azure / azure-spring-apps-landing-zone-accelerator

The Azure Spring Apps landing zone accelerator is an open-source collection of architectural guidance and reference implementation to accelerate deployment of Azure Spring Apps at scale.

Azure Spring Apps Landing Zone Accelerator

Azure Landing Zone Accelerators are architectural guidance, reference architecture, reference implementations and automation packaged to deploy workload platforms on Azure at Scale and aligned with industry proven practices.

Azure Spring apps Landing Zone Accelerator represents the strategic design path and target technical state for an Azure Spring Apps Service deployment.

This repository provides packaged guidance for customer scenarios, reference architecture, reference implementation, tooling, design area guidance, sample spring apps deployed after provisioning the infrastructure using the accelerator. The architectural approach can be used as design guidance for greenfield implementation and as an assessment for brownfield customers already using Spring boot apps.

Enterprise-Scale Architecture

The enterprise architecture is broken down into key design areas, where you can find the links to each at:

Design Area	Considerations and Recommendations
Identity and Access Management	Design Considerations and Recommendations
Network Topology and Connectivity	Design Considerations and Recommendations
Management and Monitoring	Design Considerations and Recommendations
Security, Governance, and Compliance	Design Considerations and Recommendations

Enterprise-Scale Reference Implementation

This repository contains instructions for creating an Azure Spring Apps reference architecture that can be used for deploying Spring Boot applications in a typical enterprise landing zone design. It uses a hub and spoke architecture with a single spoke. East/West traffic (traffic between resources in the hub and resources in the spoke) is filtered with Network Security Groups and North/South traffic (traffic between the Internet and resources in the hub or spoke) is routed through and mediated with an instance of Azure Firewall.

• Azure Spring Apps is deployed using vnet-injection to allow for mediation inbound and outbound traffic to the Azure Spring Apps Instance and deployed applications.
• The Azure Firewall instance has been configured to write its logs to a Log Analytics Workspace. You can leverage these Kusto queries to analyze Azure Firewall log data written to Log Analytics.
• Hub and Spoke Virtual Networks are configured to use Azure Firewall for DNS queries utilizing the DNS Proxy feature of Azure Firewall.
• Azure Private DNS zones for Azure Spring Apps and support services deployed with Private Endpoints
• A single Windows Server 2022 Virtual Machine the hub Virtual Network for testing access to applications deployed into the Azure Spring Apps instance. This virtual machine is configured with the Microsoft Monitoring Agent and is integrated with the Log Analytics Workspace. This VM is not exposed to the internet and is only accessible via Azure Bastion (for brevity, both the VM and Azure Bastion are not shown in the diagram).
• Log Analytics Workspace where Azure Spring Apps, Azure Firewall, and the virtual machine deliver logs and metrics.
• Instance of Azure Key Vault deployed with a Private Endpoint for secrets and certificates storage for applications deployed to Azure Spring Apps
• Instance of Azure Bastion for connection to the Windows Server 2022 virtual machine running in the hub virtual network.

For Azure Spring Apps Standard SKU:

• Instance of Azure Database for MySQL flexible server deployed with VNET Integration. This can be used to deploy the PetClinic sample app described in this document.

For Azure Spring Apps Enterprise SKU:

• Instance of Azure Database for PostgreSQL flexible server deployed with VNET Integration and Azure Cache for Redis with Private endpoint.

Next Steps to implement Azure Spring Apps Landing Zone Accelerator

Pick the below scenario to get started on a reference implementation.

▶️ Azure Spring Apps Secure Baseline

Deployment Details:

Azure Spring Apps SKU	Deployment Methodology	GitHub Actions
Standard	Terraform	Published
	Bicep	Power shell available, GitHub Actions Coming soon
Enterprise	Terraform	Published
	Bicep	Power shell available, GitHub Actions Coming soon

Got a feedback

Please leverage issues if you have any feedback or request on how we can improve on this repository.

Data Collection

The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft's privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkId=521839. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.

Telemetry Configuration

Telemetry collection is on by default.

To opt-out, set the variable enableTelemetry to false in Bicep/ARM file and disable_terraform_partner_id to false on Terraform files.

