Adding

2026-03-13 12:58:13 -05:00
parent 4e6099ff5c
commit 64856c640e
203 changed files with 106084 additions and 0 deletions
@@ -0,0 +1,6 @@
+# local terraform files
+.terraform
+.terraform.lock.hcl
+*.deleteme.tf
+# Visual Studio 2015/2017 cache/options directory
+.vs/
@@ -0,0 +1,55 @@
+# This import was successfully run on 4/17/25
+# Commenting it out so that the scheduled pipelines can run
+
+#import {
+#  to = azuredevops_git_repository.repositories["LCU.API.Internal.MaidBotApi"]
+#  id = "2aeafa30-011a-4751-8b26-ebf29243ae67/LCU.API.Internal.MaidBotApi"
+#}
+#import {
+#  to = azuredevops_git_repository.repositories["LCU.API.Internal.Notifications"]
+#  id = "2aeafa30-011a-4751-8b26-ebf29243ae67/LCU.API.Internal.Notifications"
+#}
+#import {
+#   to = azuredevops_build_definition.pipelines["LCU.API.Internal.AlkamiApiWrapper-qa"]
+#   id = "2aeafa30-011a-4751-8b26-ebf29243ae67/884"
+#}
+#import {
+#   to = azuredevops_build_definition.pipelines["LCU.API.Internal.AlkamiApiWrapper-feature-branches"]
+#   id = "2aeafa30-011a-4751-8b26-ebf29243ae67/884"
+#}
+#import {
+#   to = azuredevops_build_definition.pipelines["LCU.API.Internal.AlkamiApiWrapper-uat"]
+#   id = "2aeafa30-011a-4751-8b26-ebf29243ae67/884"
+#}
+#import {
+#   to = azuredevops_build_definition.pipelines["LCU.API.Internal.AlkamiApiWrapper-prd"]
+#   id = "2aeafa30-011a-4751-8b26-ebf29243ae67/884"
+#}
+# import {
+#   to = azuredevops_build_definition.pipelines["LCU.API.Internal.Dispatcher-qa"]
+#   id = "2aeafa30-011a-4751-8b26-ebf29243ae67/887"
+# }
+# import {
+#   to = azuredevops_git_repository.repositories["LCU.API.Internal.Dispatcher"]
+#   id = "2aeafa30-011a-4751-8b26-ebf29243ae67/LCU.API.Internal.Dispatcher"
+# }
+# import {
+#   to = azuredevops_git_repository.repositories["LCU.API.Internal.RepoApi"]
+#   id = "2aeafa30-011a-4751-8b26-ebf29243ae67/LCU.API.Internal.RepoApi"
+# }
+#  import {
+#    to = azuredevops_build_definition.pipelines["LCU.WebApps.Internal.TemenosDictionaryManager-feature-branches"]
+#    id = "2aeafa30-011a-4751-8b26-ebf29243ae67/872"
+#  }
+#  import {
+#    to = azuredevops_build_definition.pipelines["LCU.WebApps.Internal.TemenosDictionaryManager-qa"]
+#    id = "2aeafa30-011a-4751-8b26-ebf29243ae67/873"
+#  }
+#  import {
+#    to = azuredevops_build_definition.pipelines["LCU.WebApps.Internal.TemenosDictionaryManager-uat"]
+#    id = "2aeafa30-011a-4751-8b26-ebf29243ae67/874"
+#  }
+#  import {
+#    to = azuredevops_build_definition.pipelines["LCU.WebApps.Internal.TemenosDictionaryManager-prd"]
+#    id = "2aeafa30-011a-4751-8b26-ebf29243ae67/875"
+#  }
@@ -0,0 +1,42 @@
+# Introduction 
+Maintaining azure pipelines and their service connections for AKS workloads
+
+# Build and Test
+All testing is done via our pipelines out in Azure.
+
+Generally, changes will be checked into our config-files/azdo-lcu-pipelines-<name_of_project>.yml
+
+Run it against the pipeline out in Azure against the relevant project name and see the changes coming out.
+
+
+# Import Statements process and Example
+- Create an "import.tf" file.
+- Below is an example of import statements. Add them to the "import.tf" file, edited to match your repository and pipeleine ids.
+    - Pipeleine Id's can be found in the url when you visit the pipeline in ADO
+        - ie. https://landmarkcu.visualstudio.com/Platform/_build?definitionId=863
+    - the "id" variable below "2aeafa30-011a-4751-8b26-ebf29243ae67" is specific to the Platform project. This value will be different if the project you are importing is not in Platform.
