Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add CMK support for Base Workspace #4161

Merged
merged 56 commits into from
Dec 9, 2024
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
56 commits
Select commit Hold shift + click to select a range
9d185d4
added management key vault
Sep 9, 2024
3bab628
added cmk for vmss and storage accounts
Sep 11, 2024
dec4288
Merge branch 'main' of https://github.com/yuvalyaron/AzureTRE into 40…
yuvalyaron Nov 7, 2024
7388db5
Merge branch 'main' of https://github.com/yuvalyaron/AzureTRE into 40…
yuvalyaron Nov 11, 2024
036b90e
add default value for variables
yuvalyaron Nov 13, 2024
27212b4
add CMK for cosmos accounts
yuvalyaron Nov 14, 2024
50ec316
move tre-encryption key from mgmt to core
yuvalyaron Nov 17, 2024
df682d6
fix order of creation for encryption key
yuvalyaron Nov 17, 2024
9e66234
add cmk for the state store in mgmt
yuvalyaron Nov 17, 2024
fed7a16
add support for external KV
yuvalyaron Nov 18, 2024
7f24a23
revert CMK for cosmos - not working, need to redo this
yuvalyaron Nov 18, 2024
cd9271a
refine comments and files names
yuvalyaron Nov 19, 2024
f459a82
remove redundant space
yuvalyaron Nov 19, 2024
af53615
add space
yuvalyaron Nov 19, 2024
61d8e97
upper case in comment
yuvalyaron Nov 19, 2024
25322d7
revert cosmos tags
yuvalyaron Nov 19, 2024
e3e2d6c
Merge branch 'main' into 4002-cmk-support
yuvalyaron Nov 19, 2024
8ef0231
update changelog + core version
yuvalyaron Nov 19, 2024
70ddb6b
remove unused var
yuvalyaron Nov 19, 2024
ce953ea
remove redundant variable
yuvalyaron Nov 19, 2024
8a48a95
remove redundant variables
yuvalyaron Nov 19, 2024
b07871e
add check for enable_cmk_encryption for the key_store_id variable in tf
yuvalyaron Nov 19, 2024
0106748
bugfix: remove redundant data keyword
yuvalyaron Nov 19, 2024
18ce3fd
add enable_cmk_encryption check in module variables
yuvalyaron Nov 20, 2024
c05f752
remove redundant key_vault_id from ignore_changes for cmk
yuvalyaron Nov 21, 2024
c7f1413
remove redundant sign/verify
yuvalyaron Nov 24, 2024
26c3f79
add cmk support for cosmos db
yuvalyaron Nov 24, 2024
1666b30
update changelog + add comments
yuvalyaron Nov 24, 2024
42886ff
update core version
yuvalyaron Nov 24, 2024
dea119b
fix linting issue
yuvalyaron Nov 24, 2024
d771f6c
add null provider to providers block
yuvalyaron Nov 24, 2024
c661fdb
Merge branch 'main' of https://github.com/microsoft/AzureTRE into 414…
yuvalyaron Nov 26, 2024
e8617e4
remove duplicates that were created by merge
yuvalyaron Nov 26, 2024
56d59f5
update core version
yuvalyaron Nov 26, 2024
23d30bf
remove redundant terraform data
yuvalyaron Nov 26, 2024
858a933
Add support for CMK encryption in workspace configuration
yuvalyaron Nov 28, 2024
0762590
add cmk for the ws storage accounts
yuvalyaron Nov 28, 2024
42a6617
fix encryption_identity being sent when cmk was disabled
yuvalyaron Dec 1, 2024
619eed7
Merge branch 'main' of https://github.com/microsoft/AzureTRE into 414…
yuvalyaron Dec 1, 2024
e774caa
update changelog
yuvalyaron Dec 1, 2024
c0269c0
update changelog
yuvalyaron Dec 1, 2024
6ed2af0
fix linting issues
yuvalyaron Dec 1, 2024
87253ff
bump rp version
yuvalyaron Dec 1, 2024
be22bc2
bump core version
yuvalyaron Dec 1, 2024
a7ef6ef
update docs
yuvalyaron Dec 1, 2024
886e520
use foreach for airlock cmks
yuvalyaron Dec 2, 2024
2d2de0e
update the porter upgrade command + minor version
yuvalyaron Dec 3, 2024
83cedee
Merge branch 'main' into 4145-cmk-for-base-ws
Dec 4, 2024
75fce3a
change the default value for key_store_id variable to an empty string
yuvalyaron Dec 5, 2024
d4cc8a1
set default value of key_store_id variable to null
yuvalyaron Dec 9, 2024
3a4969d
Merge branch 'main' of https://github.com/microsoft/AzureTRE into 414…
yuvalyaron Dec 9, 2024
8908188
Update default value of key_store_id variable to 'TWEAKME'
yuvalyaron Dec 9, 2024
7165e12
Remove default value for key_store_id variable in variables.tf
yuvalyaron Dec 9, 2024
341cc32
Set default value of key_store_id variable to an empty string in locals
yuvalyaron Dec 9, 2024
4fd15e1
Merge branch 'main' of https://github.com/microsoft/AzureTRE into 414…
yuvalyaron Dec 9, 2024
373f154
update core version
yuvalyaron Dec 9, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
remove redundant key_vault_id from ignore_changes for cmk
  • Loading branch information
yuvalyaron committed Nov 21, 2024
commit c05f752b8b6a78cdca8f23a0777974053833d3b6
6 changes: 0 additions & 6 deletions core/terraform/airlock/airlock_processor.tf
Original file line number Diff line number Diff line change
Expand Up @@ -44,12 +44,6 @@ resource "azurerm_storage_account_customer_managed_key" "sa_airlock_processor_fu
key_vault_id = var.key_store_id
key_name = var.kv_encryption_key_name
user_assigned_identity_id = var.encryption_identity_id

