=0 && break || ec=\$? && sleep 10; done; (exit \$ec)
527+
COMMAND: |
528+
# Loop to retry the make command up to 3 times
529+
for i in {1..3}; do
530+
make bundle-register DIR=${{ matrix.BUNDLE_DIR }} && ec=0 && break || ec=\$? && sleep 10;
531+
done
532+
533+
# Exit with the last status code
534+
(exit \$ec)
520535
DEVCONTAINER_TAG: ${{ inputs.DEVCONTAINER_TAG }}
521536
CI_CACHE_ACR_NAME: ${{ secrets.CI_CACHE_ACR_NAME}}
522537
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
@@ -574,9 +589,14 @@ jobs:
574589
- name: Register bundle
575590
uses: ./.github/actions/devcontainer_run_command
576591
with:
577-
COMMAND: >-
578-
for i in {1..3}; do make bundle-register DIR=${{ matrix.BUNDLE_DIR }}
579-
&& ec=0 && break || ec=\$? && sleep 10; done; (exit \$ec)
592+
COMMAND: |
593+
# Loop to retry the make command up to 3 times
594+
for i in {1..3}; do
595+
make bundle-register DIR=${{ matrix.BUNDLE_DIR }} && ec=0 && break || ec=\$? && sleep 10;
596+
done;
597+
598+
# Exit with the last status code
599+
(exit \$ec)
580600
DEVCONTAINER_TAG: ${{ inputs.DEVCONTAINER_TAG }}
581601
CI_CACHE_ACR_NAME: ${{ secrets.CI_CACHE_ACR_NAME}}
582602
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
@@ -623,9 +643,14 @@ jobs:
623643
- name: Register bundle
624644
uses: ./.github/actions/devcontainer_run_command
625645
with:
626-
COMMAND: >-
627-
for i in {1..3}; do make bundle-register DIR=${{ matrix.BUNDLE_DIR }}
628-
&& ec=0 && break || ec=\$? && sleep 10; done; (exit \$ec)
646+
COMMAND: |
647+
# Loop to retry the make command up to 3 times
648+
for i in {1..3}; do
649+
make bundle-register DIR=${{ matrix.BUNDLE_DIR }} && ec=0 && break || ec=\$? && sleep 10;
650+
done;
651+
652+
# Exit with the last status code
653+
(exit \$ec)
629654
DEVCONTAINER_TAG: ${{ inputs.DEVCONTAINER_TAG }}
630655
CI_CACHE_ACR_NAME: ${{ secrets.CI_CACHE_ACR_NAME}}
631656
AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}

‎CHANGELOG.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,18 @@
44
**BREAKING CHANGES & MIGRATIONS**:
55

66
ENHANCEMENTS:
7-
* Add Windows image field to the Admin VM template ([#4274](https://github.com/microsoft/AzureTRE/pull/4274))
7+
* Core key vault firewall should not be set to "Allow public access from all networks" ([#4250](https://github.com/microsoft/AzureTRE/issues/4250))
88
* Allow workspace App Service Plan SKU to be updated ([#4331](https://github.com/microsoft/AzureTRE/issues/4331))
99
* Add core requests endpoint and UI to enable requests to be managed TRE wide. ([[#2510](https://github.com/microsoft/AzureTRE/issues/2510)])
1010
* Remove public IP from TRE's firewall when forced tunneling is configured ([#4346](https://github.com/microsoft/AzureTRE/pull/4346))
1111
* Upgrade AzureRM Terraform provider from `3.117.0` to `4.14.0`. ([[#4255](https://github.com/microsoft/AzureTRE/pull/4255/)])
1212
* Subnet definitions are now inline in the `azurerm_virtual_network` resource, and NSG associations are set using `security_group` in each subnet block (no separate `azurerm_subnet_network_security_group_association` needed). ([[#4255](https://github.com/microsoft/AzureTRE/pull/4255/)])
13+
* Azure Cosmos DB should disable public network access ([#4322](https://github.com/microsoft/AzureTRE/issues/4322))
14+
* Add Windows image field to the Admin VM template ([#4274](https://github.com/microsoft/AzureTRE/pull/4274))
1315

1416
BUG FIXES:
1517
* Fix upgrade when porter install has failed ([#4338](https://github.com/microsoft/AzureTRE/pull/4338))
1618

17-
18-
1919
COMPONENTS:
2020

2121
## 0.20.0 (Feburary 9, 2025)

‎core/terraform/cosmos_mongo.tf

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
resource "azurerm_cosmosdb_account" "mongo" {
2-
name = "cosmos-mongo-${var.tre_id}"
3-
location = azurerm_resource_group.core.location
4-
resource_group_name = azurerm_resource_group.core.name
5-
offer_type = "Standard"
6-
kind = "MongoDB"
7-
automatic_failover_enabled = false
8-
mongo_server_version = 4.2
9-
ip_range_filter = local.cosmos_ip_filter_set
2+
name = "cosmos-mongo-${var.tre_id}"
3+
location = azurerm_resource_group.core.location
4+
resource_group_name = azurerm_resource_group.core.name
5+
offer_type = "Standard"
6+
kind = "MongoDB"
7+
automatic_failover_enabled = false
8+
mongo_server_version = 4.2
9+
ip_range_filter = local.cosmos_ip_filter_set
10+
public_network_access_enabled = var.enable_local_debugging
1011

1112
capabilities {
1213
name = "EnableServerless"

‎core/terraform/deploy.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ set -o pipefail
55
set -o nounset
66
# set -o xtrace
77