+***
+import {
+  to = azuredevops_git_repository.repositories["LCU.API.Internal.TemenosDictionary"]
+  id = "2aeafa30-011a-4751-8b26-ebf29243ae67/LCU.API.Internal.TemenosDictionary"
+}
+ import {
+   to = azuredevops_build_definition.pipelines["LCU.API.Internal.TemenosDictionary-feature-branches"]
+   id = "2aeafa30-011a-4751-8b26-ebf29243ae67/862"
+ }
+ import {
+   to = azuredevops_build_definition.pipelines["LCU.API.Internal.TemenosDictionary-qa"]
+   id = "2aeafa30-011a-4751-8b26-ebf29243ae67/863"
+ }
+ import {
+   to = azuredevops_build_definition.pipelines["LCU.API.Internal.TemenosDictionary-uat"]
+   id = "2aeafa30-011a-4751-8b26-ebf29243ae67/864"
+ }
+ import {
+   to = azuredevops_build_definition.pipelines["LCU.API.Internal.TemenosDictionary-prd"]
+   id = "2aeafa30-011a-4751-8b26-ebf29243ae67/865"
+ }
+ ***
+ - Complete a PR into Main and run the pipeline using 'Apply' as the Terraform option
+ - Once PR is complete, complete a second PR that is the removal of "import.tf" file.
+ - You do not need to run the piepline again with the "import.tf" file removed.
@@ -0,0 +1,16 @@
+trigger:
+  - none
+
+schedules:
+  - cron: '30 15 * * WED'
+    displayName: Weekly Wednesday Build
+    always: true
+    branches:
+      include:
+      - main
+
+extends:
+  template: azure-tf-pipeline.yaml
+  parameters:
+    tf_operation: apply
+    target_azdo_project: lcu/pipelines/dealer_reserve
@@ -0,0 +1,16 @@
+trigger:
+  - none
+
+schedules:
+  - cron: '30 15 * * WED'
+    displayName: Weekly Wednesday Build
+    always: true
+    branches:
+      include:
+      - main
+
+extends:
+  template: azure-tf-pipeline.yaml
+  parameters:
+    tf_operation: apply
+    target_azdo_project: lcu/pipelines/incentive_log
@@ -0,0 +1,16 @@
+trigger:
+  - none
+
+schedules:
+  - cron: '30 15 * * WED'
+    displayName: Weekly Wednesday Build
+    always: true
+    branches:
+      include:
+      - main
+
+extends:
+  template: azure-tf-pipeline.yaml
+  parameters:
+    tf_operation: apply
+    target_azdo_project: lcu/pipelines/letters_and_notices_integration
@@ -0,0 +1,16 @@
+trigger:
+  - none
+
+schedules:
+  - cron: '30 15 * * WED'
+    displayName: Weekly Wednesday Build
+    always: true
+    branches:
+      include:
+      - main
+
+extends:
+  template: azure-tf-pipeline.yaml
+  parameters:
+    tf_operation: apply
+    target_azdo_project: lcu/pipelines/lmcu
@@ -0,0 +1,16 @@
+trigger:
+  - none
+
+schedules:
+  - cron: '30 15 * * WED'
+    displayName: Weekly Wednesday Build
+    always: true
+    branches:
+      include:
+      - main
+
+extends:
+  template: azure-tf-pipeline.yaml
+  parameters:
+    tf_operation: apply
+    target_azdo_project: lcu/pipelines/platform
@@ -0,0 +1,16 @@
+trigger:
+  - none
+
+schedules:
+  - cron: '30 15 * * WED'
+    displayName: Weekly Wednesday Build
+    always: true
+    branches:
+      include:
+      - main
+
+extends:
+  template: azure-tf-pipeline.yaml
+  parameters:
+    tf_operation: apply
+    target_azdo_project: lcu/pipelines/repo
@@ -0,0 +1,16 @@
+trigger:
+  - none
+
+schedules:
+  - cron: '30 15 * * WED'
+    displayName: Weekly Wednesday Build
+    always: true
+    branches:
+      include:
+      - main
+
+extends:
+  template: azure-tf-pipeline.yaml
+  parameters:
+    tf_operation: apply