lifecycle {
ignore_changes = [
key_vault_id
]
}
}

resource "azurerm_linux_function_app" "airlock_function_app" {
Expand Down
30 changes: 0 additions & 30 deletions core/terraform/airlock/storage_accounts.tf
Original file line number Diff line number Diff line change
Expand Up @@ -58,12 +58,6 @@ resource "azurerm_storage_account_customer_managed_key" "sa_import_external_encr
key_vault_id = var.key_store_id
key_name = var.kv_encryption_key_name
user_assigned_identity_id = var.encryption_identity_id

lifecycle {
ignore_changes = [
key_vault_id
]
}
}

# 'Approved' export
Expand Down Expand Up @@ -124,12 +118,6 @@ resource "azurerm_storage_account_customer_managed_key" "sa_export_approved_encr
key_vault_id = var.key_store_id
key_name = var.kv_encryption_key_name
user_assigned_identity_id = var.encryption_identity_id

lifecycle {
ignore_changes = [
key_vault_id
]
}
}

# 'In-Progress' storage account
Expand Down Expand Up @@ -171,12 +159,6 @@ resource "azurerm_storage_account_customer_managed_key" "sa_import_in_progress_e
key_vault_id = var.key_store_id
key_name = var.kv_encryption_key_name
user_assigned_identity_id = var.encryption_identity_id

lifecycle {
ignore_changes = [
key_vault_id
]
}
}


Expand Down Expand Up @@ -290,12 +272,6 @@ resource "azurerm_storage_account_customer_managed_key" "sa_import_rejected_encr
key_vault_id = var.key_store_id
key_name = var.kv_encryption_key_name
user_assigned_identity_id = var.encryption_identity_id

lifecycle {
ignore_changes = [
key_vault_id
]
}
}

# 'Blocked' storage account
Expand Down Expand Up @@ -360,10 +336,4 @@ resource "azurerm_storage_account_customer_managed_key" "sa_import_blocked_encry
key_vault_id = var.key_store_id
key_name = var.kv_encryption_key_name
user_assigned_identity_id = var.encryption_identity_id

lifecycle {
ignore_changes = [
key_vault_id
]
}
}
6 changes: 0 additions & 6 deletions core/terraform/appgateway/staticweb.tf
Original file line number Diff line number Diff line change
Expand Up @@ -37,12 +37,6 @@ resource "azurerm_storage_account_customer_managed_key" "staticweb_encryption" {
key_vault_id = var.key_store_id
key_name = var.kv_encryption_key_name
user_assigned_identity_id = var.encryption_identity_id

lifecycle {
ignore_changes = [
key_vault_id
]
}
}

# Assign the "Storage Blob Data Contributor" role needed for uploading certificates to the storage account
Expand Down
6 changes: 0 additions & 6 deletions core/terraform/azure-monitor/azure-monitor.tf
Original file line number Diff line number Diff line change
Expand Up @@ -45,12 +45,6 @@ resource "azurerm_storage_account_customer_managed_key" "az_monitor_encryption"
key_vault_id = var.key_store_id
key_name = var.kv_encryption_key_name
user_assigned_identity_id = var.encryption_identity_id

lifecycle {
ignore_changes = [
key_vault_id
]
}
}

resource "azurerm_log_analytics_linked_storage_account" "workspace_storage_ingestion" {
Expand Down
6 changes: 0 additions & 6 deletions core/terraform/storage.tf
Original file line number Diff line number Diff line change
Expand Up @@ -83,10 +83,4 @@ resource "azurerm_storage_account_customer_managed_key" "encryption" {
depends_on = [
azurerm_role_assignment.kv_encryption_key_user[0]
]

lifecycle {
ignore_changes = [
key_vault_id
]
}
}
6 changes: 0 additions & 6 deletions devops/terraform/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -52,12 +52,6 @@ resource "azurerm_storage_account_customer_managed_key" "state_storage_encryptio
azurerm_role_assignment.kv_mgmt_encryption_key_user,
azurerm_key_vault_key.tre_mgmt_encryption[0]
]

lifecycle {
ignore_changes = [
key_vault_id
]
}
}


Expand Down
Loading