Skip to content

Commit 7994231

Browse files
geoberlegeoberle
authored
MSFT STG SVC rollout (#1535)
* humand readable aks names Signed-off-by: Gerd Oberlechner <[email protected]> * create certificate for fpa Signed-off-by: Gerd Oberlechner <[email protected]> * release approver Signed-off-by: Gerd Oberlechner <[email protected]> * fix prod ip service tags Signed-off-by: Gerd Oberlechner <[email protected]> * deactivate stage ip addr tags until they are activated Signed-off-by: Gerd Oberlechner <[email protected]> * use onecert private for frontend cert until we have approval for public in stg Signed-off-by: Gerd Oberlechner <[email protected]> * lint Signed-off-by: Gerd Oberlechner <[email protected]> --------- Signed-off-by: Gerd Oberlechner <[email protected]>
1 parent 98fcdbb commit 7994231

12 files changed

+147
-27
lines changed

‎cluster-service/pipeline.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ resourceGroups:
3535
- name: AZURE_FIRST_PARTY_APPLICATION_CLIENT_ID
3636
configRef: firstPartyAppClientId
3737
- name: FPA_CERT_NAME
38-
configRef: firstPartyAppCertName
38+
configRef: firstPartyAppCertificate.name
3939
- name: AZURE_MI_MOCK_SERVICE_PRINCIPAL_PRINCIPAL_ID
4040
configRef: miMockPrincipalId
4141
- name: AZURE_MI_MOCK_SERVICE_PRINCIPAL_CLIENT_ID

‎config/config.msft.yaml

+22-8
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,9 @@ defaults:
2222
#
2323
# All defaults mentioned in this section need to be environment and region agnostic.
2424
#
25-
25+
releaseApprover:
26+
id: feca6a27-8f05-4abe-b9e4-e1185f5833ab
27+
name: TM-AzureRedHatOpenShift-HCP-Leads
2628
# The long Azure region name
2729
region: "{{ .ctx.region }}"
2830
regionRG: "{{ .ctx.region }}-shared-resources"
@@ -63,12 +65,16 @@ defaults:
6365
repository: acm-d/rhtap-hypershift-operator
6466
# OIDC
6567
oidcZoneRedundantMode: Auto
68+
# FPA certificate settings
69+
firstPartyAppCertificate:
70+
issuer: OneCertV2-PrivateCA
71+
manage: true
6672
# SVC cluster specifics
6773
svc:
6874
subscription: "hcp-{{ .ctx.region }}"
6975
rg: "hcp-underlay-{{ .ctx.region }}-svc"
7076
aks:
71-
name: "{{ .ctx.regionShort }}-svc" # [env-unique]
77+
name: "{{ .ctx.region }}-svc-1" # [env-unique]
7278
vnetAddressPrefix: "10.128.0.0/14"
7379
subnetPrefix: "10.128.8.0/21"
7480
podSubnetPrefix: "10.128.64.0/18"
@@ -81,22 +87,24 @@ defaults:
8187
osDiskSizeGB: 32
8288
etcd:
8389
kvSoftDelete: true
84-
clusterOutboundIPAddressIPTags: "FirstPartyUsage:arohcpprodoutboundsvc"
90+
#clusterOutboundIPAddressIPTags: "FirstPartyUsage:aro-hcp-prod-outbound-svc"
91+
clusterOutboundIPAddressIPTags: ""
8592
istio:
8693
istioctlVersion: "1.24.1"
8794
tag: "prod-stable"
8895
targetVersion: "asm-1-23"
8996
versions: "asm-1-23"
9097
ingressGatewayIPAddressName: "aro-hcp-istio-ingress"
91-
ingressGatewayIPAddressIPTags: "FirstPartyUsage:arohcpprodinboundsvc"
98+
#ingressGatewayIPAddressIPTags: "FirstPartyUsage:aro-hcp-prod-inbound-svc"
99+
ingressGatewayIPAddressIPTags: ""
92100
logs:
93101
namespace: HCPServiceLogs
94102
# MGMT cluster specifics
95103
mgmt:
96104
subscription: "hcp-{{ .ctx.region }}"
97105
rg: "hcp-underlay-{{ .ctx.region }}-mgmt-{{ .ctx.stamp }}"
98106
aks:
99-
name: "{{ .ctx.regionShort }}-mgmt-{{ .ctx.stamp }}" # [env-unique]
107+
name: "{{ .ctx.region }}-mgmt-{{ .ctx.stamp }}" # [env-unique]
100108
vnetAddressPrefix: "10.128.0.0/14"
101109
subnetPrefix: "10.128.8.0/21"
102110
podSubnetPrefix: "10.128.64.0/18"
@@ -109,7 +117,8 @@ defaults:
109117
osDiskSizeGB: 128
110118
etcd:
111119
kvSoftDelete: true
112-
clusterOutboundIPAddressIPTags: "FirstPartyUsage:arohcpprodoutboundcx"
120+
#clusterOutboundIPAddressIPTags: "FirstPartyUsage:aro-hcp-prod-outbound-cx"
121+
clusterOutboundIPAddressIPTags: ""
113122
applyKubeletFixes: true
114123
logs:
115124
namespace: HCPManagementLogs
@@ -377,7 +386,9 @@ clouds:
377386
digest: sha256:223f332a11d336b49243d886217a76809142b30f9ab8ef27bec80a4458b3c3a5
378387
# 1P app - from RH Tenant
379388
firstPartyAppClientId: b3cb2fab-15cb-4583-ad06-f91da9bfe2d1
380-
firstPartyAppCertName: firstPartyCert2
389+
firstPartyAppCertificate:
390+
name: firstPartyCert2
391+
manage: false # we have the cert from RH for int
381392
# Mock Managed Identities Service Princiapl - from RH Tenant
382393
miMockClientId: e8723db7-9b9e-46a4-9f7d-64d75c3534f0
383394
miMockPrincipalId: d6b62dfa-87f5-49b3-bbcb-4a687c4faa96
@@ -487,6 +498,8 @@ clouds:
487498
private: false
488499
image:
489500
digest: sha256:343bb768e38a829f13c4893e381c83fa602944809509b64e841f317ec2bf539b
501+
cert:
502+
issuer: OneCertV2-PrivateCA # let's use private until we have approval for public
490503
# RP Backend
491504
backend:
492505
image:
@@ -505,7 +518,8 @@ clouds:
505518
digest: sha256:223f332a11d336b49243d886217a76809142b30f9ab8ef27bec80a4458b3c3a5
506519
# 1P app - from RH Tenant
507520
firstPartyAppClientId: "7f4a113a-c61d-412a-bea1-85dee5baf4a8"
508-
firstPartyAppCertName: firstPartyCert
521+
firstPartyAppCertificate:
522+
name: tmp-rp-firstparty
509523
# Grafana
510524
monitoring:
511525
grafanaName: 'arohcp-stg'

