Component updates 04/24 and host encryption #1359

heoelri · 2024-04-25T09:04:12Z

This PR contains a could of component updates including:

Terraform 1.8.1
Helm 3.14.4
ingress-nginx 4.10.0
kubernetes 1.29.2
..

It also enables hostencryption for vms/vmss and makes it configurable via the variables-<env>.tfvars files. This is a feature that needs to be enabled at subscription-level before. The troubleshooting guide was updated to include that.

Mission-Critical-Online/src/infra/workload/releaseunit/variables-e2e.tfvars

Line 5 in f97ae74

    
           aks_enable_host_encryption = true # https://learn.microsoft.com/en-us/azure/aks/enable-host-encryption

The recent ingress controller releases also require allowSnippetAnnotations to be set to true in values.helm.yaml to allow our mod-security snippets like for example in ingress.yaml:

Mission-Critical-Online/src/app/charts/catalogservice/templates/ingress.yaml

Lines 13 to 16 in f97ae74

    
               nginx.ingress.kubernetes.io/modsecurity-snippet: | 
        
                 SecRuleEngine On 
        
                 SecRule &REQUEST_HEADERS:X-Azure-FDID \"@eq 0\"  \"log,deny,id:106,status:403,msg:\'Front Door ID not present\'\" 
        
                 SecRule REQUEST_HEADERS:X-Azure-FDID \"@rx ^(?!{{ .Values.azure.frontdoorid }}).*$\"  \"log,deny,id:107,status:403,msg:\'Wrong Front Door ID\'\"

Tested in e2e, here: https://dev.azure.com/mission-critical/Online/_build/results?buildId=3336&view=results

Bumps [vue](https://github.com/vuejs/core) from 3.3.9 to 3.4.3. - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](vuejs/core@v3.3.9...v3.4.3) --- updated-dependencies: - dependency-name: vue dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…mps (#1232) Bumps [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) from 3.83.0 to 3.85.0. - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v3.83.0...v3.85.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [Microsoft.ApplicationInsights.AspNetCore](https://github.com/Microsoft/ApplicationInsights-dotnet) from 2.21.0 to 2.22.0. - [Release notes](https://github.com/Microsoft/ApplicationInsights-dotnet/releases) - [Changelog](https://github.com/microsoft/ApplicationInsights-dotnet/blob/main/CHANGELOG.md) - [Commits](microsoft/ApplicationInsights-dotnet@2.21.0...2.22.0) --- updated-dependencies: - dependency-name: Microsoft.ApplicationInsights.AspNetCore dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps grafana/grafana from 9.5.14 to 9.5.15. --- updated-dependencies: - dependency-name: grafana/grafana dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) from 3.83.0 to 3.85.0. - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v3.83.0...v3.85.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

) Bumps [Azure/azapi](https://github.com/Azure/terraform-provider-azapi) from 1.10.0 to 1.11.0. - [Release notes](https://github.com/Azure/terraform-provider-azapi/releases) - [Changelog](https://github.com/Azure/terraform-provider-azapi/blob/main/CHANGELOG.md) - [Commits](Azure/terraform-provider-azapi@v1.10.0...v1.11.0) --- updated-dependencies: - dependency-name: Azure/azapi dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [@microsoft/applicationinsights-web](https://github.com/microsoft/ApplicationInsights-JS) from 3.0.5 to 3.0.7. - [Release notes](https://github.com/microsoft/ApplicationInsights-JS/releases) - [Changelog](https://github.com/microsoft/ApplicationInsights-JS/blob/3.0.7/RELEASES.md) - [Commits](microsoft/ApplicationInsights-JS@3.0.5...3.0.7) --- updated-dependencies: - dependency-name: "@microsoft/applicationinsights-web" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [Azure/azapi](https://github.com/Azure/terraform-provider-azapi) from 1.10.0 to 1.11.0. - [Release notes](https://github.com/Azure/terraform-provider-azapi/releases) - [Changelog](https://github.com/Azure/terraform-provider-azapi/blob/main/CHANGELOG.md) - [Commits](Azure/terraform-provider-azapi@v1.10.0...v1.11.0) --- updated-dependencies: - dependency-name: Azure/azapi dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) from 3.83.0 to 3.85.0. - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v3.83.0...v3.85.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [Microsoft.ApplicationInsights.AspNetCore](https://github.com/Microsoft/ApplicationInsights-dotnet) from 2.21.0 to 2.22.0. - [Release notes](https://github.com/Microsoft/ApplicationInsights-dotnet/releases) - [Changelog](https://github.com/microsoft/ApplicationInsights-dotnet/blob/main/CHANGELOG.md) - [Commits](microsoft/ApplicationInsights-dotnet@2.21.0...2.22.0) --- updated-dependencies: - dependency-name: Microsoft.ApplicationInsights.AspNetCore dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps node from 19.8.1 to 21.5.0. --- updated-dependencies: - dependency-name: node dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…mp (#1221) Bumps [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) from 3.83.0 to 3.85.0. - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v3.83.0...v3.85.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

