Skip to content
This repository was archived by the owner on Jan 30, 2025. It is now read-only.

Commit d68824a

Browse files
SenthuranSivananthanSenthuranSivananthan
authored
Organize deployment parameters for Hub Networking with Azure Firewall (Azure#265)
1 parent 2bc196a commit d68824a

23 files changed

+2426
-1904
lines changed

‎.pipelines/templates/steps/deploy-platform-connectivity-hub-azfw.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ steps:
7575
7676
# Check if the Azure Firewall Policy Id is provided in the parameters json.
7777
# If present, then do no change it. Otherwise add it to the json parameter file.
78-
AZURE_FIREWALL_POLICY_RESOURCE_ID_IN_PARAMETERS=`jq -r .parameters.azureFirewallExistingPolicyId.value ${{ parameters.networkingConfigurationPath }}`
78+
AZURE_FIREWALL_POLICY_RESOURCE_ID_IN_PARAMETERS=`jq -r .parameters.hub.value.azureFirewall.firewallPolicyId ${{ parameters.networkingConfigurationPath }}`
7979
8080
if [[ $AZURE_FIREWALL_POLICY_RESOURCE_ID_IN_PARAMETERS != null && "$AZURE_FIREWALL_POLICY_RESOURCE_ID_IN_PARAMETERS" != "" ]];
8181
then
@@ -98,7 +98,7 @@ steps:
9898
echo "Azure Firewall Policy Id: $AZURE_FIREWALL_POLICY_ID"
9999
100100
# use jq to update the json parameter file
101-
echo "$( jq '.parameters.azureFirewallExistingPolicyId.value = "'$AZURE_FIREWALL_POLICY_ID'"' ${{ parameters.networkingConfigurationPath }} )" > ${{ parameters.networkingConfigurationPath }}
101+
echo "$( jq '.parameters.hub.value.azureFirewall.firewallPolicyId = "'$AZURE_FIREWALL_POLICY_ID'"' ${{ parameters.networkingConfigurationPath }} )" > ${{ parameters.networkingConfigurationPath }}
102102
fi
103103
104104
# Check if the log analytics workspace id is provided in the parameters json.
@@ -127,16 +127,16 @@ steps:
127127
workingDirectory: '${{ parameters.workingDir }}/lz-platform-connectivity-hub-azfw'
128128

129129
- task: AzureCLI@2
130-
displayName: Azure Policy - Enable Private DNS Zone Policies (if deployPrivateDnsZones=true in config)
130+
displayName: Azure Policy - Enable Private DNS Zone Policies (if privateDnsZones.enabled=true in config)
131131
inputs:
132132
azureSubscription: $(serviceConnection)
133133
scriptType: 'bash'
134134
scriptLocation: 'inlineScript'
135135
inlineScript: |
136136
$(var-bashPreInjectScript)
137137
138-
DEPLOY_PRIVATE_DNS_ZONES=`jq -r .parameters.deployPrivateDnsZones.value ${{ parameters.networkingConfigurationPath }}`
139-
PRIVATE_DNS_ZONES_RESOURCE_GROUP=`jq -r .parameters.rgPrivateDnsZonesName.value ${{ parameters.networkingConfigurationPath }}`
138+
DEPLOY_PRIVATE_DNS_ZONES=`jq -r .parameters.privateDnsZones.value.enabled ${{ parameters.networkingConfigurationPath }}`
139+
PRIVATE_DNS_ZONES_RESOURCE_GROUP=`jq -r .parameters.privateDnsZones.value.resourceGroupName ${{ parameters.networkingConfigurationPath }}`
140140
141141
case $DEPLOY_PRIVATE_DNS_ZONES in
142142
(true)
@@ -164,22 +164,22 @@ steps:
164164
workingDirectory: '$(System.DefaultWorkingDirectory)/policy/custom/assignments'
165165