‎config/config.schema.json

+36-3
Original file line numberDiff line numberDiff line change
@@ -383,8 +383,25 @@
383383
"firstPartyAppClientId": {
384384
"type": "string"
385385
},
386-
"firstPartyAppCertName": {
387-
"type": "string"
386+
"firstPartyAppCertificate": {
387+
"type": "object",
388+
"properties": {
389+
"name": {
390+
"type": "string"
391+
},
392+
"issuer": {
393+
"$ref": "#/definitions/certificateIssuer"
394+
},
395+
"manage": {
396+
"type": "boolean"
397+
}
398+
},
399+
"additionalProperties": false,
400+
"required": [
401+
"name",
402+
"issuer",
403+
"manage"
404+
]
388405
},
389406
"miMockClientId": {
390407
"type": "string"
@@ -1121,6 +1138,22 @@
11211138
"svc",
11221139
"ocp"
11231140
]
1141+
},
1142+
"releaseApprover": {
1143+
"type": "object",
1144+
"properties": {
1145+
"name": {
1146+
"type": "string"
1147+
},
1148+
"id": {
1149+
"type": "string"
1150+
}
1151+
},
1152+
"additionalProperties": false,
1153+
"required": [
1154+
"name",
1155+
"id"
1156+
]
11241157
}
11251158
},
11261159
"additionalProperties": false,
@@ -1130,7 +1163,7 @@
11301163
"clusterService",
11311164
"cxKeyVault",
11321165
"firstPartyAppClientId",
1133-
"firstPartyAppCertName",
1166+
"firstPartyAppCertificate",
11341167
"frontend",
11351168
"genevaActions",
11361169
"global",

‎config/config.yaml

+4-1
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,10 @@ clouds:
206206
parentZoneName: osadev.cloud
207207
# 1P app
208208
firstPartyAppClientId: b3cb2fab-15cb-4583-ad06-f91da9bfe2d1
209-
firstPartyAppCertName: firstPartyCert2
209+
firstPartyAppCertificate:
210+
name: firstPartyCert2
211+
issuer: Self
212+
manage: false
210213
# Mock Managed Identities Service Princiapl
211214
miMockClientId: e8723db7-9b9e-46a4-9f7d-64d75c3534f0
212215
miMockPrincipalId: d6b62dfa-87f5-49b3-bbcb-4a687c4faa96

