Jenkins infra on Azure

Table of Contents

• Requirements
• HowTo
  • Provision
• FAQ / Troubleshooting
  • Error: Backend configuration changed

This repository hosts the infrastructure-as-code definition for all the Azure hosted resources for the Jenkins Infrastructure Project.

See also https://github.com/jenkins-infra/azure-net for all global network related resources.

Requirements

In order to use this repository to provision the Jenkins infrastructure on azure, you need:

• An Azure account (with the proper roles and permissions)

• The requirements (of the shared tools) listed at shared-tools/terraform#requirements

• The shared-tools common repository as a git submodule should be initialized and up-to-date:

  • On a freshly cloned Terraform repository, execute the following command to obtain the shared tools:

git submodule update --init --recursive

• Otherwise you should update to to the latest main branch:

cd ./.shared-tools
git pull origin main
cd ../

• The Azure Credential Secret value to allow the Terraform AzureRM Backend to access remote Azure storage:

  • Must be specified in the environment variable TF_BACKEND_ARM_CLIENT_SECRET

  • The secret value should never be written in clear (not in a text file, not in the terminal). For instance on macOS, store it in your Keychain access and set the variable with export TF_BACKEND_ARM_CLIENT_SECRET="$(security find-generic-password -a jenkins-tf-azure-backend-arm-secret -w)"

• Routing to database (private endpoints and private DNSes):

  • VPN access is required with routing to the database subnets set up to your user

  • As there are no public DNS, set up your local /etc/hosts (check the providers.tf for details)

• If you intend to work with the production, the environment variable TF_VAR_environment must be set:

export TF_VAR_environment=production

HowTo

Provision

❗	Don’t blindly execute the terraform code located in this repository on your own account as it may lead your account bill to significantly increase.

Once you’ve fulfilled the Requirements, you may execute any command from https://github.com/jenkins-infra/shared-tools/blob/main/terraform/README.adoc#available-commands by adding the correct flag --directory pointing to .shared-tools/terraform/:

make --directory=.shared-tools/terraform help
make --directory=.shared-tools/terraform lint
# ...

A usual change to this repository looks like the following:

• Fork the repository and clone it locally

• Follow the Requirements steps to obtain the shared tools

• Start by running a full make --directory=.shared-tools/terraform validate command to ensure that you work on a sane base (should generate a report TXT file with no changes to be applied)

• Edit the Terraform project files

• Run the command make --directory=.shared-tools/terraform validate again to ensure that your changes are OK

• Commit, push and open a pull request to let the Jenkins pipeline run the test + plan (as per https://github.com/jenkins-infra/shared-tools/blob/main/terraform/README.adoc#jenkins-pipeline)

FAQ / Troubleshooting

Error: Backend configuration changed

If you see this when running make --directory=.shared-tools/terraform prepare:

Error: Backend configuration changed

Remove the local Terraform state and re-initialize:

rm -rf ./.terraform
make --directory=.shared-tools/terraform prepare