Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated getting started doc to include section for using existing resources. #200

Closed
wants to merge 5 commits into from
Closed
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 68 additions & 0 deletions docs/GETTING_STARTED.md
Original file line number Diff line number Diff line change
Expand Up @@ -99,3 +99,71 @@ This command creates and configures a Symphony project that includes a code repo
| CI-Destroy main workflow | an Azure devops pipeline or a GitHub action ,based on the selected tool in cmd, to destroy a previously deployed environment using the CI-Deploy workflow. | Azure devOps/GitHub |
|AZURE_CREDENTIALS Secret | GitHub Secret to store the Symphony **Reader Service Principal** credentials used by the Workflows to access the Symphony KeyVault | GitHub |
|Symphony-KV Service Connection | Azure DevOps ARM Service connection using **Reader Service Principal** credentials used by the pipelines to access the Symphony KeyVault | Azure DevOps |

## Using Existing Resources

Existing resources can be used with Symphony. The resources, however will need to follow a specific naming convention. To use existing resources you will need to create a `symphony.json` in a top level `.symphony` folder. A prefix and suffix value is required. Below is an basic example of that file:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would also add a note that instead of using symphony provision a user can use existing resources, basically making it clear that this replaces the need to run symphony provision


``` json
{
"prefix": "{prefix}",
"suffix": "{suffix}"
}
```

The pre-created resources must follow the current naming convention.

| Resource | naming convention |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add more detailed description for each resource features. the keyvault expect a group of secrets with specific names.
The state storage account and the backup state storage accounts are only needed for terraform. They also need to have a container with specific name as well.

The container registry stores the sample app 'eshop on web' api, and web images. Those needs to be created based on a certain commid Id from the eshop repo

az acr build --image "${APP_WEB_NAME}:${APP_COMMIT}" --registry "${CR_NAME}" --resource-group "${RG_NAME}" --file "${APP_WEB_DOCKERFILE}" .
.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When running Symphony provision with pre-created resources like a keyvault, it won't create the keyvault but I'm sure it will still make the secrets. Same for the other resources. The containers will be created for the storage accounts and the images will be pushed to the pre-created ACR. I can double check though.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@malcmiller - Even if symphony provision can create those secrets, part of "bring your own" dependencies is allowing users to skip provision entirely. We need to document everything that needs to be done in lieu of symphony provision and that includes setting up secrets and service principals.

| ----------------------------- | ------------------- |
| Resource Group | rg-{prefix}-{suffix} |
| Keyvault | kv-{prefix}-{suffix} |
| state storage account | sastate{prefix}{suffix} |
| backup state storage account | sastatebkup{prefix}{suffix} |
| container registry | cr{prefix}{suffix} |

### Existing Keyvault

When using an existing keyvault the following secrets must be present.

| Name | description |
| ----------------------------- | ------------------- |
| stateStorageAccount | name of the storage account that contains the tfstate |
Copy link
Contributor

@HadwaAbdelhalem HadwaAbdelhalem Jun 8, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please add a note here that those secrets (stateStorageAccount, stateStorageAccountBackup, stateContainer, and stateRg) are needed only if you provision Symphony for terraform.

| stateStorageAccountBackup | name of the backup storage account that contains the tfstate |
| stateContainer | name of the container that contains the tfstate file |
| stateRg | resource group containing the storage account |
| clientId | service principal client id |
| clientSecret | service principal client secret |
| subscriptionId | service principal subscription ID |
| tenantId | service principal tenant ID |
| readerClientId | reader service principal client id |
| readerClientSecret | reader service principal client id |
| readerSubscriptionId | reader service principal client id |
| readerTenantId | reader service principal client id |

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

add a section about the service principals. The owner service principal is the one used to access the env subscription on which resources will be deployed. While the reader service principal is used to create GH Secret or Azure DevOps service connection to access the Symphony Key vault. The reader Service principal needs to have policy permissions to (get list backup restore) the vault secrets.

### Existing Storage Accounts

When using an existing State Storage Account or Backup State Storage Account, a container name tfstate must be present.

### Existing Container Registry
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would leave a note here that ACR is only needed for the canonical application that we ship and is not part of symphony core itself.


When the acr is deployed using symphony, eshop images will be pushed. One for the API and one for the Web. The repo can be cloned from here: `https://github.com/dotnet-architecture/eShopOnWeb.git`. You can then build and push the containers to your acr. Below are some commands to start with:

```bash
RG_NAME=${Enter your resource group name}
CR_NAME=${Enter your container registry name}

APP_REPO="https://github.com/dotnet-architecture/eShopOnWeb.git"
APP_COMMIT="a72dd77"
APP_WEB_NAME="eshopwebmvc"
APP_WEB_DOCKERFILE="src/Web/Dockerfile"
APP_API_NAME="eshoppublicapi"
APP_API_DOCKERFILE="src/PublicApi/Dockerfile"

git clone "${APP_REPO}" "_app"

git checkout "${APP_COMMIT}"

az acr build --image "${APP_WEB_NAME}:${APP_COMMIT}" --registry "${CR_NAME}" --resource-group "${RG_NAME}" --file "${APP_WEB_DOCKERFILE}" .

az acr build --image "${APP_API_NAME}:${APP_COMMIT}" --registry "${CR_NAME}" --resource-group "${RG_NAME}" --file "${APP_API_DOCKERFILE}" .
```