‎config/public-cloud-cs-pr.json

+5-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,11 @@
8888
"svcParentZoneName": "hcpsvc.osadev.cloud"
8989
},
9090
"extraVars": {},
91-
"firstPartyAppCertName": "firstPartyCert2",
91+
"firstPartyAppCertificate": {
92+
"issuer": "Self",
93+
"manage": false,
94+
"name": "firstPartyCert2"
95+
},
9296
"firstPartyAppClientId": "b3cb2fab-15cb-4583-ad06-f91da9bfe2d1",
9397
"frontend": {
9498
"cert": {

‎config/public-cloud-dev.json

+5-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,11 @@
8888
"svcParentZoneName": "hcpsvc.osadev.cloud"
8989
},
9090
"extraVars": {},
91-
"firstPartyAppCertName": "firstPartyCert2",
91+
"firstPartyAppCertificate": {
92+
"issuer": "Self",
93+
"manage": false,
94+
"name": "firstPartyCert2"
95+
},
9296
"firstPartyAppClientId": "b3cb2fab-15cb-4583-ad06-f91da9bfe2d1",
9397
"frontend": {
9498
"cert": {

‎config/public-cloud-msft-int.json

+11-3
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,11 @@
8888
"svcParentZoneName": "aro-hcp.azure-test.net"
8989
},
9090
"extraVars": {},
91-
"firstPartyAppCertName": "firstPartyCert2",
91+
"firstPartyAppCertificate": {
92+
"issuer": "OneCertV2-PrivateCA",
93+
"manage": false,
94+
"name": "firstPartyCert2"
95+
},
9296
"firstPartyAppClientId": "b3cb2fab-15cb-4583-ad06-f91da9bfe2d1",
9397
"frontend": {
9498
"cert": {
@@ -229,7 +233,7 @@
229233
"kvSoftDelete": true
230234
},
231235
"kubernetesVersion": "1.31.5",
232-
"name": "usw3-mgmt-1",
236+
"name": "westus3-mgmt-1",
233237
"podSubnetPrefix": "10.128.64.0/18",
234238
"subnetPrefix": "10.128.8.0/21",
235239
"systemAgentPool": {
@@ -291,6 +295,10 @@
291295
"oidcZoneRedundantMode": "Auto",
292296
"region": "westus3",
293297
"regionRG": "westus3-shared-resources",
298+
"releaseApprover": {
299+
"id": "feca6a27-8f05-4abe-b9e4-e1185f5833ab",
300+
"name": "TM-AzureRedHatOpenShift-HCP-Leads"
301+
},
294302
"serviceKeyVault": {
295303
"name": "arohcpint-svc-usw3",
296304
"private": false,
@@ -306,7 +314,7 @@
306314
"kvSoftDelete": true
307315
},
308316
"kubernetesVersion": "1.31.5",
309-
"name": "usw3-svc",
317+
"name": "westus3-svc-1",
310318
"podSubnetPrefix": "10.128.64.0/18",
311319
"subnetPrefix": "10.128.8.0/21",
312320
"systemAgentPool": {