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

azure-spring-apps-landing-zone-accelerator's Issues

Suggestion for variable renaming

I used this to reference how to build Azure Spring Cloud through Terraform. It was very helpful. I would however suggest some variable name changes. The variables imply it should be a route id which doesn't exist instead of the route table id. which does exist.

sc_default_apps_route ---> sc_default_apps_route_table_id
sc_default_runtime_route ---> sc_default_runtime_route_table_id

https://github.com/Azure/azure-spring-cloud-reference-architecture/blob/8d735cce1a774d928739c09d42af014062369e9f/terraform/modules/azure_spring_cloud/variables.tf#L18
https://github.com/Azure/azure-spring-cloud-reference-architecture/blob/8d735cce1a774d928739c09d42af014062369e9f/terraform/modules/azure_spring_cloud/variables.tf#L18

Can't acess spring cloud app after deploying

I am unable to access the spring cloud app I deployed using this terraform config. The test endpoint is showing 'connect failed' is there a way to fix this.

Terraform is unable to add routes to route tables generated by Azure Spring Cloud

module.spring_cloud.azurerm_spring_cloud_service.sc: Creation complete after 10m8s [id=/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.AppPlatform/Spring/spring-z935fmp1e2whx]
module.spring_cloud.data.azurerm_lb.svc_load_balancer: Reading...
module.spring_cloud.time_sleep.wait_90_seconds: Creating...
module.spring_cloud.azurerm_monitor_diagnostic_setting.sc_diag: Creating...
module.spring_cloud.data.azurerm_lb.svc_load_balancer: Read complete after 1s [id=/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/spring-z935fmp1e2whx-runtime-rg/providers/Microsoft.Network/loadBalancers/kubernetes-internal]
module.spring_cloud.azurerm_private_dns_a_record.a_record: Creating...
module.spring_cloud.azurerm_private_dns_a_record.a_record: Creation complete after 2s [id=/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.Network/privateDnsZones/private.azuremicroservices.io/A/*]
module.spring_cloud.azurerm_monitor_diagnostic_setting.sc_diag: Creation complete after 6s [id=/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.AppPlatform/Spring/spring-z935fmp1e2whx|monitoring]
module.spring_cloud.time_sleep.wait_90_seconds: Still creating... [10s elapsed]
module.spring_cloud.time_sleep.wait_90_seconds: Still creating... [20s elapsed]
module.spring_cloud.time_sleep.wait_90_seconds: Still creating... [30s elapsed]
module.spring_cloud.time_sleep.wait_90_seconds: Still creating... [40s elapsed]
module.spring_cloud.time_sleep.wait_90_seconds: Still creating... [50s elapsed]
module.spring_cloud.time_sleep.wait_90_seconds: Still creating... [1m0s elapsed]
module.spring_cloud.time_sleep.wait_90_seconds: Still creating... [1m10s elapsed]
module.spring_cloud.time_sleep.wait_90_seconds: Still creating... [1m20s elapsed]
module.spring_cloud.time_sleep.wait_90_seconds: Creation complete after 1m30s [id=2021-01-18T03:07:58Z]
module.spring_cloud.data.azurerm_resources.route_table_runtime: Reading...
module.spring_cloud.data.azurerm_resources.route_table_apps: Reading...
module.spring_cloud.data.azurerm_resources.route_table_runtime: Read complete after 1s [id=resource-e12401cf-6838-43c2-9370-ee0b1bd1c12e]
module.spring_cloud.data.azurerm_resources.route_table_apps: Read complete after 1s [id=resource-c2ed237a-9d39-4df2-abca-8cbdea9b718e]

Error: Invalid index

  on modules/azure_spring_cloud/main.tf line 111, in resource "azurerm_route" "default_egress_apps":
 111:   route_table_name              = data.azurerm_resources.route_table_apps.resources[0].name
    |----------------
    | data.azurerm_resources.route_table_apps.resources is empty list of object

The given key does not identify an element in this collection value.


Error: Invalid index

  on modules/azure_spring_cloud/main.tf line 135, in resource "azurerm_route" "default_egress_runtime":
 135:   route_table_name              = data.azurerm_resources.route_table_runtime.resources[0].name
    |----------------
    | data.azurerm_resources.route_table_runtime.resources is empty list of object

The given key does not identify an element in this collection value.