….UI (#1233) Bumps [vue-template-compiler](https://github.com/vuejs/vue) from 2.7.15 to 2.7.16. - [Release notes](https://github.com/vuejs/vue/releases) - [Changelog](https://github.com/vuejs/vue/blob/main/CHANGELOG.md) - [Commits](vuejs/vue@v2.7.15...v2.7.16) --- updated-dependencies: - dependency-name: vue-template-compiler dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) from 3.83.0 to 3.85.0. - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v3.83.0...v3.85.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [Azure/azapi](https://github.com/Azure/terraform-provider-azapi) from 1.10.0 to 1.11.0. - [Release notes](https://github.com/Azure/terraform-provider-azapi/releases) - [Changelog](https://github.com/Azure/terraform-provider-azapi/blob/main/CHANGELOG.md) - [Commits](Azure/terraform-provider-azapi@v1.10.0...v1.11.0) --- updated-dependencies: - dependency-name: Azure/azapi dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [Microsoft.ApplicationInsights.WorkerService](https://github.com/Microsoft/ApplicationInsights-dotnet) from 2.21.0 to 2.22.0. - [Release notes](https://github.com/Microsoft/ApplicationInsights-dotnet/releases) - [Changelog](https://github.com/microsoft/ApplicationInsights-dotnet/blob/main/CHANGELOG.md) - [Commits](microsoft/ApplicationInsights-dotnet@2.21.0...2.22.0) --- updated-dependencies: - dependency-name: Microsoft.ApplicationInsights.WorkerService dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) from 3.83.0 to 3.85.0. - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v3.83.0...v3.85.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [Microsoft.ApplicationInsights.AspNetCore](https://github.com/Microsoft/ApplicationInsights-dotnet) from 2.21.0 to 2.22.0. - [Release notes](https://github.com/Microsoft/ApplicationInsights-dotnet/releases) - [Changelog](https://github.com/microsoft/ApplicationInsights-dotnet/blob/main/CHANGELOG.md) - [Commits](microsoft/ApplicationInsights-dotnet@2.21.0...2.22.0) --- updated-dependencies: - dependency-name: Microsoft.ApplicationInsights.AspNetCore dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 3 to 4. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@v3...v4) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [Microsoft.ApplicationInsights.AspNetCore](https://github.com/Microsoft/ApplicationInsights-dotnet) from 2.21.0 to 2.22.0. - [Release notes](https://github.com/Microsoft/ApplicationInsights-dotnet/releases) - [Changelog](https://github.com/microsoft/ApplicationInsights-dotnet/blob/main/CHANGELOG.md) - [Commits](microsoft/ApplicationInsights-dotnet@2.21.0...2.22.0) --- updated-dependencies: - dependency-name: Microsoft.ApplicationInsights.AspNetCore dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…sts (#1224) Bumps [Microsoft.ApplicationInsights.AspNetCore](https://github.com/Microsoft/ApplicationInsights-dotnet) from 2.21.0 to 2.22.0. - [Release notes](https://github.com/Microsoft/ApplicationInsights-dotnet/releases) - [Changelog](https://github.com/microsoft/ApplicationInsights-dotnet/blob/main/CHANGELOG.md) - [Commits](microsoft/ApplicationInsights-dotnet@2.21.0...2.22.0) --- updated-dependencies: - dependency-name: Microsoft.ApplicationInsights.AspNetCore dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) from 3.85.0 to 3.89.0. - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v3.85.0...v3.89.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [Azure/azapi](https://github.com/Azure/terraform-provider-azapi) from 1.11.0 to 1.12.0. - [Release notes](https://github.com/Azure/terraform-provider-azapi/releases) - [Changelog](https://github.com/Azure/terraform-provider-azapi/blob/main/CHANGELOG.md) - [Commits](Azure/terraform-provider-azapi@v1.11.0...v1.12.0) --- updated-dependencies: - dependency-name: Azure/azapi dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) from 3.85.0 to 3.89.0. - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v3.85.0...v3.89.0) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm) from 3.94.0 to 3.97.1. - [Release notes](https://github.com/hashicorp/terraform-provider-azurerm/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-azurerm@v3.94.0...v3.97.1) --- updated-dependencies: - dependency-name: hashicorp/azurerm dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…Critical-Online into component-updates

heoelri · 2024-04-25T09:18:57Z

K8s 1.29.2 wasn't included in the first e2e test. Running a new one, here: https://dev.azure.com/mission-critical/Online/_build/results?buildId=3336&view=logs&j=9a62b2c6-931b-5ee5-4062-7dadbfc43efc&t=3795b145-dadf-5bd4-2529-ae897b37f3c3

…ritical-Online into updates-20240424

src/infra/workload/releaseunit/stamp.tf

sebader · 2024-04-26T07:45:15Z

docs/reference-implementation/Troubleshooting.md

+│  }
+```
+
+**Description:** Host encryption needs to be enabled at subscription-level when `aks_enable_host_encryption` is set to `true` in `variables-<env>.tf`.