166166
- task: AzureCLI@2
167-
displayName: Azure Policy - Enable DDoS Standard (if deployDdosStandard=true in config)
167+
displayName: Azure Policy - Enable DDoS Standard (if ddosStandard.enabled=true in config)
168168
inputs:
169169
azureSubscription: $(serviceConnection)
170170
scriptType: 'bash'
171171
scriptLocation: 'inlineScript'
172172
inlineScript: |
173173
$(var-bashPreInjectScript)
174174
175-
DEPLOY_DDOS_STANDARD=`jq -r .parameters.deployDdosStandard.value ${{ parameters.networkingConfigurationPath }}`
175+
DEPLOY_DDOS_STANDARD=`jq -r .parameters.ddosStandard.value.enabled ${{ parameters.networkingConfigurationPath }}`
176176
177177
case $DEPLOY_DDOS_STANDARD in
178178
(true)
179179
echo "DDoS Standard is enabled, creating Azure Policy assignment to protect for all Virtual Networks in '$(var-topLevelManagementGroupName)' management group."
180180
181-
DDOS_STANDARD_RESOURCE_GROUP_NAME=`jq -r .parameters.rgDdosName.value ${{ parameters.networkingConfigurationPath }}`
182-
DDOS_STANDARD_PLAN_NAME=`jq -r .parameters.ddosPlanName.value ${{ parameters.networkingConfigurationPath }}`
181+
DDOS_STANDARD_RESOURCE_GROUP_NAME=`jq -r .parameters.ddosStandard.value.resourceGroupName ${{ parameters.networkingConfigurationPath }}`
182+
DDOS_STANDARD_PLAN_NAME=`jq -r .parameters.ddosStandard.value.planName ${{ parameters.networkingConfigurationPath }}`
183183
184184
# Identify the Resource Id for DDOS Standard Plan
185185
DDOS_PLAN_ID=`az network ddos-protection show -g $DDOS_STANDARD_RESOURCE_GROUP_NAME -n $DDOS_STANDARD_PLAN_NAME --subscription ${{ parameters.networkingSubscriptionId }} --query id -o tsv`