Network route table errors out

ArgumentUsageError: argument --route-table-name: expected one argument
Try this: 'az network route-table route create -g spring-o76hh6c1q6ugt-apps-rg --route-table-name <MyRouteTable> -n default --next-hop-type VirtualAppliance --address-prefix 0.0.0.0/0 --next-hop-ip-address 10.9.0.4'
Still stuck? Run 'az network route-table route create --help' to view all commands or go to 'https://aka.ms/cli_ref' to learn more
This command is implicitly deprecated because command group 'network route-table' is deprecated and will be removed in a future release. Use 'network vhub route-table' instead.
ArgumentUsageError: argument --route-table-name: expected one argument
Try this: 'az network route-table route create -g spring-o76hh6c1q6ugt-runtime-rg --route-table-name <MyRouteTable> -n default --next-hop-type VirtualAppliance --address-prefix 0.0.0.0/0 --next-hop-ip-address 10.9.0.4'
Still stuck? Run 'az network route-table route create --help' to view all commands or go to 'https://aka.ms/cli_ref' to learn more
{- Finished ..
  "etag": "20cbe94d-cf15-4f6a-870f-e9b00f5770a8",
  "id": "/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.Network/privateDnsZones/private.azuremicroservices.io",
  "location": "global",
  "maxNumberOfRecordSets": 25000,
  "maxNumberOfVirtualNetworkLinks": 1000,
  "maxNumberOfVirtualNetworkLinksWithRegistration": 100,
  "name": "private.azuremicroservices.io",
  "numberOfRecordSets": 1,
  "numberOfVirtualNetworkLinks": 0,
  "numberOfVirtualNetworkLinksWithRegistration": 0,
  "provisioningState": "Succeeded",
  "resourceGroup": "sc-corp-rg",
  "tags": null,
  "type": "Microsoft.Network/privateDnsZones"
}
{- Finished ..
  "etag": "\"5f003339-0000-0100-0000-600620df0000\"",
  "id": "/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.Network/privateDnsZones/private.azuremicroservices.io/virtualNetworkLinks/link-to-vnet-spoke",
  "location": "global",
  "name": "link-to-vnet-spoke",
  "provisioningState": "Succeeded",
  "registrationEnabled": false,
  "resourceGroup": "sc-corp-rg",
  "tags": null,
  "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
  "virtualNetwork": {
    "id": "/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.Network/virtualNetworks/vnet-spoke",
    "resourceGroup": "sc-corp-rg"
  },
  "virtualNetworkLinkState": "Completed"
}
{- Finished ..
  "etag": "\"5f00a33b-0000-0100-0000-600621070000\"",
  "id": "/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.Network/privateDnsZones/private.azuremicroservices.io/virtualNetworkLinks/link-to-vnet-hub",
  "location": "global",
  "name": "link-to-vnet-hub",
  "provisioningState": "Succeeded",
  "registrationEnabled": false,
  "resourceGroup": "sc-corp-rg",
  "tags": null,
  "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
  "virtualNetwork": {
    "id": "/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.Network/virtualNetworks/vnet-hub",
    "resourceGroup": "sc-corp-rg"
  },
  "virtualNetworkLinkState": "Completed"
}
{
  "aRecords": [
    {
      "ipv4Address": "10.8.0.6"
    }
  ],
  "etag": "7b7afc08-4bda-4e3d-8ef6-d62b6ed118e4",
  "fqdn": "*.private.azuremicroservices.io.",
  "id": "/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.Network/privateDnsZones/private.azuremicroservices.io/A/*",
  "isAutoRegistered": false,
  "metadata": null,
  "name": "*",
  "resourceGroup": "sc-corp-rg",
  "ttl": 3600,
  "type": "Microsoft.Network/privateDnsZones/A"
}

