Skip to content

Spoke Deployment

Operator runbook for the deployment of an approved and merged spoke change: a new spoke, or a change of an existing one. Read it with New spoke and Pipelines and workflows.

1. Before you start

  • The pull request is merged to main.
  • You know the exact path of each spoke file in the pull request, relative to the spokes/ folder of the platform environment, for example team-a/canvas_app1_dev.json.
  • You have access to the pipelines of the right platform environment.

2. Plan the spoke

  1. Open the pipelines and select the spoke pipeline (spoke).
  2. Make sure the run uses the main branch.
  3. Set the spoke selection (spokeGlob) to the file you want to deploy. Use the path relative to spokes/, for example team-a/canvas_app1_dev.json. Do not use the default pattern that matches every spoke unless you intend to plan all of them.
  4. Check that the entry pipeline is not in a mode that only plans (whatIf: true), when you want the spoke applied (Parameters you will change).
  5. Start the run.
  6. When the run stops for approval, check that the prepare and plan stage is green. Then read the output of the Terraform plan and compare it with the pull request:
    • The plan matches the changes in the pull request.
    • Replacements of role assignments are common and normally not a problem.
    • If the plan shows changes or deletions for a newly created spoke file, stop the run and ask a second engineer.
  7. If the pull request has several spoke files, repeat the run for each file.

3. Approve and apply

Ask a second engineer to approve the plan (or approve it yourself where your process allows), and follow the run until it finishes.

4. Verify the apply

After the apply stage is green:

  1. Open the apply log.
  2. Check that the requested change was carried out: the spoke resources are created or changed as the plan said.
  3. Do not rely on the green stage alone. If the change is not in the output, do not consider the deployment successful: investigate, and ask a second engineer if needed.
  4. Do the checks of New spoke → Verify: management group, tags, virtual network, the connection to the hub, the Entra ID groups, and access of the team.

5. Close the ticket

Add a line to the ticket that the spoke is deployed, assign it to the requester and move it to Resolved (The standard change process).