feat(azure/postgresql): modernize module to pass scorecard#222
Conversation
Bring azure/postgresql up to current conventions (scorecard 53% → 100%), addressing the gaps surfaced on PR #221. - buildingblock: migrate from the retired Azure PostgreSQL Single Server (azurerm_postgresql_server) to Flexible Server (azurerm_postgresql_flexible_server); self-contained resource group and globally-unique server name with random suffix - backplane: replace the principal_ids role-assignment pattern with the UAMI + WIF convention (user-assigned managed identity, federated identity credential, identity output); role definition targets flexibleServers and keeps */register/action for fresh subscriptions - add meshstack_integration.tf wiring the BBD, backplane and OIDC auth - add e2e/ smoke test modeled on azure/storage-account - drop legacy bb_description.md (superseded by inline BBD readme) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Scorecard Check
📊 meshstack-hub Module Scorecard
📋 Per-Module Category SummaryScore per category per building block.
Core Structure — ✅ all passingBasic module file structure and documentation — applies to 1 modules
Core Structure — Summary
Integration — ✅ all passingmeshstack_integration.tf conventions — applies to 1 modules
Integration — Summary
Azure Backplane — ✅ all passingAzure UAMI-based automation principal conventions — applies to 1 modules
Azure Backplane — Summary
STACKIT Backplane — not applicableSTACKIT WIF-based automation principal conventions — applies to 0 modules No applicable modules. Testing — ✅ all passingEnd-to-end test coverage — applies to 1 modules
Testing — Summary
|
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
grubmeshi
left a comment
grubmeshi
left a comment
There was a problem hiding this comment.
Yes, let's have look together and we should test this, preferrably using a smoke test using our Azure dev infra.
| "Microsoft.DBforPostgreSQL/servers/firewallRules/write", | ||
| "Microsoft.DBforPostgreSQL/servers/databases/read", | ||
| "Microsoft.DBforPostgreSQL/servers/databases/write" | ||
| # resource provider registration — required on freshly created subscriptions |
There was a problem hiding this comment.
n: in particular this stuff here could be hallucinated or outdated.
| location = var.location | ||
| } | ||
|
|
||
| resource "azurerm_user_assigned_identity" "backplane" { |
There was a problem hiding this comment.
s:
| resource "azurerm_user_assigned_identity" "backplane" { | |
| resource "azurerm_user_assigned_identity" "this" { |
the module is already called backplane. I've always wanted to have a rule "single resource type in model must be named this. We should add this to the scorecard.
|
|
||
| | Responsibility | Platform Team | Application Team | | ||
| | ----------------------------------------------------- | :-----------: | :--------------: | | ||
| | Provision and configure the PostgreSQL server | ✅ | ❌ | |
There was a problem hiding this comment.
f: this whole section (and probably readme) does not make much sense anymore. Postgres Flex is indeed a (single) DB as a Service, you don't see the actual server anymore AFAIUIT.
2 participants
Bring azure/postgresql up to current conventions (scorecard 53% → 100%), addressing the gaps surfaced on PR #221.
This is the call this needs to be done to test it though:
EDIT: Warning, this is fully AI generated and needs a good checkup. I dont have much background knowledge for terraform. Maybe we can do a f2f review / testrun if this changes work.
The e2e test has not been run live — it needs the pushed ref + Azure fixtures through the smoke-test runner. Given the Single→Flexible Server change, a live run (task hub:e2e:run MODULE=azure/postgresql from meshstack-smoke-test) is the real proof before merge.