Add bash script for full deployment of Terraform secure baseline

Provider for 03-LZ-NETWORK 'hub' needed

Hello,

I am deploying the 03 module and I was getting this error.
2023-04-16T10:31:20.2842118Z �[31m│�[0m �[0m�[1m�[31mError: �[0m�[0m�[1mProvider configuration not present�[0m 2023-04-16T10:31:20.2847863Z �[31m│�[0m �[0m 2023-04-16T10:31:20.2850796Z �[31m│�[0m �[0m�[0mTo work with azurerm_public_ip.azure_bastion (orphan) its original provider 2023-04-16T10:31:20.2855544Z �[31m│�[0m �[0mconfiguration at provider["registry.terraform.io/hashicorp/azurerm"].hub is 2023-04-16T10:31:20.2856068Z �[31m│�[0m �[0mrequired, but it has been removed. This occurs when a provider 2023-04-16T10:31:20.2858758Z �[31m│�[0m �[0mconfiguration is removed while objects created by that provider still exist 2023-04-16T10:31:20.2859307Z �[31m│�[0m �[0min the state. Re-add the provider configuration to destroy 2023-04-16T10:31:20.2859774Z �[31m│�[0m �[0mazurerm_public_ip.azure_bastion (orphan), after which you can remove the 2023-04-16T10:31:20.2860166Z �[31m│�[0m �[0mprovider configuration again. 2023-04-16T10:31:20.2860491Z �[31m╵�[0m�[0m 2023-04-16T10:31:20.2860734Z �[31m╷�[0m�[0m 2023-04-16T10:31:20.2861102Z �[31m│�[0m �[0m�[1m�[31mError: �[0m�[0m�[1mProvider configuration not present�[0m 2023-04-16T10:31:20.2861418Z �[31m│�[0m �[0m 2023-04-16T10:31:20.2861835Z �[31m│�[0m �[0m�[0mTo work with azurerm_bastion_host.azure_bastion_instance (orphan) its 2023-04-16T10:31:20.2862266Z �[31m│�[0m �[0moriginal provider configuration at 2023-04-16T10:31:20.2862713Z �[31m│�[0m �[0mprovider["registry.terraform.io/hashicorp/azurerm"].hub is required, but it 2023-04-16T10:31:20.2863193Z �[31m│�[0m �[0mhas been removed. This occurs when a provider configuration is removed 2023-04-16T10:31:20.2863712Z �[31m│�[0m �[0mwhile objects created by that provider still exist in the state. Re-add the 2023-04-16T10:31:20.2864091Z �[31m│�[0m �[0mprovider configuration to destroy 2023-04-16T10:31:20.2864528Z �[31m│�[0m �[0mazurerm_bastion_host.azure_bastion_instance (orphan), after which you can 2023-04-16T10:31:20.2865007Z �[31m│�[0m �[0mremove the provider configuration again. 2023-04-16T10:31:20.2865321Z �[31m╵�[0m�[0m 2023-04-16T10:31:20.2865557Z �[31m╷�[0m�[0m 2023-04-16T10:31:20.2865935Z �[31m│�[0m �[0m�[1m�[31mError: �[0m�[0m�[1mProvider configuration not present�[0m 2023-04-16T10:31:20.2866267Z �[31m│�[0m �[0m 2023-04-16T10:31:20.2866575Z �[31m│�[0m �[0m�[0mTo work with 2023-04-16T10:31:20.2866993Z �[31m│�[0m �[0mazurerm_subnet_network_security_group_association.bastion_nsg_assoc 2023-04-16T10:31:20.2867445Z �[31m│�[0m �[0m(orphan) its original provider configuration at 2023-04-16T10:31:20.2867918Z �[31m│�[0m �[0mprovider["registry.terraform.io/hashicorp/azurerm"].hub is required, but it 2023-04-16T10:31:20.2868418Z �[31m│�[0m �[0mhas been removed. This occurs when a provider configuration is removed 2023-04-16T10:31:20.2868907Z �[31m│�[0m �[0mwhile objects created by that provider still exist in the state. Re-add the 2023-04-16T10:31:20.2869337Z �[31m│�[0m �[0mprovider configuration to destroy 2023-04-16T10:31:20.2869793Z �[31m│�[0m �[0mazurerm_subnet_network_security_group_association.bastion_nsg_assoc 2023-04-16T10:31:20.2870306Z �[31m│�[0m �[0m(orphan), after which you can remove the provider configuration again. 2023-04-16T10:31:20.2870660Z �[31m╵�[0m�[0m 2023-04-16T10:31:20.2870889Z �[31m╷�[0m�[0m 2023-04-16T10:31:20.2871280Z �[31m│�[0m �[0m�[1m�[31mError: �[0m�[0m�[1mProvider configuration not present�[0m 2023-04-16T10:31:20.2871615Z �[31m│�[0m �[0m 2023-04-16T10:31:20.2872041Z �[31m│�[0m �[0m�[0mTo work with azurerm_subnet.azure_bastion (orphan) its original provider 2023-04-16T10:31:20.2872570Z �[31m│�[0m �[0mconfiguration at provider["registry.terraform.io/hashicorp/azurerm"].hub is 2023-04-16T10:31:20.2873063Z �[31m│�[0m �[0mrequired, but it has been removed. This occurs when a provider 2023-04-16T10:31:20.2873581Z �[31m│�[0m �[0mconfiguration is removed while objects created by that provider still exist 2023-04-16T10:31:20.2874067Z �[31m│�[0m �[0min the state. Re-add the provider configuration to destroy 2023-04-16T10:31:20.2875734Z �[31m│�[0m �[0mazurerm_subnet.azure_bastion (orphan), after which you can remove the 2023-04-16T10:31:20.2876150Z �[31m│�[0m �[0mprovider configuration again. 