Terraform Azure ‐ Infrastructure & App Deployment

Introduction

This guide explains how our Terraform and GitHub Actions setup works to deploy an environment for our application consisting of two container apps: a frontend and a backend. The setup is designed for dynamic configuration of deployment environment using Terraform workspaces.

Prerequisites

Resource group for storing the Terraform states

For storing the Terraform states, we have decided to use a seperate resource group in Azure.

This setup is explained in the following resources:

• Backend Configuration
• Store State in Azure

The names of the resource group and the associated resources are used in the Terraform file provided in this repository. You can customize these names by modifying the variables in the terraform/main.tf file:

... 
backend "azurerm" {
    resource_group_name  = "rg-imo-msw-terraform-common"
    storage_account_name = "stimomswterraform"
    container_name       = "tfstates"
    key                  = "state.tfstates"
 }
...

User-Assigned Managed Identity for Github Actions

To enable GitHub Actions to connect to Azure securely, you need to grant the appropriate permissions using a User-Assigned Managed Identity.

For detailed instructions, refer to the following guides:

• Microsoft Documentation: Using GitHub Actions for Infrastructure as Code
• Microsoft Documentation: Connecting GitHub Actions to Azure

It is important to note that the environment in the GitHub Action Workflow YAML files includes dev-preview as default as the environment. Therefore, ensure you have set an environment name like that, or you can change the environment to correspond with the one you set in Azure when creating the Federated Credential.

NOTE: The pipelines assume that you have set the Azure IDs as variables in GitHub, not secrets in GitHub.

Setup

Terraform: App-name & Location

IMO-Maritime-Single-Window/
├── terraform/
│   ├── modules/
│   ├── main.tf
│   ├── variables.tf

In main.tf we start by defining the local variables and setting up the Terraform backend configuration. This includes specifying the Azure Resource Group, Storage Account, and Container used to store the Terraform state files:

• The envionment variable env captures the current Terraform workspace.
• The backend configuration specifies where the Terraform state files are stored.

In variables.tf we configure:

• The location of the Azure environment.
• The application name.

Both the application name and the environment variables defines the names of the resources used to build the app environment in Azure.

Github: App-name & Environment

To configure the application name, specify it in variables.tf as noted previously, and also set it in GitHub's variables with variable name APP_NAME. If this variable is not defined in GitHub, the default application name imo-msw will be applied. Therefore, it is important to ensure that the application name in variables.tf and the Github variable, default or set, is the same.

Github Actions Workflows

The overall workflow for a given Terraform workspace chosen manually before running the actions:

1. Deploy Infrastructure: Deploy the Terraform infrastructure to Azure
2. Deploy Images: Build and push frontend and backend images to the container registry, and deploy the images to the respective container apps.
3. Destroy: If necessary, destroy every resource and resource group corresponding to the given workspace.

1. Terraform Infrastructure Workflow

The GitHub Actions workflow automates the Terraform deployment process manually from the Actions tab selecting a workspace.

This workflow can also be triggered automatically by code changes that are pushed in the terraform/ folder and/or the .github/workflows folder. The default workspace in this case is dev-preview. To enable this, please uncomment the following section in the workflows/apply_infra.yaml file:

on:
  # If you want to run the actions automatically on push to the main/master branch, uncomment:
  # push:
  #   branches: 
  #     - master
  #   paths:
  #     - 'terraform/**'
  #     - '.github/workflows/**'
...

2. Docker Build, Push, and Deploy Workflow

This workflow (workflows/build_and_push_images.yaml) handles building, pushing Docker images, and deploying container apps.

1. Docker CLI og Docker Buildx are used to build Docker images.
2. These images are pushed to the Azure Container Registry via Azure CLI.
3. The backend and frontend container applications are deployed using the images from the Azure Container Registry. When the server image is deployed, the Azure Database for PostgreSQL is populated by executing the provided SQL script.

To enable automatic triggers on push changes, please uncomment the commented section in the YAML file.

3. Destroy Infrastructure

For destroying the infrastructure to a corresponding Terraform workspace you can trigger the process manually from the Actions tab. This YAML file is located in workflows/destroy_infra.yaml.

Architecture of IMO-MSW Deployment