|
1 | 1 | --- |
2 | | -title: "Part 2: CI/CD Infrastructure" |
3 | | -sidebar_label: "02 - CI/CD Infrastructure" |
4 | | -sidebar_position: 2 |
5 | | -description: "Establish B2B access, source control project, CI/CD runners, and automation infrastructure" |
| 2 | +title: "Part 1: CI/CD Infrastructure" |
| 3 | +sidebar_label: "01 - CI/CD Infrastructure" |
| 4 | +sidebar_position: 1 |
| 5 | +description: "Establish source control project, CI/CD runners, and automation infrastructure" |
6 | 6 | --- |
7 | 7 |
|
8 | | -# Part 2: CI/CD Infrastructure |
| 8 | +import Tabs from '@theme/Tabs'; |
| 9 | +import TabItem from '@theme/TabItem'; |
| 10 | + |
| 11 | +# Part 1: CI/CD Infrastructure |
9 | 12 |
|
10 | 13 | [](../index.mdx) |
11 | 14 | [](https://learn.microsoft.com/en-us/azure/azure-local/) |
12 | | -[](https://gitlab.com) |
| 15 | +[](https://github.com) |
| 16 | +[](https://gitlab.com) |
| 17 | +[](https://dev.azure.com) |
13 | 18 |
|
14 | | -> **DOCUMENT CATEGORY**: Part Overview |
15 | | -> **SCOPE**: Azure Local Cloud management infrastructure (Stages 00-02) |
16 | | -> **PURPOSE**: Establish B2B access, source control project, CI/CD runners, and automation |
17 | | -> **MASTER REFERENCE**: [CI/CD pipeline Documentation](https://docs.gitlab.com/ee/ci/) |
| 19 | +> **DOCUMENT CATEGORY**: Part Overview |
| 20 | +> **SCOPE**: Azure Local management infrastructure (Phase 01) |
| 21 | +> **PURPOSE**: Establish source control project, CI/CD runners, and automation infrastructure |
18 | 22 |
|
19 | | -**Status**: Active |
20 | | -**Execution**: Once per deployment program |
21 | | -**Last Updated**: 2026-01-31 |
| 23 | +**Status**: Active |
| 24 | +**Execution**: Once per deployment program |
| 25 | +**Last Updated**: 2026-03-19 |
22 | 26 |
|
23 | 27 | --- |
24 | 28 |
|
25 | 29 | ## Part Purpose |
26 | 30 |
|
27 | | -This part establishes the Azure Local Cloud management infrastructure required for Azure Local deployments. It covers B2B tenant access, source control project setup, CI/CD runners, and automation user access. |
| 31 | +This part establishes the management infrastructure required for Azure Local deployments. It covers CI/CD service principal creation, source control project setup, CI/CD runners, and automation user access. |
28 | 32 |
|
29 | 33 | --- |
30 | 34 |
|
31 | | -## Stages in This Part |
| 35 | +## Phase in This Part |
32 | 36 |
|
33 | | -| Stage | Title | Description | Steps | |
| 37 | +| Phase | Title | Description | Steps | |
34 | 38 | |-------|-------|-------------|-------| |
35 | | -| **[Phase 00](./phase-01-cicd-setup/)** | B2B Configuration | Configure Microsoft Entra ID B2B Cross-Tenant Synchronization | 2 | |
36 | | -| **[Phase 01](./phase-01-cicd-setup/)** | CI/CD Setup | Create source control project, configure settings, environments, and variables | 5 | |
37 | | -| **Phase 02** | Infrastructure Deployment | Deploy CI/CD runners, Entra ID groups, and verify user access | 3 | |
| 39 | +| **[Phase 01](./phase-01-cicd-setup/)** | CI/CD Setup | Bootstrap Azure access, create source control project, configure settings, environments, variables, and deploy runners | 6 | |
38 | 40 |
|
39 | 41 | --- |
40 | 42 |
|
41 | 43 | ## Execution Flow |
42 | 44 |
|
43 | 45 | ``` |
44 | | -┌─────────────────────────────────────────────────────────────────────────────┐ |
45 | | -│ Part 2: CI/CD Infrastructure │ |
46 | | -├─────────────────────────────────────────────────────────────────────────────┤ |
47 | | -│ │ |
48 | | -│ ┌─────────────┐ ┌─────────────┐ ┌─────────────────────────────────┐ │ |
49 | | -│ │ Stage 00 │ │ Stage 01 │ │ Stage 02 │ │ |
50 | | -│ │ B2B │───▶│ CI/CD │───▶│ Infrastructure Deployment │ │ |
51 | | -│ │ Config │ │ Setup │ │ │ │ |
52 | | -│ └─────────────┘ └─────────────┘ └─────────────────────────────────┘ │ |
53 | | -│ │ │ │ │ |
54 | | -│ ▼ ▼ ▼ │ |
55 | | -│ ┌───────────┐ ┌─────────────┐ ┌───────────────────────────────────┐ │ |
56 | | -│ │ Azure Local Cloud│ │ GitLab │ │ ┌─────────┐ ┌─────────────────┐ │ │ |
