This setup is to allow automated provisioning of the ACM@UIC's cloud services. The main goal of this project is to maintain and deploy the majority of our infrastructure with minimal setup.
The idea is to define Infrastructure as Code (IAC). This allows DevOps and SysAdmin Engineers to easily understand configuration in a uniform way.
- CI/CD Platform (GitHub Actions)
The CI/CD platform will need to be configured with the appropriate authorization to make changes to the cloud infrastructure. This must be done before pipelines can run. Note that this needs to be only performed once per cloud tenant.
In Azure, these are setup by creating a Service Principal with role-based authentication control. Reference documentation Using the CLI is the quickest way to perform this action. Assuming you are already logged into the CLI, you can run the following invocation to create the Service Principal
# Create Service Principal and configure its access to Azure resources.
az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/SUBSCRIPTION_ID" --name terraform-svc
This should result in a response similar to this:
$ az ad sp create-for-rbac --role="Contributor" --scopes="/subscriptions/SUBSCRIPTION_ID" --name terraform-svc
The output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. For more information, see https://aka.ms/azadsp-cli
{
"appId": "00XXXXXX-XXXX-XXXX-xxxx-XXXXXXXXXX",
"displayName": "terraform-svc",
"password": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
"tenant": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
}
Once the service principal is created, store the following secrets:
AZURE_AD_CLIENT_ID– This will be theappIdfrom aboveAZURE_AD_TENANT_ID– The Azure AD tenant ID to where the service principal was created. This is thetenantfrom above.AZURE_SUBSCRIPTION_ID– Subscription ID of where you want to deploy the Terraform. This can be found in the output ofaz account subscription list.
# Create federated credentials for the service principal
az rest --method POST --uri 'https://graph.microsoft.com/beta/applications/<APPLICATION-OBJECT-ID>/federatedIdentityCredentials' --body '{"name":"acm-uic-iac-main","issuer":"https://token.actions.githubusercontent.com","subject":"repo:acm-uic/IaC:ref:refs/heads/main","description":"","audiences":["api://AzureADTokenExchange"]}'
az rest --method POST --uri 'https://graph.microsoft.com/beta/applications/<APPLICATION-OBJECT-ID>/federatedIdentityCredentials' --body '{"name":"acm-uic-iac-pulls","issuer":"https://token.actions.githubusercontent.com","subject":"repo:acm-uic/IaC:pull_request","description":"","audiences":["api://AzureADTokenExchange"]}'
az rest --method POST --uri 'https://graph.microsoft.com/beta/applications/<APPLICATION-OBJECT-ID>/federatedIdentityCredentials' --body '{"name":"acm-uic-iac-env-prod","issuer":"https://token.actions.githubusercontent.com","subject":"repo:acm-uic/IaC:environment:prod","description":"","audiences":["api://AzureADTokenExchange"]}'
Once the secrets are in place, ensure the appropriate pipelines have permission to access these secrets. They can usually be defined as environment variables for use by the pipelines.
This is a quick summary of each stack for the Azure Cloud Platform.
| Type | Name | Description |
|---|---|---|
| Terraform | acm-general | Deploys the assets in the acm-general resource group |