+    target_azdo_project: lcu/pipelines/unified_opt_in
@@ -0,0 +1,55 @@
+trigger:
+- none
+
+parameters:
+- name: tf_operation
+  displayName: Terraform operation to perform
+  type: string
+  values:
+  - plan
+  - apply
+  - destroy
+  default: plan
+
+- name: tf_additional_command_options
+  displayName: Options to pass to the Terraform Operation
+  type: string
+  default: ' '
+
+- name: target_azdo_project
+  displayName: Target AZDO Project (Business Unit / AZDO Functionality / Azdo Project)
+  type: string
+  values:
+  - lcu/pipelines/platform
+  - lcu/pipelines/letters_and_notices_integration
+  - lcu/pipelines/repo
+  - lcu/pipelines/unified_opt_in
+  - lcu/pipelines/incentive_log
+  - lcu/pipelines/lmcu
+  - lcu/pipelines/dealer_reserve
+  default: lcu/pipelines/platform
+
+variables:
+- template: ./azure-tf-pvars.yaml
+
+resources:
+  repositories:
+  - repository: azdo_pipeline_templates
+    type: git
+    name: Infrastructure Platform/azdo-pipeline-templates
+    ref: main
+  - repository: shared_terraform_configurations
+    type: git
+    name: Infrastructure Platform/shared-terraform-configurations
+    ref: main
+  - repository: shared_platform_terraform_modules
+    type: git
+    name: Infrastructure Platform/shared-platform-terraform-modules
+    ref: main
+
+stages:
+- template: terraform-base.yaml@azdo_pipeline_templates
+  parameters:
+    tf_operation: ${{ parameters.tf_operation }}
+    tf_additional_command_options: ${{ parameters.tf_additional_command_options }}
+    tf_workspace: azdo-${{ replace(parameters.target_azdo_project, '/', '-') }}
@@ -0,0 +1,15 @@
+variables:
+  # AZDO
+  pvar_azdo_agent_pool_name: vmss-sub-df-lcu-apps-qa-lz-uscz
+  pvar_azdo_service_connection_name: sub-df-lcu-apps-qa-contributor-svcon
+
+  # TERRAFORM
+  pvar_tf_version: 1.9.8
+  pvar_tf_backend_azdo_service_connection_name: sub-df-lcu-apps-qa-contributor-svcon
+  pvar_tf_backend_resource_group: rg-sub-df-lcu-apps-qa-apps-uscz
+  pvar_tf_backend_storage_account: sasubdflcuappsqaappsuscz
+  pvar_tf_backend_storage_container: tfstate
+  pvar_tf_backend_rm_key: $(Build.Repository.Name).tfstate
+
+  # TERRAFORM APPLY/DESTORY APPROVERS
+  pvar_tf_approval_emails: ''
@@ -0,0 +1,72 @@
+---
+trigger:
+- none
+
+parameters:
+- name: target_azdo_project
+  displayName: Target AZDO Project (Business Unit / AZDO Functionality / Azdo Project)
+  type: string
+  values:
+  - lcu/pipelines/platform
+  - lcu/pipelines/letters_and_notices_integration
+  - lcu/pipelines/repo
+  - lcu/pipelines/unified_opt_in
+  - lcu/pipelines/incentive_log
+  default: lcu/pipelines/platform
+
+- name: tf_operation
+  displayName: Terraform operation to perform
+  type: string
+  default: state list
+  values:
+  - state list
+  - state import
+  - state rm
+
+- name: tf_additional_command_options
+  displayName: Options to pass to the Terraform Operation
+  type: string
+  default: ' '
+
+- name: resource_address
+  displayName: (Optional) the Terraform resource name we are importing to state (state import, state mv, state rm)
+  type: string
+  default: ' '
+
+- name: resource_destination_address
+  displayName: (Optional) Resource Destination Address (state mv)
+  type: string
+  default: ' '
+
+- name: resource_id
