Manual component-based installation

az login
az account show

./bootstrap-scripts/setup-devtools-azure.sh

export PPC_DEPLOY_DIR=<path to PPC deployment directory>
cd "$PPC_DEPLOY_DIR/iac/azure/cluster/modules/00_backup_storage"

    resource_group_name    = "<resource-group-name>"
    aks_cluster_name       = "<cluster-name>"
    storage_account_name   = "<storage-account-name>"
    storage_container_name = "velero"
    key_vault_name         = "<key-vault-name>"
    key_name               = "pty-backup-key"

    azure_subscription_id = "<subscription-id>"
    azure_location        = "<region>"        # e.g. eastus

    tofu init
    tofu plan          # review the proposed changes before applying
    tofu apply         # when prompted with "Enter a value:", type "yes"

    export PPC_DEPLOY_DIR=<path to PPC deployment directory>
    cd "$PPC_DEPLOY_DIR/iac/azure/cluster/modules/01_identity/"

    # -------------------------------------------------
    # Common (backend + provider — same value in all stages)
    # -------------------------------------------------
    resource_group_name    = "<resource-group-name>" # e.g. "aks-rg-prod"
    aks_cluster_name       = "<cluster-name>" # e.g. "prod-aks-cluster"
    azure_subscription_id  = "<subscription-id>" # e.g. "1e9ef7b6-cdc4-4a6b-98f7-a408ac1e19e0"
    storage_account_name   = "<storage-account-name>" # e.g. "myclusterstateaccount"
    storage_container_name = "velero"

    # -------------------------------------------------
    # Pre-existing managed identities (provided by IT)
    # -------------------------------------------------
    uami_id = "</subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<user-assigned-managed-identity-name>>"

    velero_uami_id = "</subscriptions/<subscription-id>/resourceGroups/<velero-resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<velero-managed-identity-name>>" # required  

    opensearch_uami_id = "</subscriptions/<subscription-id>/resourceGroups/<opensearch-resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<opensearch-managed-identity-name>>" # required

    # -------------------------------------------------
    # Key Vault (leave empty to skip KV role assignment)
    # -------------------------------------------------
    key_vault_name = "<key-vault-name>" # e.g. "my-key-vault"

    tofu init
    tofu plan          # review the proposed changes before applying
    tofu apply         # when prompted with "Enter a value:", type "yes"

   export PPC_DEPLOY_DIR=<path to PPC deployment directory>
   cd "$PPC_DEPLOY_DIR/iac/azure/cluster/modules/02_aks_cluster/"

    # -------------------------------------------------
    # Common (backend + provider — same value in all stages)
    # -------------------------------------------------
    resource_group_name    = "<resource-group-name>" # e.g. "aks-rg-prod"
    aks_cluster_name       = "<cluster-name>" # e.g. "prod-aks-cluster"
    azure_subscription_id  = "<subscription-id>" # e.g. "1e9ef7b6-cdc4-4a6b-98f7-a408ac1e19e0"
    storage_account_name   = "<storage-account-name>" # e.g. "myclusterstateaccount"
    storage_container_name = "velero"

    # -------------------------------------------------
    # Identity (UAMI for kubelet and federated credentials)
    # -------------------------------------------------
    uami_id            = "</subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<user-assigned-managed-identity-name>>" # full UAMI resource ID (same as Stage 01)
    velero_uami_id     = "</subscriptions/<subscription-id>/resourceGroups/<velero-resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<velero-managed-identity-name>>" # full Velero UAMI resource ID (for federated credential)
    opensearch_uami_id = "</subscriptions/<subscription-id>/resourceGroups/<opensearch-resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<opensearch-managed-identity-name>>" # full OpenSearch UAMI resource ID (for federated credential)

    # -------------------------------------------------
    # Cluster
    # -------------------------------------------------
    azure_location      = "<region>" # e.g. "eastus"  (auto-detected from resource group)
    subnet_id           = "</subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/<subnet-name>>" # e.g. "/subscriptions/.../subnets/snet-aks-applianceframework"
    private_dns_zone_id = "</subscriptions/<subscription-id>/resourceGroups/<dns-resource-group>/providers/Microsoft.Network/privateDnsZones/privatelink.eastus.azmk8s.io>" # e.g. "/subscriptions/.../privateDnsZones/privatelink.eastus.azmk8s.io"

    # -------------------------------------------------
    # Networking (service CIDR + DNS IP)
    # -------------------------------------------------
    service_cidr   = "<10.0.0.0/16>" # auto-derived by updatevartf.sh (non-overlapping with the VNet)
    dns_service_ip = "<10.220.0.10>" # auto-derived: the .10 host of the chosen service_cidr
    pod_cidr       = "<10.0.0.0/16>" # auto-derived: non-overlapping with the VNet and service_cidr

    # -------------------------------------------------
    # System node pool
    # -------------------------------------------------
    architecture                  = "amd64" # amd64 or arm64
    system_node_pool_vm_size      = ""      # leave empty to auto-select based on architecture
    system_node_pool_node_count   = 2
    system_node_pool_disk_size_gb = 50
    system_node_pool_os_sku       = "AzureLinux"
    system_node_pool_zones        = ["1", "2", "3"]
    fips_enabled                  = true # set false for a non-FIPS node OS image (immutable)