57 | | -│ │ Users │ │ Project │ │ │ Runners │ │ Entra Groups │ │ │ |
58 | | -│ │ Synced │ │ Created │ │ └─────────┘ └─────────────────┘ │ │ |
59 | | -│ └───────────┘ └─────────────┘ └───────────────────────────────────┘ │ |
60 | | -│ │ |
61 | | -└─────────────────────────────────────────────────────────────────────────────┘ |
| 46 | +┌─────────────────────────────────────────────────────────────────────────┐ |
| 47 | +│ Part 1: CI/CD Infrastructure │ |
| 48 | +├─────────────────────────────────────────────────────────────────────────┤ |
| 49 | +│ │ |
| 50 | +│ ┌───────────────────────────────────────────────────────────────────┐ │ |
| 51 | +│ │ Phase 01: CI/CD Setup │ │ |
| 52 | +│ ├───────────────────────────────────────────────────────────────────┤ │ |
| 53 | +│ │ │ │ |
| 54 | +│ │ Task 01: Bootstrap (Service Principal) │ │ |
| 55 | +│ │ Task 02: Create Source Control Project │ │ |
| 56 | +│ │ Task 03: Configure Project Settings │ │ |
| 57 | +│ │ Task 04: Create Environments │ │ |
| 58 | +│ │ Task 05: Configure Variables │ │ |
| 59 | +│ │ Task 06: Deploy Runners │ │ |
| 60 | +│ │ │ │ |
| 61 | +│ └───────────────────────────────────────────────────────────────────┘ │ |
| 62 | +│ │ |
| 63 | +└─────────────────────────────────────────────────────────────────────────┘ |
62 | 64 | ``` |
63 | 65 |
|
64 | 66 | --- |
65 | 67 |
|
66 | 68 | ## Key Deliverables |
67 | 69 |
|
68 | | -| Deliverable | Stage | Description | |
69 | | -|-------------|-------|-------------| |
70 | | -| **B2B Tenant Access** | 00 | Azure Local Cloud users synced to customer tenant (Member or Guest type) | |
71 | | -| **source control project** | 01 | Customer project created from Azure Local Cloud template | |
72 | | -| **Project Settings** | 01 | Branch protection, merge approvals, security settings configured | |
73 | | -| **Environments** | 01 | GitLab environments created for each deployment target | |
74 | | -| **CI/CD runners** | 02 | Self-hosted runners deployed in customer Azure subscription | |
75 | | -| **Entra ID Groups** | 02 | Azure Local Cloud management groups deployed with RBAC | |
76 | | -| **User Access** | 02 | Verified deployment team access to Azure resources | |
| 70 | +| Deliverable | Task | Description | |
| 71 | +|-------------|------|-------------| |
| 72 | +| **CI/CD Service Principal** | 01 | Entra ID app registration for pipeline authentication | |
| 73 | +| **Source Control Project** | 02 | Deployment project/repo created from Azure Local template | |
| 74 | +| **Project Settings** | 03 | Branch protection, code review, security settings configured | |
| 75 | +| **Environments** | 04 | Deployment environments created for each target | |
| 76 | +| **CI/CD Variables** | 05 | Environment-specific secrets and variables configured | |
| 77 | +| **CI/CD Runners** | 06 | Self-hosted runners deployed in target Azure subscription | |
77 | 78 |
|
78 | 79 | --- |
79 | 80 |
|
80 | 81 | ## Prerequisites |
81 | 82 |
|
82 | | -Before starting Part 2: |
| 83 | +Before starting Part 1: |
83 | 84 |
|
84 | | -- [ ] [Part 1: Planning & Discovery](../../planning/) completed |
85 | | -- [ ] Customer information collected (CID, name, tenant ID, service tier) |
86 | | -- [ ] Azure Local Cloud MGMT tenant access (Security Administrator or higher) |
87 | | -- [ ] Customer tenant Global Administrator consent obtained |
88 | | -- [ ] GitLab access with project creation permissions |
| 85 | +- [ ] [Planning & Discovery](../../planning/) completed |
| 86 | +- [ ] Deployment information collected (organization name, tenant ID, subscription IDs) |
| 87 | +- [ ] Azure CLI installed and authenticated to target tenant |
| 88 | +- [ ] Source control platform access with project/repo creation permissions |
89 | 89 | - [ ] Azure subscription access for runner deployment |
90 | 90 |
|
91 | 91 | --- |
92 | 92 |
|
93 | | -## Configuration Templates |
94 | | - |
95 | | -JSON and Terraform templates are located in the AZL Toolkit repository: |
96 | | - |
97 | | -``` |