+  displayName: (Optional) the Azure resource ID to import to (state import)
+  type: string
+  default: ' '
+
+variables:
+- template: ./azure-tf-pvars.yaml
+
+resources:
+  repositories:
+  - repository: azdo_pipeline_templates
+    type: git
+    name: Infrastructure Platform/azdo-pipeline-templates
+    ref: main
+  - repository: shared_terraform_configurations
+    type: git
+    name: Infrastructure Platform/shared-terraform-configurations
+    ref: main
+  - repository: shared_platform_terraform_modules
+    type: git
+    name: Infrastructure Platform/shared-platform-terraform-modules
+    ref: main
+
+stages:
+- template: terraform-utility.yaml@azdo_pipeline_templates
+  parameters:
+    tf_operation: ${{ parameters.tf_operation }}
+    tf_additional_command_options: ${{ parameters.tf_additional_command_options }}
+    resource_address: ${{ parameters.resource_address }}
+    resource_destination_address: ${{ parameters.resource_destination_address }}
+    resource_id: ${{ parameters.resource_id }}
+    tf_workspace: azdo-${{ replace(parameters.target_azdo_project, '/', '-') }}
@@ -0,0 +1,21 @@
+---
+# AZDO
+azdo_project_name: Dealer Reserve
+
+aks_workloads: 
+  - path: \AKS\reserve-management-system-api
+    repo: LCU.WebApps.Indirect.ReserveManagementSystem
+    pipeline_path_prefix: "Api/"
+    environment: DB
+    
+environments:
+  - DB
+
+db_approval_env_suffixes:
+  - prd
+  
+pipeline_definitions:
+  - feature-branches
+  - qa
+  - uat
+  - prd
@@ -0,0 +1,22 @@
+---
+# AZDO
+azdo_project_name: Incentive Log
+
+aks_workloads: 
+  - path: \AKS\incentive-manager
+    repo: LCU.WebApps.Operations.IncentiveManager
+  - path: \AKS\incentive-manager-api
+    repo: LCU.API.Operations.IncentiveAPI
+    environment: DB
+
+environments:
+  - DB
+
+db_approval_env_suffixes:
+  - prd
+  
+pipeline_definitions:
+  - feature-branches
+  - qa
+  - uat
+  - prd
@@ -0,0 +1,20 @@
+---
+# AZDO
+azdo_project_name: Letters and Notices Integration
+
+aks_workloads: 
+  - path: \AKS\notice-processor-api
+    repo: LCU.API.Internal.NoticeProcessor
+    environment: DB
+
+environments:
+  - DB
+
+db_approval_env_suffixes:
+  - prd
+
+pipeline_definitions:
+  - feature-branches
+  - qa
+  - uat
+  - prd
@@ -0,0 +1,19 @@
+---
+# AZDO
+azdo_project_name: LMCU
+
+aks_workloads: 
+  - path: \AKS\LCU.Applications.Internal.DnaLauncher
+    repo: LCU.Applications.Internal.DnaLauncher
+
+environments:
+  - DB
+
+db_approval_env_suffixes:
+  - prd
+  
+pipeline_definitions:
+  - feature-branches
+  - qa
+  - uat
+  - prd
@@ -0,0 +1,142 @@
+---
+# AZDO
+azdo_project_name: Platform
+
+aks_workloads: 
+  - path: \AKS\digital-foundations-aks-sample-apps
+    repo: digital-foundations-aks-sample-apps
+  - path: \AKS\prometheus-alerts-wrapper
+    repo: LCU.Api.Internal.PrometheusAlertsWrapper
+  - path: \AKS\alloy-api-wrapper
+    repo: LCU.API.Internal.AlloyApiWrapper
+  - path: \AKS\blend-api-wrapper
+    repo: LCU.API.Internal.BlendApiWrapper
+    environment: DB
+  - path: \AKS\core-api-wrapper
+    repo: LCU.Api.Internal.CoreApiWrapper
+  - path: \AKS\dealer-portal-api
+    repo: LCU.API.Internal.DealerPortal
+  - path: \AKS\dealer-portal-manager
+    repo: LCU.WebApps.External.DealerPortal
+  - path: \AKS\dialer-api
+    repo: LCU.API.Internal.DialerApi
+    environment: DB
