Deploy IaC Patch for Infrastructure and Policy
This section describes how to deploy an Infrastructure (IaC) patch using Terraform. IaC patch does not include service deployment.
 |
Set Deny Policy exemption
Before starting to deploy patch, ensure Deny Policy exemption is in place. Extend the existing policy exemption to cover the upgrade duration. This is required to avoid Terraform or deployment failures
|
Getting Started
• Get the new infrastructure zip package and extract. For more information, refer Step 1: Download
the infrastructure package (IaC zip).
• Store or update the infrastructure package in a respective IaC repository and branch of version control system.
• Refer or use existing input variables and configurations
◦ terraform/deployment-profiles/infra-templates/backend.conf. Refer Step 4: Configure
the Terraform backend Azure storage account
◦ terraform/deployment-profiles/infra-templates/infra.tfvars. Refer Step 3: Configure
Terraform infrastructure input parameters.
◦ terraform/deployment-profiles/policy-templates/backend.conf. Refer Step 4: Configure
the Terraform backend Azure storage account.
◦ terraform/deployment-profiles/policy-templates/policy.tfvars. Refer Step 3: Configure
Terraform infrastructure input parameters.
• Check documentation and release notes for target version and any version higher than source version.
◦ In case of any changes in input variables or configurations, update infra.tfvars and backend.conf accordingly.
Infrastructure Patch Deployment
Execute Terraform Patch
1. Go to Azure Resources Terraform.
cd terraform/deployment-profiles/infra-templates
2. Initialize Terraform.
terraform init -backend-config=backend.conf
3. Plan Terraform
terraform plan -var-file=infra.tfvars
|
|
Carefully review the Terraform plan before applying changes. Ensure that the changes displayed align with the intended infrastructure changes and that there are no unexpected modifications or deletions.
|
4. Apply Terraform.
terraform apply -var-file=infra.tfvars
During these steps:
◦ Only incremental changes are applied.
◦ Existing infrastructure remains intact.
◦ No unintended resource is deleted.
Azure Policy Patch Deployment
This section explains how to patch the Azure Policies, deployed using the same infrastructure zip file but with a policy terraform directory and state file.
1. Switch to Azure Resources Terraform.
cd terraform/deployment-profiles/policy-templates
2. Initialize Terraform.
terraform init -backend-config=backend.conf
3. Plan Terraform
terraform plan -var-file=policy.tfvars
|
|
Carefully review the Terraform plan before applying changes. Ensure that the displayed planned updates and upgrades align with the intended Azure Policy changes and that there are no unexpected modifications or deletions.
|
4. Apply Terraform.
terraform apply -var-file=infra.tfvars
Policy definitions updated.