Updates may 2025

[thomast1906]

Summary of changes

🧱 Terraform, Security & Lab Updates

• Migrated Terraform CI authentication to OIDC (replacing client secrets)
• Updated to Terraform 1.11.0
• AKS version 1.32
• terraform-docs, and tfsec security scanning into CI pipeline
• Enforced tagging standards and directory consistency across Terraform commands

📘 Documentation Enhancements

• Improved labs content
• Added a new Azure overview README summarising lab purpose and key practices.

🛠️ Script Overhauls

• Replaced basic setup scripts with robust versions featuring:
  • Error handling
  • Metadata outputs and validation

This pull request introduces significant updates to the Azure setup and Terraform workflows for the "DevOps The Hard Way - Azure" project. Key changes include enhancements to security and automation in Terraform workflows, improved documentation for labs, and the addition of robust scripts for Azure resource provisioning. Below are the most important changes, grouped by theme:

Terraform Workflow Enhancements

• Updated .github/workflows/main.yml to support OpenID Connect (OIDC) for Terraform authentication, replacing the use of client secrets. Added id-token: write permission and the ARM_USE_OIDC environment variable.
• Upgraded Terraform version to 1.11.0 and added steps for rendering Terraform documentation (terraform-docs) and performing security scans (tfsec) in the CI pipeline.
• Ensured all Terraform commands (init, plan, apply, etc.) explicitly set the working directory to ./2-Terraform-AZURE-Services-Creation/4-aks for consistency. [1] [2]

Documentation Improvements

• Enhanced the 1-Configure-Terraform-Remote-Storage.md lab by adding prerequisites (e.g., Contributor permissions) and detailing security measures like encryption, TLS enforcement, and resource locks for Azure Storage Accounts. [1] [2] [3]
• Updated the 2-Create-Azure-AD-Group-AKS-Admins.md lab with clearer prerequisites and best practices, including Conditional Access policies and Privileged Identity Management (PIM). [1] [2]
• Added an overview README (1-Azure/README.md) to summarize the purpose of the Azure setup, list labs, and highlight best practices like RBAC and Infrastructure as Code.

Script Enhancements

• Replaced the basic create-terraform-storage.sh script with a more robust version (1-create-terraform-storage.sh) that includes error handling, enhanced security configurations (e.g., TLS 1.2, public access disabled), and detailed Terraform backend output. [1] [2]
• Replaced the basic create-azure-ad-group.sh script with an improved version (2-create-azure-ad-group.sh) that adds descriptive metadata, checks for existing resources, and outputs the Azure AD Group ID in a user-friendly format. [1] [2]

Terraform Configuration and Lab Updates

• Updated the ACR lab (1-Create-ACR.md) to include additional prerequisites (e.g., Azure CLI) and best practices such as using Managed Identity for authentication and implementing retention policies for cost optimization. [1] [2]
• Improved the Terraform configuration for ACR to enforce consistent tagging and use a Standard SKU for better resource management.

These changes enhance the project's security, maintainability, and usability, aligning with best practices for Azure and Terraform workflows.