8+
# shellcheck disable=SC1091
9+
source "../../devops/scripts/kv_add_network_exception.sh"
10+
811
# This is where we can migrate any Terraform before we plan and apply
912
# For instance deprecated Terraform resources
1013
# shellcheck disable=SC1091

‎core/terraform/destroy.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ set -o pipefail
55
set -o nounset
66
# set -o xtrace
77

8+
# shellcheck disable=SC1091
9+
source "../../devops/scripts/kv_add_network_exception.sh"
10+
811
# These variables are loaded in for us
912
# shellcheck disable=SC2154
1013
../../devops/scripts/terraform_wrapper.sh -g "${TF_VAR_mgmt_resource_group_name}" \

‎core/terraform/keyvault.tf

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
resource "azurerm_key_vault" "kv" {
2-
name = "kv-${var.tre_id}"
2+
name = local.kv_name
33
tenant_id = data.azurerm_client_config.current.tenant_id
44
location = azurerm_resource_group.core.location
55
resource_group_name = azurerm_resource_group.core.name
@@ -8,7 +8,27 @@ resource "azurerm_key_vault" "kv" {
88
purge_protection_enabled = var.kv_purge_protection_enabled
99
tags = local.tre_core_tags
1010

11-
lifecycle { ignore_changes = [access_policy, tags] }
11+
public_network_access_enabled = local.kv_public_network_access_enabled
12+
13+
network_acls {
14+
default_action = local.kv_network_default_action
15+
bypass = local.kv_network_bypass
16+
ip_rules = [local.myip] # exception for deployment IP, this is removed in kv_remove_network_exception.sh
17+
}
18+
19+
lifecycle {
20+
ignore_changes = [access_policy, tags]
21+
}
22+
23+
# create provisioner required due to https://github.com/hashicorp/terraform-provider-azurerm/issues/18970
24+
#
25+
provisioner "local-exec" {
26+
when = create
27+
command = <<EOT
28+
az keyvault update --name ${local.kv_name} --public-network-access ${local.kv_public_network_access_enabled ? "Enabled" : "Disabled"} --default-action ${local.kv_network_default_action} --bypass "${local.kv_network_bypass}" --output none
29+
az keyvault network-rule add --name ${local.kv_name} --ip-address ${local.myip} --output none
30+
EOT
31+
}
1232
}
1333

1434
resource "azurerm_role_assignment" "keyvault_deployer_role" {

‎core/terraform/locals.tf

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,16 @@ locals {
1616
# https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-firewall#allow-requests-from-the-azure-portal
1717

1818
azure_portal_cosmos_ips_list = [
19-
"104.42.195.92",
20-
"40.76.54.131",
21-
"52.176.6.30",
22-
"52.169.50.45",
23-
"52.187.184.26"
19+
"13.91.105.215",
20+
"4.210.172.107",
21+
"13.88.56.148",
22+
"40.91.218.243"
2423
]
2524

2625
cosmos_ip_filter_set = toset(
2726
var.enable_local_debugging
2827
? concat(local.azure_portal_cosmos_ips_list, [local.myip])
29-
: local.azure_portal_cosmos_ips_list
28+
: []
3029
)
3130

3231
# we define some zones in core despite not used by the core infra because
@@ -59,4 +58,10 @@ locals {
5958

6059
cmk_name = "tre-encryption-${var.tre_id}"
6160
encryption_identity_name = "id-encryption-${var.tre_id}"
61+
62+
# key vault variables
63+
kv_name = "kv-${var.tre_id}"
64+
kv_public_network_access_enabled = true
65+
kv_network_default_action = var.enable_local_debugging ? "Allow" : "Deny"
66+
kv_network_bypass = "AzureServices"
6267
}

‎core/terraform/scripts/letsencrypt.sh

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@ if [[ -z ${STORAGE_ACCOUNT} ]]; then
88
exit 1
99
fi
1010

11+
if [[ -n ${KEYVAULT} ]]; then
12+
# shellcheck disable=SC1091
13+
source "$script_dir/../../../devops/scripts/kv_add_network_exception.sh"
14+
fi
15+
1116
# The storage account is protected by network rules
1217
#
1318
# The rules need to be temporarily lifted so that the script can determine if the index.html file

‎core/terraform/statestore.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,11 @@ resource "azurerm_cosmosdb_account" "tre_db_account" {
55
offer_type = "Standard"
66
kind = "GlobalDocumentDB"
77
automatic_failover_enabled = false
8+
public_network_access_enabled = var.enable_local_debugging
89
ip_range_filter = local.cosmos_ip_filter_set
910
local_authentication_disabled = true
1011
tags = local.tre_core_tags
12+
1113
dynamic "capabilities" {
1214
# We can't change an existing cosmos
1315
for_each = var.is_cosmos_defined_throughput ? [] : [1]

‎core/version.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
__version__ = "0.12.0"
1+
__version__ = "0.12.2"

‎devops/scripts/destroy_env_no_terraform.sh

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,11 @@ then
6666
no_wait_option="--no-wait"
6767
fi
6868

69+
script_dir=$(realpath "$(dirname "${BASH_SOURCE[0]}")")
70+
71+
# shellcheck disable=SC1091
72+
source "$script_dir/kv_add_network_exception.sh"
73+
6974
group_show_result=$(az group show --name "${core_tre_rg}" > /dev/null 2>&1; echo $?)
7075
if [[ "$group_show_result" != "0" ]]; then
7176
echo "Resource group ${core_tre_rg} not found - skipping destroy"

‎devops/scripts/key_vault_list.sh

Lines changed: 0 additions & 17 deletions
This file was deleted.

0 commit comments

Comments
 (0)