2023-04-16T10:31:20.2876434Z �[31m╵�[0m�[0m 2023-04-16T10:31:20.2876659Z �[31m╷�[0m�[0m 2023-04-16T10:31:20.2877045Z �[31m│�[0m �[0m�[1m�[31mError: �[0m�[0m�[1mProvider configuration not present�[0m 2023-04-16T10:31:20.2877381Z �[31m│�[0m �[0m 2023-04-16T10:31:20.2877805Z �[31m│�[0m �[0m�[0mTo work with azurerm_resource_group.hub_rg (orphan) its original provider 2023-04-16T10:31:20.2878317Z �[31m│�[0m �[0mconfiguration at provider["registry.terraform.io/hashicorp/azurerm"].hub is 2023-04-16T10:31:20.2878801Z �[31m│�[0m �[0mrequired, but it has been removed. This occurs when a provider 2023-04-16T10:31:20.2879334Z �[31m│�[0m �[0mconfiguration is removed while objects created by that provider still exist 2023-04-16T10:31:20.2879815Z �[31m│�[0m �[0min the state. Re-add the provider configuration to destroy 2023-04-16T10:31:20.2880301Z �[31m│�[0m �[0mazurerm_resource_group.hub_rg (orphan), after which you can remove the 2023-04-16T10:31:20.2880743Z �[31m│�[0m �[0mprovider configuration again. 2023-04-16T10:31:20.2881039Z �[31m╵�[0m�[0m 2023-04-16T10:31:20.2881290Z �[31m╷�[0m�[0m 2023-04-16T10:31:20.2881677Z �[31m│�[0m �[0m�[1m�[31mError: �[0m�[0m�[1mProvider configuration not present�[0m 2023-04-16T10:31:20.2881999Z �[31m│�[0m �[0m 2023-04-16T10:31:20.2882419Z �[31m│�[0m �[0m�[0mTo work with azurerm_network_security_group.bastion_nsg (orphan) its 2023-04-16T10:31:20.2882841Z �[31m│�[0m �[0moriginal provider configuration at 2023-04-16T10:31:20.2883293Z �[31m│�[0m �[0mprovider["registry.terraform.io/hashicorp/azurerm"].hub is required, but it 2023-04-16T10:31:20.2883814Z �[31m│�[0m �[0mhas been removed. This occurs when a provider configuration is removed 2023-04-16T10:31:20.2884330Z �[31m│�[0m �[0mwhile objects created by that provider still exist in the state. Re-add the 2023-04-16T10:31:20.2884772Z �[31m│�[0m �[0mprovider configuration to destroy 2023-04-16T10:31:20.2885250Z �[31m│�[0m �[0mazurerm_network_security_group.bastion_nsg (orphan), after which you can 2023-04-16T10:31:20.2885673Z �[31m│�[0m �[0mremove the provider configuration again. 2023-04-16T10:31:20.2885980Z �[31m╵�[0m�[0m 2023-04-16T10:31:20.2886239Z �[31m╷�[0m�[0m 2023-04-16T10:31:20.2886602Z �[31m│�[0m �[0m�[1m�[31mError: �[0m�[0m�[1mProvider configuration not present�[0m 2023-04-16T10:31:20.2886934Z �[31m│�[0m �[0m 2023-04-16T10:31:20.2887342Z �[31m│�[0m �[0m�[0mTo work with azurerm_virtual_network.hub_vnet (orphan) its original 2023-04-16T10:31:20.2887757Z �[31m│�[0m �[0mprovider configuration at 2023-04-16T10:31:20.2888219Z �[31m│�[0m �[0mprovider["registry.terraform.io/hashicorp/azurerm"].hub is required, but it 2023-04-16T10:31:20.2888718Z �[31m│�[0m �[0mhas been removed. This occurs when a provider configuration is removed 2023-04-16T10:31:20.2889175Z �[31m│�[0m �[0mwhile objects created by that provider still exist in the state. Re-add the 2023-04-16T10:31:20.2889682Z �[31m│�[0m �[0mprovider configuration to destroy azurerm_virtual_network.hub_vnet 2023-04-16T10:31:20.2890150Z �[31m│�[0m �[0m(orphan), after which you can remove the provider configuration again. 2023-04-16T10:31:20.2890471Z �[31m╵�[0m�[0m 2023-04-16T10:31:20.3056017Z ##[warning]Can't find loc string for key: TerraformPlanFailed 2023-04-16T10:31:20.3063081Z ##[error]Error: TerraformPlanFailed 1 2023-04-16T10:31:20.3128187Z ##[section]Finishing: Terraform : azurerm

