In Azure, a Landing Zone is defined via a management group the subscription for the project will be assigned to. Policies can be applied to these management groups. Optionally a blueprint can also be defined. Via an Azure Blueprint default resources can be deployed to the subscription and additional specific policies can be defined. A blueprint can be configured to decline users to change or delete the resources and policies created by the blueprint.
The Landing Zone can be configured in the
Administration section. If a project is selected to have an Azure location a landingzone must be picked by the user. By choosing a landing zone platform specific configuration can be set (in this case for Azure). The options for Azure are:
All newly created meshProjects get their corresponding Subscription assigned to this Management Group. The Management Group can be configured by an platform operator throughout the Azure portal.
The name of the Blueprint which should get assigned to the project. You can leave it empty, then no Blueprint will get automatically assigned.
Blueprint Management Group
Blueprints must reside inside a Management Group. It is assumed it is in the same group as the group where to put the Subscriptions by default. If the Blueprint is located in another group it can be configuered here.
Operators must ensure to create these management groups in the meshcloud AAD Tenant before configuring them for use in a Landing Zone.
Max. Auto Upgrade Blueprint Version
Blueprints are versioned in Azure and can be managed via the Azure Portal. To avoid the accidental assignment of new (and possibly faulty) Blueprints there is this
Max. Auto Upgrade Blueprint Version field. If you enter a version identifier here which corresponds to a existing Blueprint version in the Azure portal:
- Existing projects with this Landing Zone will get their Blueprint updated to this version on the next replication
- Newly created projects will get the latest Blueprint version assigned (possibly higher then the version configured here)