Skip to content

Upgrade TRE - tvstre-prod-main-v0.27.X - Continued - #75

Closed
JaimieWi wants to merge 6 commits into
feature/upgrade-to-tvstre-prod-main-v0.27.0from
jcw/upgrade-to-tvstre-prod-main-v0.27.0
Closed

Upgrade TRE - tvstre-prod-main-v0.27.X - Continued#75
JaimieWi wants to merge 6 commits into
feature/upgrade-to-tvstre-prod-main-v0.27.0from
jcw/upgrade-to-tvstre-prod-main-v0.27.0

Conversation

@JaimieWi

Copy link
Copy Markdown
Contributor

TRE run id: tre58c5d4df

CONTINUED - see #74 for previous state

Summary

This PR upgrades the TRE to incorporate upstream changes from v0.27.0 (v0.26.0 skipped — see linked YouTrack ticket for rationale), along with CI/CD authentication changes required to support the new version.

Full breakdown of breaking changes, testing checklist, and decision log: https://oxbrcdw.myjetbrains.com/youtrack/issue/DEV-1968/Upgrade-TRE-to-tvstre-prod-main-v0.26.0-v0.27.0


Upstream Changes

v0.27.0

Breaking changes reviewed (full detail in linked ticket)

  • Azure ML workspace RBAC change — not applicable, not currently deployed
  • Airlock manager review fix — bug fix only, no action required
  • Cost label tooltip clarification — text only, no functional change
  • GitHub Actions authentication migrated to federated credentials — see CI/CD changes below

v0.26.0 (picked up as part of this upgrade)

  • NTP firewall rule removed from general rule collection — accepted, no action
  • Config schema validation change for developer settings — config.yaml updated

CI/CD Changes

  • GitHub Actions authentication migrated from stored credentials secret to federated credentials (Dev environment)
  • Workflow files synced with upstream to bring in changes required for federated credential support, which had not yet been carried into this deployment repo
  • Nightly scheduled run removed from deploy_tre.yml — not required for our deployment model

TVS SDE Custom Changes

  • Firewall Standard → Premium tier upgrade — separate TVS SDE accreditation/security decision. Work in Progress

Ongoing - Errors and Logs during upgrade

Error 1: Terraform init — Azure CLI auth incompatible with Service Principal

Error: "Authenticating using the Azure CLI is only supported as a User (not a Service Principal)"

Cause: register_tre_bundle.yml wasn't passing AZURE_CLIENT_ID/TENANT_ID/SUBSCRIPTION_ID through to the Deploy management step, so Terraform fell back to CLI auth.

Fix: Updated register_tre_bundle.yml to pass these through. Pending re-run confirmation.

Applied workflow changes required for federated credential support
that exist upstream but were not yet reflected in this deployment
repo (previously only carried forward as far as an earlier release).

- action.yml
- clean_validation_envs.yml
- deploy_tre_branch.yml
- deploy_tre_reusable.yml
- lets_encrypt.yml

Also removes the nightly scheduled run from deploy_tre.yml
(midnight cron trigger) as it is not required for our deployment
model, and updates the file's header comment to reflect this.

cli-package.yml and pr_comment_bot.yml intentionally not added -
not applicable to our setup (no AzureTRE CLI in use). Files that
exist only in the upstream AzureTRE repo (not AzureTRE-Deployment)
were out of scope for this change.
- pipelines stuck, force commit test
@JaimieWi JaimieWi closed this Aug 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant