---
# System prepended metadata

title: Untitled

---

### TODO

- [x] Broken foreach loop
    - [x] Deploy fix
- [x] Machine key not working
    - [x] Fix path location
    - [x] Taint null resource
    - [x] Recreate VMs
- [x] Deployment Failures
    - [x] APP couldn't download 
- [x] Validate website and app pool created OK on VMs
    - [x] Check the what DB we are pointing at
- [x] SQL User groups
- [x] SQL Admin user AD stuff
- [x] 8001 node binding logic
    - [x] Investigate
- [x] Add a default Admin AD group to the MI when it is created
    - [x] CAF Admins
- [x] SQL Search Button doesn't work
    - [ ] Infra has a PBI for this 
- [x] Policy for enforcing tags
    - [ ] Jamie taking a gander
- [x] Destroy and recreate VMs for new MK
- [x] Add Machine Key check to setup script
- [x] Setup InfraTest subscription
- [ ] ADHoc Script User
- [x] Remove UKS in KV name
- [x] Remove AppGateway logging
- [ ] Merge shiptotelus to main for packer
    - [x] Weekly packer image build
    - [ ] Strip out Gen1 packer code
    - [ ] Remove DC stuff
- [x] Deploy latest to 8001 - 8006
- [x] Set storage and kv service endpoints on Web and App subnets
    
### MOTODO
- [ ] provide way to create sql logins when deploying SQL mi
- [ ] fix database connection settings for Azure SQL mi in deployment engine.
	- [ ] fix dacpac deployments
	- [ ] fix sql script deployments
	- [ ] fix issue with job checking on mi
- [ ] provide easy way to switch between two database servers. or at least let people know its an issue.
- [ ] script creation of cloudflare rules
- [ ] script creating of dpu so it matches current dpu80 setup in App gateway
- [x] Sort out terraform state storage account name for other subscriptions.
    - [x] https://mbstfs2013.muddyboots.com:4443/Muddyboots%20Software%20Limited/MBS/_git/MBS-ADO-Templates/pullrequest/16475

### Questions

- What logging should the AppGateway have and how long for?
    - Access logs?
- Node bindings, are they still a thing?
    - The appgateway at the moment doesn't support routing to a single node
    - [Link to relevant code](https://mbstfs2013.muddyboots.com:4443/Muddyboots%20Software%20Limited/MBS/_git/DevOps?path=%2FDeploymentScripts%2FDevV2%2FDEV_DeploymentLibrary.psm1&version=GBmaster&line=4623&lineEnd=4624&lineStartColumn=1&lineEndColumn=1&lineStyle=plain&_a=contents)
- Should all Devs have contributor access to QM DEV?
    - We've currently added GG_Developement to QM DEV
    - Is lighthouse + AAD a good idea?
        - Managing access from two different places

### Actionable stuff

- [ ] Migrate Agents VMSS to TAG
- [ ] Tidy up
    - [ ] Delete Hackday TF repo
    - [ ] Tidy repos in general
    - [ ] Clean crap out of QM-DEV Resource Group
- [ ] Make shared deployment to make as beautiful dpu deployment
    - [ ] Setup Infratest subscription
- [ ] cert_keyvault_secret url must contain word `secrets` in shared
- [ ] ensure that deployment is given read over devops tooling sub
- [ ] Auto adding to PRTG 
- [ ] Restores 


### Actionable stuff
- [ ] SP expiry tracking
- [ ] Get the SQL MI AAD account directory.read without giving away everything
- [ ] Rewrite SQL deployment
    - [ ] Allow TAG AD groups to be added to via the deployment library for DacPac deployments/restores
- [ ] Hashicorp Vault
- [ ] Reduce complexity of Terraform Plan/Apply template
    - Terragrunt?!



### Bring dev into line with test

- [ ] Duplicate Infra Terraform to create a new RG, Vnet and subnets
    - [ ] move to d-qm-infrastructure-uks-rg
    - [ ] Old stuff needs to exist still
    - [ ] going to be a new range
- [ ] Download a copy of the shared infra tfstate and delete from state
    - [ ] Creating a copy basically in the new d-qm-infrastructure-uks-rg.
    - [ ] APG, PIP canne be moved
- [ ] Create d-80-qm-rg manually
- [ ] Move VMs, disks, KV, Availability Set etc. manually into the new RG
    - [ ] Be careful of KV permissions, they get wiped (haven't check SA)
    - [ ] Basically move everything apart from the the MI and DBs
    - [ ] We want to avoid the VMs/disk being deleted as that will mean that everything has to be redeployed
    - [ ] Check NICs still assoicated with APG
- [ ] Update the DPU TFstate to point everything at the new RG name
- [ ] OUTAGE - Turn off VMs and make networking changes
    - [ ] DNS change to new PIP
    - [ ] Cloudflare LB change to new PIP
    - [ ] Disassociate NICs from APG
    - [ ] Give the TF a run check and it works
- [ ] Workout what to do with the SQL MI
    - [ ] Cannot be migrated