If we really need to make host encryption a requirement, we'd need to put it into the getting started guide. Otherwise every single customer will likely fail over this.
Isn't there some way we can enable this for us without enabling it for everybody who would clone the repo?

@sebader I completely forgot this PR. I don't see a way to only enable it for us. The auto-registration via TF is also not an option as it would require us to define all resource provider registrations. I'm ok to add it to the getting started guide though. If that's an acceptable solution.

…level encryption using Azure CLI

…n.tf

src/infra/workload/globalresources/main.tf

…n.tf

heoelri · 2024-05-14T11:47:01Z

@sebader ready

dependabot bot and others added 30 commits January 2, 2024 08:56

fix for failing health check

b46df0f

check also for frontend

3aa691f

dependabot bot and others added 6 commits April 24, 2024 10:54

Merge branch 'component-updates' of https://github.com/Azure/Mission-…

690eecf

…Critical-Online into component-updates

Merge branch 'component-updates' into updates-20240424

29c7dad

Fix host encryption issue in Terraform variables

08af85e

Update kubernetesVersion to 1.29.2 in configuration.yaml

a3c878e

heoelri requested review from CalCof and a team as code owners April 25, 2024 09:04

heoelri self-assigned this Apr 25, 2024

Update ingress-nginx configuration to allow snippet annotations

f97ae74

heoelri added the do not merge Pull requests that require additional validation label Apr 25, 2024

Merge branch 'main' into updates-20240424

42bebf6

heoelri added 3 commits April 25, 2024 11:46

Fix host encryption issue in Terraform variables

dbb216e

Merge branch 'updates-20240424' of https://github.com/Azure/Mission-C…

c236276

…ritical-Online into updates-20240424

Fix host encryption issue in Terraform variables

2511ca8

sebader reviewed Apr 26, 2024

View reviewed changes

src/infra/workload/releaseunit/stamp.tf Outdated Show resolved Hide resolved

sebader reviewed Apr 26, 2024

View reviewed changes

Update Terraform variables to include instructions for enabling host-…

7b30be0

…level encryption using Azure CLI

heoelri removed the do not merge Pull requests that require additional validation label May 14, 2024

heoelri added 2 commits May 14, 2024 11:19

Update Azure/azapi version to 1.13.1 in main.tf and modules/stamp/mai…

70b83b3

…n.tf

Update Terraform variables to enable host-level encryption

0c7786f

sebader reviewed May 14, 2024

View reviewed changes

src/infra/workload/globalresources/main.tf Outdated Show resolved Hide resolved

heoelri added 3 commits May 14, 2024 12:00

Update Azure/azapi version to 1.13.1 in main.tf and modules/stamp/mai…

b1f0ca0

…n.tf

Enable host-level encryption for AKS in Terraform variables

7c24968

Replace deprecated params

385a55e

sebader approved these changes May 14, 2024

View reviewed changes

heoelri merged commit ad6ecf3 into main May 14, 2024
22 checks passed

heoelri deleted the updates-20240424 branch May 14, 2024 11:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Component updates 04/24 and host encryption #1359

Component updates 04/24 and host encryption #1359

heoelri commented Apr 25, 2024 •

edited

Loading

heoelri commented Apr 25, 2024

sebader Apr 26, 2024

heoelri May 14, 2024

heoelri commented May 14, 2024

	nginx.ingress.kubernetes.io/modsecurity-snippet: \|
	SecRuleEngine On
	SecRule &REQUEST_HEADERS:X-Azure-FDID \"@eq 0\" \"log,deny,id:106,status:403,msg:\'Front Door ID not present\'\"
	SecRule REQUEST_HEADERS:X-Azure-FDID \"@rx ^(?!{{ .Values.azure.frontdoorid }}).*$\" \"log,deny,id:107,status:403,msg:\'Wrong Front Door ID\'\"

Component updates 04/24 and host encryption #1359

Component updates 04/24 and host encryption #1359

Conversation

heoelri commented Apr 25, 2024 • edited Loading

heoelri commented Apr 25, 2024

sebader Apr 26, 2024

Choose a reason for hiding this comment

heoelri May 14, 2024

Choose a reason for hiding this comment

heoelri commented May 14, 2024

heoelri commented Apr 25, 2024 •

edited

Loading