‎config/public-cloud-msft-stg.json

+15-7
Original file line numberDiff line numberDiff line change
@@ -88,11 +88,15 @@
8888
"svcParentZoneName": "aro-hcp.azure.com"
8989
},
9090
"extraVars": {},
91-
"firstPartyAppCertName": "firstPartyCert",
91+
"firstPartyAppCertificate": {
92+
"issuer": "OneCertV2-PrivateCA",
93+
"manage": true,
94+
"name": "tmp-rp-firstparty"
95+
},
9296
"firstPartyAppClientId": "7f4a113a-c61d-412a-bea1-85dee5baf4a8",
9397
"frontend": {
9498
"cert": {
95-
"issuer": "OneCertV2-PublicCA",
99+
"issuer": "OneCertV2-PrivateCA",
96100
"name": "frontend-cert"
97101
},
98102
"cosmosDB": {
@@ -221,13 +225,13 @@
221225
},
222226
"mgmt": {
223227
"aks": {
224-
"clusterOutboundIPAddressIPTags": "FirstPartyUsage:arohcpprodoutboundcx",
228+
"clusterOutboundIPAddressIPTags": "",
225229
"etcd": {
226230
"kvName": "arohcpstg-etcd-usw3-1",
227231
"kvSoftDelete": true
228232
},
229233
"kubernetesVersion": "1.31.5",
230-
"name": "usw3-mgmt-1",
234+
"name": "westus3-mgmt-1",
231235
"podSubnetPrefix": "10.128.64.0/18",
232236
"subnetPrefix": "10.128.8.0/21",
233237
"systemAgentPool": {
@@ -289,6 +293,10 @@
289293
"oidcZoneRedundantMode": "Auto",
290294
"region": "westus3",
291295
"regionRG": "westus3-shared-resources",
296+
"releaseApprover": {
297+
"id": "feca6a27-8f05-4abe-b9e4-e1185f5833ab",
298+
"name": "TM-AzureRedHatOpenShift-HCP-Leads"
299+
},
292300
"serviceKeyVault": {
293301
"name": "arohcpstg-svc-usw3",
294302
"private": false,
@@ -298,13 +306,13 @@
298306
},
299307
"svc": {
300308
"aks": {
301-
"clusterOutboundIPAddressIPTags": "FirstPartyUsage:arohcpprodoutboundsvc",
309+
"clusterOutboundIPAddressIPTags": "",
302310
"etcd": {
303311
"kvName": "arohcpstg-etcd-usw3",
304312
"kvSoftDelete": true
305313
},
306314
"kubernetesVersion": "1.31.5",
307-
"name": "usw3-svc",
315+
"name": "westus3-svc-1",
308316
"podSubnetPrefix": "10.128.64.0/18",
309317
"subnetPrefix": "10.128.8.0/21",
310318
"systemAgentPool": {
@@ -323,7 +331,7 @@
323331
"vnetAddressPrefix": "10.128.0.0/14"
324332
},
325333
"istio": {
326-
"ingressGatewayIPAddressIPTags": "FirstPartyUsage:arohcpprodinboundsvc",
334+
"ingressGatewayIPAddressIPTags": "",
327335
"ingressGatewayIPAddressName": "aro-hcp-istio-ingress",
328336
"istioctlVersion": "1.24.1",
329337
"tag": "prod-stable",

‎config/public-cloud-nightly.json

+5-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,11 @@
8888
"svcParentZoneName": "hcpsvc.osadev.cloud"
8989
},
9090
"extraVars": {},
91-
"firstPartyAppCertName": "firstPartyCert2",
91+
"firstPartyAppCertificate": {
92+
"issuer": "Self",
93+
"manage": false,
94+
"name": "firstPartyCert2"
95+
},
9296
"firstPartyAppClientId": "b3cb2fab-15cb-4583-ad06-f91da9bfe2d1",
9397
"frontend": {
9498
"cert": {

‎config/public-cloud-personal-dev.json

+5-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,11 @@
8888
"svcParentZoneName": "hcpsvc.osadev.cloud"
8989
},
9090
"extraVars": {},
91-
"firstPartyAppCertName": "firstPartyCert2",
91+
"firstPartyAppCertificate": {
92+
"issuer": "Self",
93+
"manage": false,
94+
"name": "firstPartyCert2"
95+
},
9296
"firstPartyAppClientId": "b3cb2fab-15cb-4583-ad06-f91da9bfe2d1",
9397
"frontend": {
9498
"cert": {

‎dev-infrastructure/configurations/svc-cluster.tmpl.bicepparam

+5
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ param oidcZoneRedundantMode = '{{ .oidcZoneRedundantMode }}'
6767

6868
param aroDevopsMsiId = '{{ .aroDevopsMsiId }}'
6969

70+
param svcDNSZoneName = '{{ .dns.svcParentZoneName }}'
7071
param regionalCXDNSZoneName = '{{ .dns.regionalSubdomain }}.{{ .dns.cxParentZoneName }}'
7172
param regionalSvcDNSZoneName = '{{ .dns.regionalSubdomain }}.{{ .dns.svcParentZoneName }}'
7273

@@ -76,6 +77,10 @@ param frontendIngressCertName = '{{ .frontend.cert.name }}'
7677
param frontendIngressCertIssuer = '{{ .frontend.cert.issuer }}'
7778
param genevaActionsServiceTag = '{{ .genevaActions.serviceTag }}'
7879

80+
param fpaCertificateName = '{{ .firstPartyAppCertificate.name }}'
81+
param fpaCertificateIssuer = '{{ .firstPartyAppCertificate.issuer }}'
82+
param manageFpaCertificate = {{ .firstPartyAppCertificate.manage }}
83+
7984
// Azure Monitor Workspace
8085
param azureMonitoringWorkspaceId = '__azureMonitoringWorkspaceId__'
8186

0 commit comments

Comments
 (0)