+  - path: \AKS\fraud-api
+    repo: LCU.API.Internal.FraudApi
+  - path: \AKS\hot-list-api
+    repo: LCU.API.Internal.HotList
+    environment: DB
+  - path: \AKS\housing-counselor-api
+    repo: LCU.API.Internal.HousingCounselorApi
+  - path: \AKS\hud-api-wrapper
+    repo: LCU.API.Internal.HudApiWrapper
+  - path: \AKS\jd-power-api-wrapper
+    repo: LCU.API.Internal.JDPowerApiWrapper
+  - path: \AKS\loan-rate-api
+    repo: LCU.API.Internal.LoanRate
+    environment: DB
+  - path: \AKS\loan-to-insiders
+    repo: LCU.API.Internal.LoanToInsiders
+  - path: \AKS\location-api
+    repo: LCU.API.Internal.LocationApi
+  - path: \AKS\member-stip-portal-api
+    repo: LCU.API.Internal.MemberStipPortal
+  - path: \AKS\member-stip-portal
+    repo: LCU.WebApps.External.MemberStipPortal
+  - path: \AKS\networking-test
+    repo: LCU.Test.Internal.Networking
+  - path: \AKS\redirect-api
+    repo: LCU.API.External.Redirect
+  - path: \AKS\remote-deposit-capture
+    repo: LCU.API.Internal.RemoteDepositCapture
+    environment: DB
+  - path: \AKS\temenos-action-handler
+    repo: LCU.API.Internal.TemenosActionHandler
+  - path: \AKS\temenos-api-wrapper
+    repo: LCU.API.Internal.TemenosApiWrapper
+  - path: \AKS\vehicle-valuation-api
+    repo: LCU.API.Internal.VehicleValuation
+  - path: \AKS\archiver-api
+    repo: LCU.API.Internal.ArchiverApi
+    environment: DB
+  - path: \AKS\genesys-api-wrapper
+    repo: LCU.API.Internal.GenesysApiWrapper
+  - path: \AKS\data-clean-up-api
+    repo: LCU.Api.Internal.DataCleanUp
+  - path: \AKS\loan-payoff-api
+    repo: LCU.API.Internal.LoanPayoff
+  - path: \AKS\voapps-api-wrapper
+    repo: LCU.API.Internal.VoAppsApiWrapper
+  - path: \AKS\document-type-uploader
+    repo: LCU.API.Internal.DocumentTypeUploader
+  - path: \AKS\file-updater-api
+    repo: LCU.Api.Internal.FileUpdater
+    environment: DB
+  - path: \AKS\document-type-cleanup-api
+    repo: LCU.API.Internal.DocumentTypeCleanup
+  - path: \AKS\real-time-alerts
+    repo: LCU.Api.Internal.RealTimeAlerts
+    environment: DB
+  - path: \AKS\loan-rate-manager
+    repo: LCU.WebApps.Internal.LoanRateManager
+  - path: \AKS\temenos-notification-api
+    repo: LCU.Api.Internal.TemenosNotificationApi
+    environment: DB
+  - path: \AKS\document-type-retriever-api
+    repo: LCU.API.Internal.DocumentTypeRetriever
+  - path: \AKS\document-api
+    repo: LCU.API.Internal.Document
+  - path: \AKS\document-ingestor-api
+    repo: LCU.API.Internal.DocumentIngestor
+    environment: DB
+  - path: \AKS\vendor-api
+    repo: LCU.API.External.VendorAPI
+  - path: \AKS\temenos-dictionary-api
+    repo: LCU.API.Internal.TemenosDictionary
+    environment: DB
+  - path: \AKS\temenos-dictionary-manager
+    repo: LCU.WebApps.Internal.TemenosDictionaryManager
+  - path: \AKS\repo-api
+    repo: LCU.API.Internal.RepoApi
+    environment: DB
+  - path: \AKS\dispatcher-api
+    repo: LCU.API.Internal.Dispatcher
+    environment: DB
+  - path: \AKS\online-loan-app-api
+    repo: LCU.API.Internal.OnlineLoanApp
+  - path: \AKS\online-loan-app
+    repo: LCU.WebApps.External.OnlineLoanApp
+  - path: \AKS\dispatcher-manager
+    repo: LCU.WebApps.Internal.DispatcherManager
+  - path: \AKS\autoims-api-wrapper
+    repo: LCU.API.Internal.AutoImsApiWrapper
+  - path: \AKS\alkami-api-wrapper
