Skip to content

Hub Config

The hub configuration describes one platform environment (canary or prod): its regions, subscriptions, network, firewall, policies and monitoring.

Structure

File / folder Layer Holds
<env-folder>/mcp.json all State backends, job runners, DevOps org, spoke defaults. See mcp.json.
<env-folder>/global.auto.tfvars all primary_region, active_regions, active_regions_names, scaffold_environment, scaffold_environment_short_name, scaffold_company_short_name, scaffold_subscriptions (management, connectivity, identity)
<region>/global.auto.tfvars all scaffold_location, scaffold_location_short_name
<region>/foundation.auto.tfvars foundation Management group structure, action group receivers, custom policy paths, DDoS plan, Network Manager
<region>/connectivity.auto.tfvars connectivity Virtual hub, firewall and policy, gateways, DNS, Bastion, App Gateway and WAF paths, hub 24/7
<region>/firewall.auto.tfvars firewall Rule collection group and IP group paths, naming flags
<region>/identity.auto.tfvars identity Identity VNet
<region>/management.auto.tfvars management Log Analytics, Key Vault, Automation, Sentinel, management VNet
<region>/postdeployment.auto.tfvars postdeployment Policy assignment/exemption paths, Defender, AMBA alerting_management_groups, security contact
<region>/firewall_rule_configuration/*.json firewall Rule collection groups (schema firewallschema.json)
<region>/ip_groups/*.json firewall IP groups
<region>/application_gateways/*.json connectivity App Gateway definitions (schema appgwschema.json)
<region>/web_application_firewall_policies/*.json connectivity WAF policies (schema wafpolicyschema.json)
policies/definitions/, policies/set_definitions/ foundation Custom policy definitions and initiatives
policies/policy_assignments/0{1..4}_*/ postdeployment Assignments at management group, subscription, resource group, resource scope
policies/policy_exemptions/0{1..4}_*/ postdeployment Exemptions at the same four scopes

Files that don't end in .json are ignored by every loader. To disable a file without deleting it, rename it to <name>.json.ignore. (The reference repository uses .jason for sample exemptions.)

TFVARS overview: what goes where

You want to change… File Variables (examples)
Regions global.auto.tfvars primary_region, active_regions, active_regions_names — see Add a region
Names global.auto.tfvars scaffold_company_short_name, scaffold_environment(_short_name); per resource overwrite_*
Management groups <primary>/foundation.auto.tfvars management_group_organization_id, management_group_structure, mgmtgrp_structure_under_customer_area_*
Who gets platform alerts <primary>/foundation.auto.tfvars monitor_action_group_general_email_receiver, …_xpirit_email_receiver, …_webhook_receiver
A hub feature on/off <region>/<layer>.auto.tfvars see the feature flags reference
Hub address ranges <region>/connectivity.auto.tfvars virtual_hub_address_prefix, hub VNet subnets, virtual_network_dns_servers
Tags on hub resources <region>/<layer>.auto.tfvars *_tags, see Hub tags
Alert initiatives <primary>/postdeployment.auto.tfvars alerting_management_groups
Defender contact postdeployment.auto.tfvars security_contact_email

Reference configuration (XDEV)

xms-cloud-platform-config is the XDEV tenant: one region (gwc, Germany West Central), company short name xdev, canary and prod, Azure DevOps organization Xebia-Dev, and two spokes under prod/spokes/data_platform/. It pins release/v4.11.

Content of the JSON files

The fields of each JSON type are described in the runbook that changes them:

How to change hub config

flowchart LR
    b[Branch] --> e[Edit tfvars / JSON] --> t["Validate<br/>(config tests)"] --> pr["PR + review"]
    pr --> ci["CI: hub run in Plan"] --> cd1["CD: apply canary"] --> v[Verify] --> cd2["CD: apply prod"] --> m[Merge]
  1. Create a branch in the configuration repository.
  2. Edit only the files the runbook names.
  3. Run the config tests locally (optional).
  4. Open a pull request; a second engineer reviews.
  5. Run hub from the branch in Plan or ApproveModifications mode. Read every layer's plan.
  6. Apply to canary, verify, then prod.
  7. Merge, so main describes what is deployed.

Full procedure: Making a change safely.