Terraform Azure ‐ Infrastructure & App Deployment

Introduction

This guide explains how our Terraform and GitHub Actions setup works to deploy an environment for our application consisting of two container apps: a frontend and a backend. The setup is designed for dynamic configuration of deployment environment using Terraform workspaces.

Prerequisites

Resource group for storing the Terraform states

For storing the Terraform states, we have decided to use a seperate resource group in Azure.

This setup is explained in the following resources:

• Store State in Azure

The names of the resource group and the associated resources are used in the Terraform file provided in this repository. You can customize these names by modifying the variables in the terraform/main.tf file:

... 
backend "azurerm" {
    resource_group_name  = "rg-imo-msw-terraform-common"
    storage_account_name = "stimomswterraform"
    container_name       = "tfstates"
    key                  = "state.tfstates"
 }
...

User-Assigned Managed Identity for Github Actions

To enable GitHub Actions to connect to Azure securely, you need to grant the appropriate permissions using a User-Assigned Managed Identity.

For detailed instructions, refer to the following guides:

• Microsoft Documentation: Using GitHub Actions for Infrastructure as Code
• Microsoft Documentation: Connecting GitHub Actions to Azure

The environments in the GitHub Action Workflow YAML files in .github/workflows/ is chosen between three options: dev-preview, dev, and prod. Ensure that you have set these environment names in Azure when creating the Federated Credential in Azure and have set them in GitHub.

NOTE: The Github Worklflows assume that you have set the Azure IDs as variables in GitHub, not secrets in GitHub. As shown the .github/workflows YAML-files:

    env:
      ARM_SUBSCRIPTION_ID: ${{ vars.ARM_SUBSCRIPTION_ID }}
      ARM_CLIENT_ID: ${{ vars.ARM_CLIENT_ID }}
      ARM_TENANT_ID: ${{ vars.ARM_TENANT_ID }}

Setup

Terraform: App-name & Location

IMO-Maritime-Single-Window/
├── terraform/
│   ├── modules/
│   ├── main.tf
│   ├── variables.tf

In main.tf the envionment variable env captures the current Terraform workspace.

In variables.tf we configure:

• The location of the Azure environment.
• The application name.

Both the environment variable env in main.tf and the application name app in variables.tf define the names of the resources used to build the app environment in Azure.

Github: App-name & Environment

Defining the app name

To configure the application name, specify it in terraform/variables.tf as noted previously, and also set it in GitHub's variables with variable name APP_NAME. If this variable is not defined in GitHub, the default application name imo-msw will be applied as specified in .github/workflows/build_and_push_images.yaml:

env:
...
  APP_NAME: ${{vars.APP_NAME || 'imo-msw'}}
...

Therefore, it is important to ensure that the application name in terraform/variables.tf and the Github variable, default or set, is the same.

Github Actions Workflows

The overall workflow for a given Terraform workspace chosen manually before running the actions:

1. Deploy Infrastructure: Deploy the Terraform infrastructure to Azure.
2. Deploy Images: Build and push frontend and backend images to the container registry, and deploy the images to the respective container apps.
3. Destroy: If necessary, destroy every resource and resource group corresponding to the given workspace.

1. Terraform Infrastructure Workflow

The GitHub Actions workflow automates the Terraform deployment process manually from the Actions tab selecting a workspace. This initial deployment sets up standard "hello world" images. Consequently, the backend and frontend container apps will initially fail due to incorrect port configurations. However, after completing step 2—deploying the created images—the container apps will be fully operational.

2. Docker Build, Push, and Deploy Workflow

This workflow (workflows/build_and_push_images.yaml) handles building, pushing Docker images, and deploying container apps.

1. Docker CLI og Docker Buildx are used to build Docker images.
2. These images are pushed to the Azure Container Registry via Azure CLI.
3. The backend and frontend container applications are deployed using the images from the Azure Container Registry. When the server image is deployed, the Azure Database for PostgreSQL is populated by executing the provided SQL script.

To enable automatic triggers on push changes, please uncomment the commented section in the YAML file.

3. Destroy Infrastructure

For destroying the infrastructure to a corresponding Terraform workspace you can trigger the process manually from the Actions tab. This YAML file is located in workflows/destroy_infra.yaml.

Architecture of IMO-MSW Deployment