Skip to content

Prerequisites

The bootstrap creates the backend, identities, environments, repository, and runner for you. This page lists only what must exist before it runs, and what the operator running it needs. What the bootstrap creates is on the bootstrap reference page.

Azure

  • A tenant for the customer, with the management group root available to build the Cloud Adoption Framework hierarchy under.
  • Subscriptions. At a minimum a management subscription for platform resources and state. The reference adds a connectivity subscription for the hub network and one or more workload subscriptions for landing zones.
  • Operator rights. The person running the bootstrap signs in with az login and needs to create resource groups in the management subscription, assign roles at the management group scope, and assign a role on the bootstrap's own state account.

GitHub

  • An organization to hold the landing-zone repository. It can be any organization: the callers reference the public nrit-solutions/tf-pr-ops entrypoint, and the private engine core is reached through the engine App.
  • Two GitHub Apps. One checks out the private engine repository and downloads the prebuilt binary; the bootstrap consumes its client id and private key but does not create it. See the engine GitHub App. The second is the per-organization checks App that owns every engine check row, the merge gate included; it is required onboarding since engine v3 and the bootstrap neither creates nor wires it. See the checks App.
  • A personal access token for the operator, with repo and admin:org scope in the organization that receives the customer repository, so the bootstrap can create and configure it (the approver team and the ruleset live there). Nothing is needed on the NRIT organization. The self-hosted posture needs a second token to register runners; see Bootstrap a customer.
  • The engine App credentials for the organization: a client id and private key that let the jobs read the private engine core. Inside nrit-solutions this is nrit-engine-reader; any other organization gets its own App from NRIT. See Running the platform from your own organization.
  • The template repository nrit-alz-customer-template, public, from which the customer repository is generated.

Toolchain

The operator workstation needs Terraform and the Azure CLI to run the bootstrap.

Inside the customer repository, versions are pinned with mise: mise.toml pins Terraform and Terragrunt, which the engine uses, and pre-commit, tflint, and checkov, which the commit hooks and the PR caller's pre-commit job use. Run mise install once after cloning, then pre-commit install to wire up the hooks. When no version manager is present, the engine workflow falls back to built-in versions, but pinning in the repo is the supported path.

Next: Bootstrap a customer.