    # -------------------------------------------------
    # Ownership / tagging
    # -------------------------------------------------
    owner_email                   = "<name@domain.tld>" # optional; blank = auto-detect from the Azure CLI identity

    tofu init
    tofu plan          # review the proposed changes before applying
    tofu apply         # when prompted with "Enter a value:", type "yes"

# Confirm the AKS cluster is in Succeeded state
az aks show --name <cluster-name> --resource-group <resource-group> \
  --query "{Name:name, State:provisioningState, Version:kubernetesVersion, Fqdn:privateFqdn}" \
  --output table

Name              State      Version    Fqdn
----------------  ---------  ---------  -----------------------------------------------
<cluster-name>    Succeeded  1.35       <cluster-name>.privatelink.<region>.azmk8s.io

# Verify kubectl can reach the cluster
kubectl get nodes    # expect 2 system nodes in Ready state

# Verify federated credentials exist
az identity federated-credential list \
  --identity-name <velero-uami-name> \
  --resource-group <velero-uami-resource-group> --output table

az identity federated-credential list \
  --identity-name <opensearch-uami-name> \
  --resource-group <opensearch-uami-resource-group> --output table

   export PPC_DEPLOY_DIR=<path to PPC deployment directory>
   cd "$PPC_DEPLOY_DIR/iac/azure/cluster/modules/03_node_pool/"

    # -------------------------------------------------
    # Common (backend + provider — same value in all stages)
    # -------------------------------------------------
    resource_group_name    = "<resource-group-name>" # e.g. "aks-rg-prod"
    aks_cluster_name       = "<cluster-name>" # e.g. "prod-aks-cluster"
    azure_subscription_id  = "<subscription-id>" # e.g. "1e9ef7b6-cdc4-4a6b-98f7-a408ac1e19e0"
    storage_account_name   = "<storage-account-name>" # e.g. "myclusterstateaccount"
    storage_container_name = "velero"

    # -------------------------------------------------
    # Node pool
    # -------------------------------------------------
    subnet_id              = "</subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/<subnet-name>>"      # same subnet as AKS nodes (Stage 02)
    architecture           = "amd64" # amd64 or arm64
    vm_size                = ""      # leave empty for architecture default
    node_pool_disk_size_gb = 120
    node_pool_desired_size = 3
    node_pool_zones        = ["1", "2", "3"]
    fips_enabled           = true # set false for a non-FIPS node OS image (immutable)

    tofu init
    tofu plan          # review the proposed changes before applying
    tofu apply         # when prompted with "Enter a value:", type "yes"

# Confirm the user node pool exists and is Succeeded
az aks nodepool show --cluster-name <cluster-name> \
  --resource-group <resource-group> --name userpool \
  --query "{Name:name, State:provisioningState, Count:count, VmSize:vmSize, OsSku:osSku}" \
  --output table

Name      State      Count    VmSize      OsSku
--------  ---------  -------  ----------  ----------
userpool  Succeeded  <count>  <vm-size>   AzureLinux

# Verify all nodes are Ready (system + user nodes)
kubectl get nodes -o wide

# Confirm user pool nodes have the expected label
kubectl get nodes -l agentpool=userpool

   export PPC_DEPLOY_DIR=<path to PPC deployment directory>
   cd "$PPC_DEPLOY_DIR/iac/azure/cluster/modules/04_aks_addons/"

    # -------------------------------------------------
    # Common (backend + provider — same value in all stages)
    # -------------------------------------------------
    resource_group_name    = "<resource-group-name>" # e.g. "aks-rg-prod"
    aks_cluster_name       = "<cluster-name>" # e.g. "prod-aks-cluster"
    azure_subscription_id  = "<subscription-id>" # e.g. "1e9ef7b6-cdc4-4a6b-98f7-a408ac1e19e0"
    storage_account_name   = "<storage-account-name>" # e.g. "myclusterstateaccount"
    storage_container_name = "velero"

    # -------------------------------------------------
    # Storage classes (must match Stage 05's terraform.tfvars)
    # -------------------------------------------------
    storage_class_name        = "<storage-class-name>"
    backup_storage_class_name = "<backup-storage-class-name>"

    tofu init
    tofu plan          # review the proposed changes before applying
    tofu apply         # when prompted with "Enter a value:", type "yes"

# List storage classes and confirm ebs-sc is the default
kubectl get storageclass

# Verify ebs-sc details
kubectl describe storageclass ebs-sc

# Confirm the built-in 'default' storage class is no longer the default
kubectl get storageclass default -o jsonpath='{.metadata.annotations.storageclass\.kubernetes\.io/is-default-class}'
# expected output: empty or "false"

storage_class_names = {
  "backup" = "ebs-bkp"
  "default" = "ebs-sc"
}

   export PPC_DEPLOY_DIR=<path to PPC deployment directory>
   cd "$PPC_DEPLOY_DIR/iac/azure/cluster/modules/05_helm_releases/"

