Skip to content

Prerequisites

The bootstrap creates the backend, identities, environments, repository, and runner for you. This page lists only what must exist before it runs, and what the operator running it needs. What the bootstrap creates is on the bootstrap reference page.

Azure

  • A tenant for the customer, with the management group root available to build the Cloud Adoption Framework hierarchy under.
  • Subscriptions. At a minimum a management subscription for platform resources and state. The reference adds a connectivity subscription for the hub network and one or more workload subscriptions for landing zones.
  • Operator rights. The person running the bootstrap signs in with az login and needs to create resource groups in the management subscription, assign roles at the management group scope, and assign a role on the bootstrap's own state account.

GitHub

  • An organisation to hold the landing-zone repository and the engine (nrit-tf-pr-ops).
  • Organisation Actions access so the customer repo may call the engine's reusable workflows: set nrit-tf-pr-ops to organisation-accessible.
  • A GitHub App that can check out the private engine repository. The bootstrap consumes its client id and private key; it does not create the App. See the engine GitHub App.
  • A personal access token for the operator, with repo and admin:org scope, so the bootstrap can create and configure the customer repository. The self-hosted posture needs a second token to register runners; see Bootstrap a customer.
  • The template repository nrit-alz-customer-template, from which the customer repository is generated.

Toolchain

The operator workstation needs Terraform and the Azure CLI to run the bootstrap.

Inside the customer repository, versions are pinned with mise: the reference pins Terraform and Terragrunt in mise.toml, and the engine uses those versions. When no version manager is present, the workflow falls back to built-in versions, but pinning in the repo is the supported path.

Next: Bootstrap a customer.