98 | | -azurelocal-toolkit/ |
99 | | -├── configs/ |
100 | | -│ └── azure/ |
101 | | -│ └── b2b/ # Stage 00 - B2B config templates |
102 | | -│ ├── customer-inbound-policy.json |
103 | | -│ ├── Azure Local Cloud-outbound-policy.json |
104 | | -│ ├── cts-application.json |
105 | | -│ ├── cts-credentials.json |
106 | | -│ ├── cts-provisioning-job.json |
107 | | -│ ├── cts-group-assignment.json |
108 | | -│ └── README.md |
109 | | -└── scripts/ |
110 | | - └── deploy/ |
111 | | - └── stage-0-b2b-config/ # Stage 00 deployment scripts |
112 | | -``` |
113 | | - |
114 | | ---- |
115 | | - |
116 | 93 | ## Terraform Modules Used |
117 | 94 |
|
118 | | -| Module | Stage | Purpose | |
119 | | -|--------|-------|---------| |
120 | | -| `tf-module-azr-gitlab-runner` | 02 | Deploy CI/CD runner VMs in customer subscription | |
121 | | -| `tf-module-azr-entra-groups` | 02 | Deploy Entra ID groups for Azure Local Cloud access | |
| 95 | +| Module | Task | Purpose | |
| 96 | +|--------|------|---------| |
| 97 | +| `azurelocal-toolkit//terraform/modules/cicd-runner` | 06 | Deploy CI/CD runner VMs in target subscription | |
122 | 98 |
|
123 | 99 | --- |
124 | 100 |
|
125 | 101 | ## Validation Checklist |
126 | 102 |
|
127 | | -### Phase 00: B2B Configuration |
128 | | -- [ ] Azure Local Cloud users synced to customer tenant |
129 | | -- [ ] User type is correct (Member for Azure Local Cloud, Guest for CI/CD) |
130 | | -- [ ] Users can authenticate to customer tenant |
131 | | -- [ ] CTS provisioning job is running |
132 | | - |
133 | | -### Phase 01: CI/CD Setup |
134 | | -- [ ] source control project created with correct naming |
135 | | -- [ ] Branch protection and merge approvals configured |
| 103 | +- [ ] CI/CD service principal created with correct RBAC roles |
| 104 | +- [ ] Source control project created with correct naming |
| 105 | +- [ ] Branch protection and code review configured |
136 | 106 | - [ ] Environments created |
137 | 107 | - [ ] Environment variables configured |
138 | | - |
139 | | -### Phase 02: Infrastructure Deployment |
140 | 108 | - [ ] CI/CD runners deployed and registered |
141 | | -- [ ] Runners appear online in GitLab |
142 | | -- [ ] Entra ID groups created |
143 | | -- [ ] RBAC assignments applied |
144 | | -- [ ] Azure Local Cloud users can access Azure resources |
| 109 | +- [ ] Runners appear online in source control platform |
145 | 110 |
|
146 | 111 | --- |
147 | 112 |
|
148 | 113 | ## Next Steps |
149 | 114 |
|
150 | | -After completing Part 2, proceed to [Part 3: Azure Foundation](../02-azure-foundation/) to establish the Azure cloud infrastructure including landing zones, networking, and security resources. |
| 115 | +After completing Part 1, proceed to [Part 2: Azure Foundation](../02-azure-foundation/) to establish the Azure cloud infrastructure including landing zones, networking, and security resources. |
151 | 116 |
|
152 | 117 | --- |
153 | 118 |
|
154 | 119 | ## References |
155 | 120 |
|
156 | 121 | - [Cross-Tenant Synchronization Overview](https://learn.microsoft.com/en-us/entra/identity/multi-tenant-organizations/cross-tenant-synchronization-overview) |
157 | | -- [CI/CD pipeline Documentation](https://docs.gitlab.com/ee/ci/) |
158 | | -- [CI/CD runner Documentation](https://docs.gitlab.com/runner/) |
159 | 122 | - [Azure RBAC Documentation](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview) |
| 123 | +- [GitHub Actions Documentation](https://docs.github.com/en/actions) |
| 124 | +- [GitHub Actions Self-Hosted Runners](https://docs.github.com/en/actions/hosting-your-own-runners) |
| 125 | +- [GitLab CI/CD Documentation](https://docs.gitlab.com/ee/ci/) |
| 126 | +- [GitLab Runner Documentation](https://docs.gitlab.com/runner/) |
| 127 | +- [Azure DevOps Pipelines Documentation](https://learn.microsoft.com/en-us/azure/devops/pipelines/) |
| 128 | +- [Azure DevOps Self-Hosted Agents](https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/agents) |
160 | 129 |
|
0 commit comments