It cleared when I added an extra provider alias 'hub', which is required by the 02 module.
Was this a needed step.

ACTION REQUIRED: Microsoft needs this private repository to complete compliance info

There are open compliance tasks that need to be reviewed for your azure-spring-cloud-reference-architecture repo.

Action required: 1 compliance task

To bring this repository to the standard required for 2021, we require administrators of this and all Microsoft GitHub repositories to complete a small set of tasks within the next 60 days. This is critical work to ensure the compliance and security of your Azure GitHub organization.

Please take a few minutes to complete the task at: https://repos.opensource.microsoft.com/orgs/Azure/repos/azure-spring-cloud-reference-architecture/compliance

• The GitHub AE (GitHub inside Microsoft) migration survey has not been completed for this private repository

You can close this work item once you have completed the compliance tasks, or it will automatically close within a day of taking action.

If you no longer need this repository, it might be quickest to delete the repo, too.

GitHub inside Microsoft program information

More information about GitHub inside Microsoft and the new GitHub AE product can be found at https://aka.ms/gim or by contacting [email protected]

FYI: current admins at Microsoft include @selvasingh

Deploy private app gateway - CLI script

Request you to check-in CLI script for private app gateway.

Terraform configuration file updates

Version used: Terraform version: 1.1.7

I am trying to deploy Spring Cloud using the terraform config files provided in this repo. I have run it previously with an older terraform version (1.1.3) and haven't gotten the following errors.

-modules/azure_firewall/main.tf:
The sku_name and sku_tier are now required firewall attributes. They need to be specified in the azure_firewall_instance resource.
The "AZFW_Hub" sku_name does not support IP Configurations.

-modules/my_sql/main.tf
The minimal TLS version for the my_sql_server resource has to be specified with a valid parameter.

-modules/key_vault/main.tf
The permission naming case has to updated from lower case from ["get, "regeneratekey", "listsas"] to ["Get", "RegenerateKey", "ListSAS"]

-modules/azure_spring_cloud/main.tf
The "instrumentation_key" argument is deprecated and should be removed.

Call Terraform destroy twice?

For cleaning up, should developers call destroy twice - first destroy app gateway and then everything else? We should document that

Use Windows Client for Jumphost

jumphost and jump box terms are used interchangeably, let's use one term

https://github.com/Azure/azure-spring-cloud-reference-architecture/search?q=jumphost
https://github.com/Azure/azure-spring-cloud-reference-architecture/search?q=jump_box

az monitor diagnostic-settings create command issue

The error message is as below:

Metric category 'Performance (Java)' is not supported.. [Code: "BadRequest"]

The root cause is:

L681 ~ L738 of the file https://github.com/Azure/azure-spring-cloud-reference-architecture/blob/main/CLI/deploy-azurespringcloud-internal.sh

Should be changed as below:

    --metrics '[
        {
            "category": "AllMetrics",
            "enabled": true,
            "retentionPolicy": {
                "enabled": false,
                "days": 0
                }
        }
    ]'

