Automated update of shared service properties - rule on the firewall, package on package mirror

[christoferlof]

A shared resources used by multiple services may need to be updated.

For example:

• Firewall rules on the firewall
• Mirrored packages on the package mirror
• Workspace app registration by workspace services

Requirements

For the firewall:
As a TRE service integrator
I want an uncomplicated way of enable egress traffic to a Workspace/Workspace Service
So that I can create a bundle that can access the required resources

As an Azure administrator
I want to know which changes to a shared service have been made by which resource
So that I can get an overview of what has made changes

As an Azure administrator
I want changes made to a shared service to be undone when the resource that requires them is uninstalled
So that I I only have the configuration I need

Implementation

High level flow

1. User submits a POST to create a new resource (eg a VM)
2. The resource bundle is applied and the VM created
3. Outputs from the process (eg an IP address) are collected
4. A message is returned to the API layer with details of which shared resource needs updating, and which values to update (eg a new rule on the shared firewall)
5. The API layer GETs the shared resource from the data store, merges the changes, and PATCHes it, polling the operation until the shared service is updated.
6. The original resource operation is completed.

Shared services to-dos

• Shared Service Templates in API #1238
• Shared Services in API #1239
• Update Resource Properties via API #1240
• Update Resource in Azure following API Update #1243
• Control resource processor parallelism and scaling #514
• Update a secondary resource from a primary #1244
• Use Sessions in Service Bus to enforce ordering #1245
• All operation updates should include the user who made the change #1413