Skip to content

environments.md

Latest commit

 

History

History
76 lines (64 loc) · 7.56 KB

environments.md

File metadata and controls

76 lines (64 loc) · 7.56 KB
Raw

ARO HCP Tenants and Environments

Azure Tenants

Red Hat Tenant (Development Tenant)

  • Access: Requires a Red Hat (RH) account
  • Purpose: Hosts various development and test-related environments
  • Pros:
    • full control over the environment
    • small entry barrier
    • nearly no restrictions
    • quick development cycles
  • Cons:
    • nearly no restrictions
    • no access to EV2 deployments
    • no access to special Azure features (OneCert, SWIFT, MSI-RP, ...)
    • no MISE support

MSIT Corp Tenant (MSFT INT Tenant)

  • Access: Requires a b- account, accessed via Windows Virtual Desktop (WVD) or Virtual Machine (VM)
  • Purpose: Hosts the ARO HCP INT environment, testing EV2 rollouts and ARM interaction
  • Pros:
    • access to EV2 deployments
    • self-service EV2 deployments to retain a certain level of control and speed
    • access to certain special Azure features (OneCert, Kusto, ...)
    • MISE support
    • getting feedback of MSFT compliance requirements
  • Cons:
    • higher entry barrier with b- account
    • no access to certain Azure features (SWIFT, MSI-RP, ...)
    • restrictive managed identity federation...
    • ... combined with no multi-tenant app support complicates testing

AME Tenant (Azure Production Tenant)

  • Access: Requires an AME account, accessed from a SAW device
  • Purpose: Hosts the ARO HCP Stage and Production environments
  • Pros:
    • real life EV2 production deployments
    • access to all required Azure features
    • MISE support
  • Cons:
    • highest entry barrier with AME account and SAW devices
    • slow deployment cycles

ARO HCP Environment Overview

This table provides an overview of the various ARO HCP deployment environments, their Azure tenants and available capabilities and features the environment supports.

Deployment Environment Service Azure Tenant / Cloud Testing Azure Tenant / Cloud / Subscription Multi-tenant support OneCert Service Mock SPs ARM integration MSI RP MSFT Compliance required MISE Deployment Driver Logs Config / Env
Personal DEV Env Red Hat / Public Red Hat / Public / ARO Hosted Control Planes (EA Subscription 1) No No Yes No No No No Makefile in-cluster Pod logs config.yaml / pers
Developer Machine Red Hat / Public Red Hat / Public / ARO Hosted Control Planes (EA Subscription 1) No No Yes No No No No Makefile local config.yaml / pers *
Integrated / Shared Dev (decommissioned) Red Hat / Public Red Hat / Public / ARO Hosted Control Planes (EA Subscription 1) No No Yes No No No No Prow Azure Log Analytics config.yaml / dev
Integration MSIT Corp / Public Red Hat / Public / ARO SRE Team - INT (EA Subscription 3) No Yes Yes Yes No Yes Yes EV2 Geneva ADO sdp-pipelines/hcp/config.clouds-overlay.yaml / int
Staging AME / Public Red Hat / Public / ARO HCP - STAGE testing (EA Subscription) Yes Yes No Yes Yes Yes Yes EV2 Geneva ADO sdp-pipelines/hcp/config.clouds-overlay.yaml / stg
Production AME / Public Undefined Yes Yes No Yes Yes Yes Yes EV2 Geneva ADO sdp-pipelines/hcp/config.clouds-overlay.yaml / prd

Note

The Integrated / Shared Dev environment has been decommissioned. Only shared global resources (ACRs, DNS zones) are still deployed there via the global-pipeline-postsubmit Prow job, as these resources are shared by personal dev environments.

  • Deployment Environment: This is the name of an ARO HCP deployment environment as the team refers to it. By using this name, the team understands the context and capabilities of the environment.
  • Service Azure Tenant: The Azure tenant where the ARO HCP service is deployed, e.g. where the Service and Management Clusters are running.
  • User Azure Tenant: The Azure tenant where the users are creating their clusters and where their ARO HCP dataplane will be running.
  • Multi-tenant support: Indicates if the environment supports multiple tenants Apps/Service Principals or not. Multi-Tenancy is required if the Service and User Azure Tenant are different.
  • OneCert: Indicates if the environment supports the OneCert certificate signers/CAs, e.g. for creating certificates directly within Key Vault.
  • Service Mock SPs: Indicates if the environment requires us to use mocks for First Party App (FPA)
  • ARM integration: Indicates if the environment will be integrated with Azure Resource Manager (ARM). "We can use ARM to talk to the environment."
  • MSI RP: Indicates if we can use MSI-RP to get ahold of ARO HCP dataplane managed identities backing certificates.
  • MSFT Compliance required: Indicates if the environment requires MSFT Compliance.
  • MISE: Indicates if we can use MISE for RP frontend authn/z. If not available, we can only use kubectl port-forward to access the RP frontend service.
  • Deployment Driver: The tooling used to deploy / update an environment.
  • Logs: The log storage solution used for the environment.
  • Config / Env: A reference to the configuration file and environment name used for the environment.