Feature/107/pipelines refactor

[JinLee794]

107

Description

Adding conditional logic on the Terraform secure baseline ase deployment pipeline to:

• Only execute deployment (tf apply) on push to main events (once PR is merged)
• Added Production environment for Azure OIDC to control approval process for deployments
• Only executes the plan steps on PRs to allow for external contributors to introduce changes without deployment into our environment
• Added a pull request template for introducing changes going forward
• Added conditional logic to the ASE resources on the TF deployment to allow for optional creation of ASE (specify ase name/rg name in the input parameters as shown on Parameters/uat.tfvars)

Type of Change

Please delete options that are not relevant.

• [x] Bugfix (non-breaking change which fixes an issue)
• [ ] New feature (non-breaking change which adds functionality)
• [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
• [ ] Update to documentation

Checklist

• [x] I'm sure there are no other open Pull Requests for the same update/change
• [x] My corresponding pipelines / checks run clean and green without any errors or warnings
• [x] My code follows the style guidelines of this project
• [x] I have commented my code, particularly in hard-to-understand areas
• [x] I have made corresponding changes to the documentation (readme)
• [x] I did format my code

[github-actions[bot]]

Terraform Format and Style 🖌``

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Validation Output

``` Success! The configuration is valid. ```

Terraform Plan 📖success

Show Plan

``` Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: ~ update in-place Terraform will perform the following actions: # azurerm_subnet.vnetSpokeSubnet will be updated in-place ~ resource "azurerm_subnet" "vnetSpokeSubnet" { id = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/rgtf-networking-sec-baseline-sgl-dev-westus2-001/providers/Microsoft.Network/virtualNetworks/vnet-spoke-sec-baseline-sgl-dev-westus2-001/subnets/snet-ase-sec-baseline-sgl-dev-westus2-001" name = "snet-ase-sec-baseline-sgl-dev-westus2-001" # (7 unchanged attributes hidden) ~ delegation { name = "hostingEnvironment" ~ service_delegation { ~ actions = [ - "Microsoft.Network/virtualNetworks/subnets/action", + "Microsoft.Network/virtualNetworks/subnets/join/action", + "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action", ] name = "Microsoft.Web/hostingEnvironments" } } } Plan: 0 to add, 1 to change, 0 to destroy. ```

Pusher: @JinLee794, Action: pull_request, Working Directory: scenarios/secure-baseline-ase/terraform, Workflow: Single-tenant ASEv3 Secure Baseline: Terraform Deploy

[github-actions[bot]]

Terraform Format and Style 🖌``

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Validation Output

``` Success! The configuration is valid. ```

Terraform Plan 📖success

Show Plan

``` Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: ~ update in-place Terraform will perform the following actions: # azurerm_subnet.vnetSpokeSubnet will be updated in-place ~ resource "azurerm_subnet" "vnetSpokeSubnet" { id = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/rgtf-networking-sec-baseline-sgl-dev-westus2-001/providers/Microsoft.Network/virtualNetworks/vnet-spoke-sec-baseline-sgl-dev-westus2-001/subnets/snet-ase-sec-baseline-sgl-dev-westus2-001" name = "snet-ase-sec-baseline-sgl-dev-westus2-001" # (7 unchanged attributes hidden) ~ delegation { name = "hostingEnvironment" ~ service_delegation { ~ actions = [ - "Microsoft.Network/virtualNetworks/subnets/action", + "Microsoft.Network/virtualNetworks/subnets/join/action", + "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action", ] name = "Microsoft.Web/hostingEnvironments" } } } Plan: 0 to add, 1 to change, 0 to destroy. ```

Pusher: @JinLee794, Action: pull_request, Working Directory: scenarios/secure-baseline-ase/terraform, Workflow: Single-tenant ASEv3 Secure Baseline: Terraform Deploy

[github-actions[bot]]

Terraform Format and Style 🖌``

Terraform Initialization ⚙️success

Terraform Validation 🤖success

Validation Output

``` Success! The configuration is valid. ```

Terraform Plan 📖success

Show Plan

``` Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: ~ update in-place Terraform will perform the following actions: # azurerm_subnet.vnetSpokeSubnet will be updated in-place ~ resource "azurerm_subnet" "vnetSpokeSubnet" { id = "/subscriptions/864eb9d0-e9c4-4d6b-bf11-bd4cfde05e81/resourceGroups/rgtf-networking-sec-baseline-sgl-dev-westus2-001/providers/Microsoft.Network/virtualNetworks/vnet-spoke-sec-baseline-sgl-dev-westus2-001/subnets/snet-ase-sec-baseline-sgl-dev-westus2-001" name = "snet-ase-sec-baseline-sgl-dev-westus2-001" # (7 unchanged attributes hidden) ~ delegation { name = "hostingEnvironment" ~ service_delegation { ~ actions = [ - "Microsoft.Network/virtualNetworks/subnets/action", + "Microsoft.Network/virtualNetworks/subnets/join/action", + "Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action", ] name = "Microsoft.Web/hostingEnvironments" } } } Plan: 0 to add, 1 to change, 0 to destroy. ```

Pusher: @JinLee794, Action: pull_request, Working Directory: scenarios/secure-baseline-ase/terraform, Workflow: Single-tenant ASEv3 Secure Baseline: Terraform Deploy