FE - Integrate a new domain

This document describes the necessary steps to integrate a new Flexible Engine domain with PF products (NGOT, caascad). Once this operation is done, concourse CI on infra zones will be able to manage resources in the new domain. The whole operation consists in some manual opertions on FE console, secrets generation and storing them on Vault instances.

Concourse is used with trackbone and envs-ng repo to interact with all of our domains. Some terraform and helm config use secrets stored on Vault on predictable path. The current procedure aim is to write those specific secrets.

Populate several environment variables:

DOMAIN_ID="<OCBXXXX>" # for example: OCB0005119
REGION="<region>"     # for example: eu-west-0
export DOMAIN_ID REGION

User support.caascad and cce trust

The user support.caascad must be added to the new domain by the domain owner. It must be granted full permissions. The domain owner must give us the username/password of the account.

When we get those credentials, connect to the console on the ${REGION} project, go to the CCE page, and enable CCE usage. This action will create a CCE agency. That agency is used by the CCE api to allow impersonation and allow their internal accounts to build on our project.

When it's done go to IAM page, then agencies, retrieve the "cce_admin_trust" agency id.

Also go the support.caascad account section to generate AKSK for this user. AKSK are used specifically for FE storage object api, It does not handle username/password authentication.

Export data:

AGENCY_ID="<xxxxxxxx>" # for example: 58d5ce0c-76b1-470a-a877-2f0cf9aeb6f7
USERNAME="<xxx>"       # for example: support.caascad
PASSWORD="<xxx>"       # for example: hOIOjjld687kk%jm+$yrdhUI
ACCESS_KEY="<xxx>"    
SECRET_KEY="<xxx>"
export AGENCY_ID USERNAME PASSWORD ACCESS_KEY SECRET_KEY

Now we can add necessary credentials to Vault Corp.

export VAULT_ADDR=https://vault.corp.caascad.com
vault token lookup || vault login -method oidc

cat <EOF>> /tmp/support.caascad.credentials.secret
{
  "auth_url": "https://iam.${REGION}.prod-cloud-ocb.orange-business.com/v3",
  "cce_agency_id": "${AGENCY_ID}",
  "domain": "prod-cloud-ocb.orange-business.com",
  "domain_name": "${DOMAIN_ID}",
  "password": "${PASSWORD}",
  "region": "${REGION}",
  "tenant_name": "${REGION}",
  "username": "${USERNAME}"
}
EOF

vault write secret/zones/fe/api-${DOMAIN_ID} @/tmp/support.caascad.credentials.secret
rm /tmp/support.caascad.credentials.secret

The fe_bootstrap_project is in charge to copy the previous secret to the infra_zone related to the zone where you will apply this configuration. Thus you do not need to copy manually that secret to infra_zone VAULT.

Otherwise there is no industrialisation for AKSK secret. You need to copy manually the AKSK secret on infra zones that need to work on the domain.

INFRA_ZONE="<xxx>" # for example: infra-stg
export VAULT_ADDR=https://vault.${INFRA_ZONE}.caascad.com
cat <EOF>> /tmp/support.caascad.aksk.secret
{
    "access_key": "XXXXXXX",
    "secret_key": "YYYYYY"
}
vault write secret/zones/fe/api-${DOMAIN_ID}-aksk @/tmp/support.caascad.aksk.secret
rm /tmp/support.caascad.aksk.secret

Edit quota

Now open a ticket to FE support to ask for quota edition. For example this is what has been asked for NGOT domain:

Elastic Volume Service/Disk unlimited
Elastic Volume Service/Disk capacity (GB) unlimited
Cloud Container Engine/Cluster 50
Elastic Cloud Server/Memory (GB) 64000
Cloud Eye/Alarm rule 1000
Identity and Access Management/User 300
Identity and Access Management/User group  150
Identity and Access Management/Identity provider 10
Identity and Access Management/Agency  10
Identity and Access Management/Project 20
Elastic Load Balance/Load balancer 10
Elastic Load Balance/Listener 10
Virtual Private Cloud/EIP 40