+    repo: LCU.API.Internal.AlkamiApiWrapper
+  - path: \AKS\core-soap-api-wrapper-api
+    repo: LCU.API.Internal.CoreSoapApiWrapper
+  - path: \AKS\document-manager
+    repo: LCU.WebApps.Internal.DocumentManager
+  - path: \AKS\collections-api
+    repo: LCU.API.Internal.CollectionsApi
+  - path: \AKS\crif-api-wrapper
+    repo: LCU.API.Internal.CrifApiWrapper
+  - path: \AKS\spit
+    repo: LCU.WebApps.Marketing.SPIT
+  - path: \AKS\notifications-api
+    repo: LCU.API.Internal.Notifications
+    environment: DB
+  - path: \AKS\maidbot-api
+    repo: LCU.API.Internal.MaidBotApi
+    environment: DB
+
+environments:
+  - DB
+
+db_approval_env_suffixes:
+  - prd
+  
+pipeline_definitions:
+  - feature-branches
+  - qa
+  - uat
+  - prd
@@ -0,0 +1,20 @@
+---
+# AZDO
+azdo_project_name: Repo
+
+aks_workloads: 
+  - path: \AKS\digital-foundations-aks-sample-apps
+    repo: digital-foundations-aks-sample-apps
+    environment: DB
+
+environments:
+  - DB
+
+db_approval_env_suffixes:
+  - prd
+  
+pipeline_definitions:
+  - feature-branches
+  - qa
+  - uat
+  - prd
@@ -0,0 +1,24 @@
+---
+# AZDO
+azdo_project_name: Unified Opt-In
+
+aks_workloads: 
+  - path: \AKS\Member-Preferences-Api
+    repo: LCU.API.Internal.MemberPreferencesApi
+    environment: DB
+  - path: \AKS\member-preferences-wrapper-api
+    repo: LCU.API.Internal.MemberPreferencesWrapperApi
+  - path: \AKS\Unified-Opt-In-Client
+    repo: LCU.WebApps.Collections.UnifiedOptIn
+
+environments:
+  - DB
+
+db_approval_env_suffixes:
+  - prd
+  
+pipeline_definitions:
+  - feature-branches
+  - qa
+  - uat
+  - prd
@@ -0,0 +1,17 @@
+# AZDO
+data "azuredevops_project" "project" {
+  name = local.lz_config.azdo_project_name
+}
+
+data "http" "azdo_service_connections" {
+  for_each = local.aks_service_connections
+  url      = "https://dev.azure.com/landmarkcu/${local.lz_config.azdo_project_name}/_apis/serviceendpoint/endpoints?endpointNames=${each.value}"
+  method   = "GET"
+  request_headers = {
+    authorization = "basic ${base64encode(":${var.AZDO_PAT_TOKEN}")}"
+  }
+}
+
+data "azuredevops_group" "db_prd_approvers" {
+  name = "ADO - DB PRD Approvers"
+}
@@ -0,0 +1,14 @@
+resource "azuredevops_check_approval" "db_requires_approval" {
+  for_each = local.db_approval_env_names
+
+  project_id           = data.azuredevops_project.project.id
+  target_resource_id   = azuredevops_environment.this[each.value].id
+  target_resource_type = "environment"
+
+  approvers = [
+    data.azuredevops_group.db_prd_approvers.origin_id
+  ]
+
+  requester_can_approve      = true
+  minimum_required_approvers = 1
+}
@@ -0,0 +1,26 @@
+resource "azuredevops_git_repository" "repositories" {
+  for_each = {
+    for pipeline in local.lz_config.aks_workloads :
+    pipeline.repo => pipeline
+  }
+
+  project_id = data.azuredevops_project.project.id
+  name       = each.value.repo
+
+  initialization {
+    init_type = "Clean"
+  }
+
+  lifecycle {
+    # Repositories are critical, long-lived assets.
+    # Prevent accidental deletion caused by config changes,
+    # refactors, or terraform destroy.
+    prevent_destroy = true
+
+    # Ignore changes to initialization to support importing existing repositories.
+    # Once a repo exists, initialization settings are irrelevant.
