Skip to main content

Infrastructure

1. Subscriptions, tenant, SPN

  • Azure tenant
    • [EXISTING] One Microsoft Entra (Azure AD) tenant, ID = var.spn-tenant-id.
  • Subscriptions used
    • [EXISTING] 99d2dbed-9f2e-4ee4-b828-2c5d25219f4d – Nordic Claims / admin workloads (DNS zone, VNets, some subnets, Terraform backend).
    • [EXISTING] 86a091da-60ab-4a68-bfc0-87b0445b192a – “test_subscription” (webapps spoke VNet for storage allow‑listing, prev env resources).
    • [EXISTING] 5b0194fb-735d-4564-8b6a-667f31dc8ccd – “architecture_and_platforms” (old build-agent VNet).
    • [EXISTING] 2c358f16-b868-4c84-b2eb-8f97786cd9c9 – “build_agents” (current build-agent VNet).
    • [EXISTING] administration_subscription_id = 99d2dbed-9f2e-4ee4-b828-2c5d25219f4d – admin KV, DNS.
  • Terraform service principal
    • [EXISTING] SPN with:
      • client_id = var.spn-client-id
      • client_secret = var.spn-client-secret
      • tenant_id = var.spn-tenant-id
    • Needs sufficient RBAC to manage all the above subscriptions’ resources it touches.

2. Networking (VNets, subnets, IPs)

  • Primary web VNet (runtime‑critical)
    • [EXISTING] VNet AISIPSM-IPS-Network (subscription 99d2dbed-..., RG AISIPSM-IPS-Network).
    • [EXISTING] Subnet AISIPSM-IPS-WebApps in that VNet – used for:
      • App Service VNet integration (data.azurerm_subnet.webapps).
      • Storage network rules (data.azurerm_subnet.nordic_claims_vnet_webapps).
  • Build agent VNets (for CI access to storage)
    • [EXISTING] VNet AISARCH-Build-Agents-NE-Network, subnet default – old build agents (data.azurerm_subnet.OLD_build_agent_vnet).
    • [EXISTING] VNet 2c358f16-WE-Spoke-Network, subnet buildagents – current build agents (data.azurerm_subnet.build_agent_vnet).
  • Test subscription spoke VNet (for storage allow‑listing)
    • [EXISTING] VNet 86a091da-NE-Spoke-Network, subnet main (data.azurerm_subnet.test_vnet_webapps).
  • Baltic AKS network
    • [EXISTING] Subnet IDs (in subscription 77981029-1d2f-4323-b715-879564056947):
      • Pods subnet: .../New-Baltic-AKS-Prod-Spoke-WE-Network/subnets/aks-prod-node-pool-0-pods-subnet
      • Nodes subnet: .../New-Baltic-AKS-Prod-Spoke-WE-Network/subnets/aks-prod-node-pool-0-nodes-subnet
    • Used in storage network rules for both legacy and new flow storage.
  • Public IP range
    • [EXISTING] Baltic public IP range 195.190.141.0/24 – whitelisted on storage accounts to allow VPN access.