‎config/networking/CanadaESLZ-main/hub-azfw/hub-network.parameters.json‎

Lines changed: 138 additions & 109 deletions
Original file line numberDiff line numberDiff line change
@@ -77,120 +77,149 @@
7777
"TechnicalContact": "technical-contact-tag"
7878
}
7979
},
80-
"deployPrivateDnsZones": {
81-
"value": true
82-
},
83-
"rgPrivateDnsZonesName": {
84-
"value": "pubsec-dns-rg"
85-
},
86-
"deployDdosStandard": {
87-
"value": false
88-
},
89-
"rgDdosName": {
90-
"value": "pubsec-ddos-rg"
91-
},
92-
"ddosPlanName": {
93-
"value": "ddos-plan"
94-
},
95-
"bastionName": {
96-
"value": "bastion"
97-
},
98-
"bastionSku": {
99-
"value": "Standard"
100-
},
101-
"bastionScaleUnits": {
102-
"value": 2
103-
},
104-
"rgPazName": {
105-
"value": "pubsec-public-access-zone-rg"
106-
},
107-
"rgMrzName": {
108-
"value": "pubsec-management-restricted-zone-rg"
109-
},
110-
"mrzVnetName": {
111-
"value": "management-restricted-vnet"
112-
},
113-
"mrzVnetAddressPrefixRFC1918": {
114-
"value": "10.18.4.0/22"
115-
},
116-
"mrzMazSubnetName": {
117-
"value": "MazSubnet"
118-
},
119-
"mrzMazSubnetAddressPrefix": {
120-
"value": "10.18.4.0/25"
121-
},
122-
"mrzInfSubnetName": {
123-
"value": "InfSubnet"
124-
},
125-
"mrzInfSubnetAddressPrefix": {
126-
"value": "10.18.4.128/25"
127-
},
128-
"mrzSecSubnetName": {
129-
"value": "SecSubnet"
130-
},
131-
"mrzSecSubnetAddressPrefix": {
132-
"value": "10.18.5.0/26"
133-
},
134-
"mrzLogSubnetName": {
135-
"value": "LogSubnet"
136-
},
137-
"mrzLogSubnetAddressPrefix": {
138-
"value": "10.18.5.64/26"
139-
},
140-
"mrzMgmtSubnetName": {
141-
"value": "MgmtSubnet"
142-
},
143-
"mrzMgmtSubnetAddressPrefix": {
144-
"value": "10.18.5.128/26"
145-
},
146-
"rgHubName": {
147-
"value": "pubsec-hub-networking-rg"
148-
},
149-
"hubVnetName": {
150-
"value": "hub-vnet"
151-
},
152-
"hubVnetAddressPrefixRFC1918": {
153-
"value": "10.18.0.0/22"
154-
},
155-
"hubVnetAddressPrefixRFC6598": {
156-
"value": "100.60.0.0/16"
157-
},
158-
"hubVnetAddressPrefixBastion": {
159-
"value": "192.168.0.0/16"
160-
},
161-
"hubPazSubnetName": {
162-
"value": "PAZSubnet"
163-
},
164-
"hubPazSubnetAddressPrefix": {
165-
"value": "100.60.1.0/24"
166-
},
167-
"hubGatewaySubnetAddressPrefix": {
168-
"value": "10.18.0.0/27"
169-
},
170-
"hubAzureFirewallSubnetAddressPrefix": {
171-
"value": "10.18.1.0/24"
172-
},
173-
"hubAzureFirewallManagementSubnetAddressPrefix": {
174-
"value": "10.18.2.0/26"
80+
"privateDnsZones": {
81+
"value": {
82+
"enabled": true,
83+
"resourceGroupName": "pubsec-dns-rg"
84+
}
17585
},
176-
"hubBastionSubnetAddressPrefix": {
177-
"value": "192.168.0.0/24"
86+
"ddosStandard": {
87+
"value": {
88+
"enabled": false,
89+
"resourceGroupName": "pubsec-ddos-rg",
90+
"planName": "ddos-plan"
91+
}
17892
},
179-
"azureFirewallName": {
180-
"value": "pubsecAzureFirewall"
93+
"publicAccessZone": {
94+
"value": {
95+
"enabled": true,
96+
"resourceGroupName": "pubsec-public-access-zone-rg"
97+
}
18198
},
182-
"azureFirewallZones": {
183-
"value": [
184-
"1",
185-
"2",
186-
"3"
187-
]
99+
"managementRestrictedZone": {
100+
"value": {
101+
"enabled": true,
102+
"resourceGroupName": "pubsec-management-restricted-zone-rg",
103+
"network": {
104+
"name": "management-restricted-vnet",
105+
"addressPrefixes": ["10.18.4.0/22"],
106+
"subnets": [
107+
{
108+
"comments": "Management (Access Zone) Subnet",
109+
"name": "MazSubnet",
110+
"addressPrefix": "10.18.4.0/25",
111+
"nsg": {
112+
"enabled": true
113+
},
114+
"udr": {
115+
"enabled": true
116+
}
117+
},
118+
{
119+
"comments": "Infrastructure Services (Restricted Zone) Subnet",
120+
"name": "InfSubnet",
121+
"addressPrefix": "10.18.4.128/25",
122+
"nsg": {
123+
"enabled": true
124+
},
125+
"udr": {
126+
"enabled": true
127+
}
128+
},
129+
{
130+
"comments": "Security Services (Restricted Zone) Subnet",
131+
"name": "SecSubnet",
132+
"addressPrefix": "10.18.5.0/26",
133+
"nsg": {
134+
"enabled": true
135+
},
136+
"udr": {
137+
"enabled": true
138+
}
139+
},
140+
{
141+
"comments": "Logging Services (Restricted Zone) Subnet",
142+
"name": "LogSubnet",
143+
"addressPrefix": "10.18.5.64/26",
144+
"nsg": {
145+
"enabled": true
146+
},
147+
"udr": {
148+
"enabled": true
149+
}
150+
},
151+
{
152+
"comments": "Core Management Interfaces (Restricted Zone) Subnet",
153+
"name": "MgmtSubnet",
154+
"addressPrefix": "10.18.5.128/26",
155+
"nsg": {
156+
"enabled": true
157+
},
158+
"udr": {
159+
"enabled": true
160+
}
161+
}
162+
]
163+
}
164+
}
188165
},
189-
"azureFirewallForcedTunnelingEnabled": {
190-
"value": false
166+
"hub": {
167+
"value": {
168+
"resourceGroupName": "pubsec-hub-networking-rg",
169+
"bastion": {
170+
"enabled": true,
171+
"name": "bastion",
172+
"sku": "Standard",
173+
"scaleUnits": 2
174+
},
175+
"azureFirewall": {
176+
"name": "pubsecAzureFirewall",
177+
"availabilityZones": ["1", "2", "3"],
178+
"forcedTunnelingEnabled": false,
179+
"forcedTunnelingNextHop": "10.17.1.4"
180+
},
181+
"network": {
182+
"name": "hub-vnet",
183+
"addressPrefixes": [
184+
"10.18.0.0/22",
185+
"100.60.0.0/16"
186+
],
187+
"addressPrefixBastion": "192.168.0.0/16",
188+
"subnets": {
189+
"gateway": {
190+
"comments": "Gateway Subnet used for VPN and/or Express Route connectivity",
191+
"name": "GatewaySubnet",
192+
"addressPrefix": "10.18.0.0/27"
193+
},
194+
"firewall": {
195+
"comments": "Azure Firewall",
196+
"name": "AzureFirewallSubnet",
197+
"addressPrefix": "10.18.1.0/24"
198+
},
199+
"firewallManagement": {
200+
"comments": "Azure Firewall Management",
201+
"name": "AzureFirewallManagementSubnet",
202+
"addressPrefix": "10.18.2.0/26"
203+
},
204+
"bastion": {
205+
"comments": "Azure Bastion",
206+
"name": "AzureBastionSubnet",
207+
"addressPrefix": "192.168.0.0/24"
208+
},
209+
"publicAccess": {
210+
"comments": "Public Access Zone (Application Gateway)",
211+
"name": "PAZSubnet",
212+
"addressPrefix": "100.60.1.0/24"
213+
},
214+
"optional": []
215+
}
216+
}
217+
}
191218
},
192-
"azureFirewallForcedTunnelingNextHop": {
193-
"value": "10.17.1.4"
219+
"networkWatcher": {
220+
"value": {
221+
"resourceGroupName": "NetworkWatcherRG"
222+
}
194223
}
195224
}
196225
}

0 commit comments

Comments
 (0)