+    ignore_changes = [
+      initialization,
+    ]
+  }
+}
@@ -0,0 +1,39 @@
+locals {
+  # CONFIGS
+  workspace        = (terraform.workspace == "default") ? "azdo-lcu-pipelines-platform" : terraform.workspace
+  lz_config        = yamldecode(file("./config-files/${local.workspace}.yaml"))
+  platform_configs = yamldecode(file("../shared-terraform-configurations/df-platform-configs.yaml"))
+
+  aks_service_connections = {
+    qa  = "svcon-sub-df-lcu-apps-qa-aks-k8s-uscz"
+    uat = "svcon-sub-df-lcu-apps-uat-aks-k8s-uscz"
+    prd = "svcon-sub-df-lcu-apps-prd-aks-k8s-uscz"
+  }
+
+  pipelines = {
+    for v in setproduct(local.lz_config.aks_workloads, local.lz_config.pipeline_definitions) :
+    "${v[0].repo}-${v[1]}" => {
+      pipeline_folder_path = v[0].path
+      repo                 = v[0].repo
+      pipeline_name        = "${v[0].repo}-${v[1]}"
+      suffix               = v[1]
+      pipeline_path_prefix = lookup(v[0], "pipeline_path_prefix", "")
+      aks_auth             = try(v[1] != "feature-branches") ? local.aks_service_connections["${v[1]}"] : null
+      environment_auth     = try(v[1] != "feature-branches" && lookup(v[0], "environment", null) != null) ? "${v[0].environment}-${v[1]}" : null
+    }
+  }
+
+  environments = compact(distinct(flatten([
+    for v in setproduct(local.lz_config.environments, local.lz_config.pipeline_definitions) :
+    ["${v[0]}-${v[1]}"]
+    if v[1] != "feature-branches"
+  ])))
+
+  # default to none if the key is missing
+  db_approval_env_suffixes = try(local.lz_config.db_approval_env_suffixes, [])
+
+  # build the actual environment names (DB-qa / DB-uat / DB-prd)
+  db_approval_env_names = toset([
+    for s in local.db_approval_env_suffixes : "DB-${s}"
+  ])
+}
@@ -0,0 +1,21 @@
+resource "azuredevops_pipeline_authorization" "service_connection_auth" {
+  for_each    = { for key, val in local.pipelines : key => val if val.suffix != "feature-branches" }
+  pipeline_id = azuredevops_build_definition.pipelines[each.value.pipeline_name].id
+  project_id  = data.azuredevops_project.project.id
+  resource_id = jsondecode(data.http.azdo_service_connections[each.value.suffix].response_body).value[0].id
+  type        = "endpoint"
+}
+
+resource "azuredevops_environment" "this" {
+  for_each   = toset(local.environments)
+  project_id = data.azuredevops_project.project.id
+  name       = each.value
+}
+
+resource "azuredevops_pipeline_authorization" "environments_auth" {
+  for_each    = { for key, val in local.pipelines : key => val if val.suffix != "feature-branches" && lookup(val, "environment_auth", null) != null }
+  pipeline_id = azuredevops_build_definition.pipelines[each.value.pipeline_name].id
+  project_id  = data.azuredevops_project.project.id
+  resource_id = azuredevops_environment.this["${each.value.environment_auth}"].id
+  type        = "environment"
+}
@@ -0,0 +1,17 @@
+resource "azuredevops_build_definition" "pipelines" {
+  for_each   = local.pipelines
+  project_id = data.azuredevops_project.project.id
+  name       = each.value.pipeline_name
+  path       = each.value.pipeline_folder_path
+
+  ci_trigger {
+    use_yaml = true
+  }
+
+  repository {
+    repo_type   = "TfsGit"
+    repo_id     = azuredevops_git_repository.repositories[each.value.repo].id
+    branch_name = azuredevops_git_repository.repositories[each.value.repo].default_branch
+    yml_path    = "${each.value.pipeline_path_prefix}azdo_pipelines/azure-pipelines-${each.value.suffix}.yaml"
+  }
+}
@@ -0,0 +1,46 @@
+terraform {
+  required_version = "~> 1.9.0"
+
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 3.70"
+    }
+
+    azuredevops = {
+      source  = "microsoft/azuredevops"
+      version = "~> 1.2.0"
+    }
+
+  }
+
+  backend "azurerm" {}
+}
+
+provider "azurerm" {
+  use_msi                    = true
+  skip_provider_registration = true
+
+  features {
+    key_vault {
+      purge_soft_deleted_certificates_on_destroy = false
+      purge_soft_deleted_keys_on_destroy         = false
+      purge_soft_deleted_secrets_on_destroy      = false
+    }
+  }
+}
+
+provider "azurerm" {
+  alias = "hub"
+
+  use_msi                    = true
+  skip_provider_registration = true
+  subscription_id            = local.platform_configs.bootstrap_values.hub_subscription_id
+
+  features {}
+}
+
+provider "azuredevops" {
+  org_service_url       = local.platform_configs.bootstrap_values.azdo_org_url
+  personal_access_token = var.AZDO_PAT_TOKEN
+}
@@ -0,0 +1,9 @@
+variable "TARGET_AZURE_LOCATION" {
+  description = "the Target Location in Azure to deploy AKS resources in"
+  type        = string
+}
+
+variable "AZDO_PAT_TOKEN" {
+  description = "the AZDO PAT used to create K8s Service Connections in the Team's Project"
+  type        = string
+}