Update Azure Firewall Rules to support ACME Fitness app - jcenter.bintray.com

The ACME Fitness app has additional endpoints that need to be whitelisted on the Azure Firewall Rules
https://jcenter.bintray.com

Instructions for deleting everything

Typically, in all our quickstarts and tutorials, because these documents create Azure resources that are expensive, we supply instructions for how to delete them. We should do that sam here

Examples:
https://docs.microsoft.com/en-us/azure/spring-cloud/spring-cloud-quickstart?tabs=Azure-CLI&pivots=programming-language-java#clean-up-resources

https://github.com/microsoft/azure-spring-cloud-training/tree/master/99-conclusion

Input parameters - syntax restrictions

Shall we document the syntax restrictions by referencing relevant published documents on docs.microsoft.com? Particularly for:

VM admin name
VM admin password
MySQL admin name
MySQL admin password

Here is a sample output of Azure CLI script run:

{- Finished ..
  "dnsName": "bst-792b9eda-e643-4ac5-8fb6-22f6aed909a2.bastion.azure.com",
  "etag": "W/\"a2854bdc-e636-424a-9be6-da89b2ec9898\"",
  "id": "/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.Network/bastionHosts/corp-bastion-svc",
  "ipConfigurations": [
    {
      "etag": "W/\"a2854bdc-e636-424a-9be6-da89b2ec9898\"",
      "id": "/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.Network/bastionHosts/corp-bastion-svc/bastionHostIpConfigurations/bastion_ip_config",
      "name": "bastion_ip_config",
      "privateIpAllocationMethod": "Dynamic",
      "provisioningState": "Succeeded",
      "publicIpAddress": {
        "id": "/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.Network/publicIPAddresses/azure-bastion-ip",
        "resourceGroup": "sc-corp-rg"
      },
      "resourceGroup": "sc-corp-rg",
      "subnet": {
        "id": "/subscriptions/1c638cf4-608f-4ee6-b680-c329e824c3a8/resourceGroups/sc-corp-rg/providers/Microsoft.Network/virtualNetworks/vnet-hub/subnets/AzureBastionSubnet",
        "resourceGroup": "sc-corp-rg"
      },
      "type": "Microsoft.Network/bastionHosts/bastionHostIpConfigurations"
    }
  ],
  "location": "eastus2",
  "name": "corp-bastion-svc",
  "provisioningState": "Succeeded",
  "resourceGroup": "sc-corp-rg",
  "tags": null,
  "type": "Microsoft.Network/bastionHosts"
}
The password length must be between 12 and 123. Password must have the 3 of the following: 1 lower case character, 1 upper case character, 1 number and 1 special character.

Terraform should accept jumphost vm admin name

Right now, the default is azureuser and is in the variables file. Given that the script accepts admin name for MySQL, let's follow the same approach

Instructions for deleting everything

Typically, in all our quickstarts and tutorials, because these documents create Azure resources that are expensive, we supply instructions for how to delete them. We should do that sam here

Examples:
https://docs.microsoft.com/en-us/azure/spring-cloud/spring-cloud-quickstart?tabs=Azure-CLI&pivots=programming-language-java#clean-up-resources

https://github.com/microsoft/azure-spring-cloud-training/tree/master/99-conclusion

allows tags to be used for deploying reference architecture

Tags are used by enterprise orgs for managing permissions to create and manage resources and manage costs. Without tags, customers may not be able to provision these resources

Need not install Azure CLI Firewall Extension - ARM Template

Firewall extension is auto installed

bash-3.2$ az extension add --name firewall
No matching extensions for 'firewall'. Use --debug for more information.
bash-3.2$ az network firewall --help
CommandNotFoundError: 'firewall' is misspelled or not recognized by the system.
Try this: 'az extension add --name <anextension>'
Still stuck? Run 'az network --help' to view all commands or go to 'https://aka.ms/cli_ref' to learn more
bash-3.2$ az network firewall list
The command requires the extension azure-firewall. Do you want to install it now? The command will continue to run after the extension is installed. (Y/n): y
Run 'az config set extension.use_dynamic_install=yes_without_prompt' to allow installing extensions without prompt.
The installed extension 'azure-firewall' is in preview.