# Get the Velero Client ID
az identity show \
  --name <velero-managed-identity-name> \
  --resource-group <resource-group-name> \
  --query clientId \
  -o tsv

# Get the OpenSearch Client ID
az identity show \
  --name <opensearch-managed-identity-name> \
  --resource-group <resource-group-name> \
  --query clientId \
  -o tsv

    # -------------------------------------------------
    # Common (backend + provider — same value in all stages)
    # -------------------------------------------------
    resource_group_name    = "<resource-group-name>" # e.g. "aks-rg-prod"
    aks_cluster_name       = "<cluster-name>" # e.g. "prod-aks-cluster"
    azure_subscription_id  = "<subscription-id>" # e.g. "1e9ef7b6-cdc4-4a6b-98f7-a408ac1e19e0"
    storage_account_name   = "<storage-account-name>" # e.g. "myclusterstateaccount"
    storage_container_name = "velero"
    check_prev_stage       = true # set false to skip verifying Stage 04 was applied before Stage 05
    
    # -------------------------------------------------
    # Storage classes (must match Stage 04's terraform.tfvars)
    # -------------------------------------------------
    storage_class_name        = "<storage-class-name>"
    backup_storage_class_name = "<backup-storage-class-name>"
    
    # -------------------------------------------------
    # Networking
    # -------------------------------------------------
    subnet_id    = "</subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>/subnets/<subnet-name>>" # same subnet as Stages 02/03 (for VNet address space lookup)
    pod_cidr     = ""  # optional override; empty = auto-detected from the live AKS network profile
    architecture = "amd64" # amd64 or arm64
    node_os      = "AzureLinux_FIPS" # should mirror stage-03 user node pool os_sku + fips_enabled
    node_pool_name = "<node-pool-name>" # must match node_pool_name in Stage 03's terraform.tfvars

    # -------------------------------------------------
    # Registry
    # -------------------------------------------------
    global_image_reg = "<Container_Registry_Path>"
    harbor_secret    = "harbor-secret"
    ingress_fqdn     = "<FQDN>" # e.g. "apps.example.com"

    # -------------------------------------------------
    # Ownership / tagging
    # -------------------------------------------------
    owner_email = "<name@domain.tld>" # optional; blank = auto-detect from the Azure CLI identity

    # -------------------------------------------------
    # CLI users (enrolled via bootstrap.sh access add-cli-user)
    # -------------------------------------------------
    cli_user_public_keys = {} # e.g. { "jane.doe" = "ssh-rsa AAAA... jane.doe@host" } — on FIPS clusters only RSA (>=2048 bits) and ECDSA keys are accepted, not Ed25519/DSA

    # cli_user_public_keys is an optional map of additional CLI users
    # who should be granted SSH access to the cluster. Add entries
    # as username-to-public-key pairs, for example: {"jane.doe" = "ssh-rsa AAAA... jane.doe@host"}

    # This is used to enroll additional users through bootstrap.sh access add-cli-user.
    # On FIPS-enabled clusters, only RSA keys with a minimum length of 2048 bits
    # and ECDSA keys are accepted. Ed25519 and DSA keys are not supported.


    # -------------------------------------------------
    # Restore / backup
    # -------------------------------------------------
    restore             = false                               # set to true to restore from a previous backup
    backup_name         = "authnz-postgresql-schedule-backup" # Velero backup name used when restore = true
    insight_backup_name = ""                                  # Insight Velero backup name (K8s resources only); leave empty to auto-resolve latest

    # -------------------------------------------------
    # Workload Identity
    # -------------------------------------------------
    velero_uami_client_id     = "<velero_uami_client_id>" # client ID of the Velero UAMI 
    opensearch_uami_client_id = "<opensearch_uami_client_id>" # client ID of the OpenSearch UAMI    

export TF_VAR_username="<registry-username>"
export TF_VAR_password="<registry-password>"

    tofu init
    tofu plan          # review the proposed changes before applying
    tofu apply         # when prompted with "Enter a value:", type "yes"

# Confirm all Helm releases are deployed
helm list -A

# Verify Velero is running
kubectl get pods -n pty-backup-recovery

# Verify NFA platform pods
kubectl get pods -A

# Verify Insight pods
kubectl get pods -n pty-insight

# Verify Envoy Gateway
kubectl get pods -n api-gateway

# Verify VolumeSnapshotClass exists
kubectl get volumesnapshotclass

# Check all pods across the cluster are healthy
kubectl get pods -A --field-selector=status.phase!=Running,status.phase!=Succeeded

# Confirm the ingress gateway has an IP
kubectl get gateway -A

nfa_release_status = "deployed"
user_svc_private_key = <sensitive>
velero_release_status = "deployed"

kubectl get nodes
kubectl get pods -A

cd iac/azure/cluster/modules/02_aks_cluster/

fips_enabled                  = false

cd iac/azure/cluster/modules/03_node_pool/

fips_enabled                  = false