Convert Azure FW Rules to Firewall Manager policies

Should help users with list of regions that support Azure Spring Cloud

The following query will share the general list of available regions but not scoped to regions where Azure Spring Cloud is supported

The following query will supply the list of regions that support Azure Spring Cloud
https://azure.microsoft.com/global-infrastructure/services/?products=spring-cloud&regions=all

Should explain how tags are supported for Terraform quickstart

Related #46
We should specify how tags are supplied by developers when they invoke quickstart

Run Terraform failed

1. when I run
   terraform plan -out my.plan --var-file ../parameters.tfvars
   from https://github.com/Azure/azure-spring-apps-landing-zone-accelerator/blob/main/Scenarios/ASA-Secure-Baseline/Terraform/07-LZ-AppGateway.md
   failed with:
   

Add option for Internal WAF

Add a parameter for Internal Application Gateway with WAF. Default can be external.

object id is incorrect for Azure Spring Cloud Domain Management

The object ID is different per tenant.

Provision jumpbox with Microsoft Edge

az login step when running the powershell leads to the need for signing in using browser. The default experience with IE is painful. After a lot of clicks to allow it to open the link it finally results in the below error

Need to register Microsoft.ContainerService as a provider

On a new non-Microsoft tenant, attempting to deploy produces the error

Failed to create Azure Spring Cloud service instance spring-3lybqjv6zyd4s in VNet due to customer error: Please verify resource provider Microsoft.ContainerService has been registered successfully..

When registering the Azure Spring Cloud provider, we need a step to register the ContainerService provider as well:

az provider register --namespace 'Microsoft.ContainerService'

Instructions for deleting everything

Typically, in all our quickstarts and tutorials, because these documents create Azure resources that are expensive, we supply instructions for how to delete them. We should do that sam here

Examples:
https://docs.microsoft.com/en-us/azure/spring-cloud/spring-cloud-quickstart?tabs=Azure-CLI&pivots=programming-language-java#clean-up-resources

https://github.com/microsoft/azure-spring-cloud-training/tree/master/99-conclusion

Update the jumpbox scripts to point to correct version of Maven

Jumpbox is provisioned with 3.8.2 version of maven. Petclinic scripts point to 3.6.2 which results in below error when running Powershell script C:\ProgramData\chocolatey\lib\maven\apache-maven-3.6.3\bin\mvn' is not recognized as the name of a cmdlet

Tags need to be fixed across all resources for Terraform secure baseline

Explain what are the input values for terraforming the app gateway

We should explain where to get the app FQDN and self-signed certificate (create KV and get self-signed should be okay?)

Need not install Azure CLI Firewall extension

Re README instructions at:

The firewall extension gets auto-installed. Hence, it looks like we can remove that as a pre-requisite

bash-3.2$ az extension add --name firewall
No matching extensions for 'firewall'. Use --debug for more information.
bash-3.2$ az network firewall --help
CommandNotFoundError: 'firewall' is misspelled or not recognized by the system.
Try this: 'az extension add --name <anextension>'
Still stuck? Run 'az network --help' to view all commands or go to 'https://aka.ms/cli_ref' to learn more
bash-3.2$ az network firewall list
The command requires the extension azure-firewall. Do you want to install it now? The command will continue to run after the extension is installed. (Y/n): y
Run 'az config set extension.use_dynamic_install=yes_without_prompt' to allow installing extensions without prompt.
The installed extension 'azure-firewall' is in preview.

How are tags supported for Azure CLI script

Reladed #46

We should explain how developers can specify tags when they start the deployment

ARM Template - Input parameters - syntax restrictions

#53 is addressed for Terraform and CLI but not yet for ARM Template. Request you to apply the same hyperlinks to remind users about VM and MySQL administrator name and password

Expand on UPN and how to create UPN

Request you to expand on UPN - user principal or service principal and how to create that in the CLI README

Upgrade Terraform plans to latest version

There is new functionality for Azure Spring Apps - Spring Cloud gateway starting with terraform version 3.39.
Request is to upgrade the TF plans to this version or later.

Use two resources groups to house hub and spoke resources

Suggest that we use two resource groups to house hub and spoke resources. Typically, the hub and spoke are owned by two different groups within enterprise organization and two different cost centers