Skip to content

Customer Onboarding — Overview

Source: Customer Onboarding Steps (TRIB 19706971190)

Overview

Onboarding a new RaaS customer involves configuring several layers of infrastructure: version control branches, GitLab runners, OS-level config (via Ansible), cloud-level config (via Terraform), and testing.

Onboarding Steps

Step Action Notes / Runbook
1 Create customer branches in ansible-raas, terraform-raas, and testing-raas: <customer_code>, <customer_code>-stage, <customer_code>-dev Git branches per repo for each customer's config
2 Configure the GitLab Runner for the new customer account Runbook: Onboarding RaaSv2.x — Configure GitLab Runner
3 Configure OS level — run the Ansible provisioning playbooks Runbook: Onboarding RaaSv2.x — Configure Customer Ansible
4 Configure Cloud level — run the Terraform provisioning Runbook: Onboarding RaaSv2.x — Configure Customer Terraform
5 Configure the Testing Environment Runbook: Configure Testing Environment for New Customer
6 Run the testing pipeline against the environment and verify Confirm all smoke tests pass before handing off

HSCN-Specific Onboarding

For HSCN customers, additional steps are required after the standard onboarding:

  1. Provision HSCN VPN — see HSCN VPN Operations → Create a New HSCN VPN
  2. Raise Redcentric firewall change request — see Firewall Rules
  3. Allocate HSCN IPAM addresses — coordinate with Lee to assign IP(s) from 10.104.29.0/24
  4. Add customer to TGW route table — done automatically via Terraform in hscn-connection-stack
  5. Verify connectivity — run post-onboarding checks per Connectivity Checks

Key Repositories

Repo Purpose
raas-deploy-raas Ansible playbooks for OS-level provisioning
hscn-connection-stack Terraform for HSCN VPN configuration
raas-aws-environment account.csv — source of truth for all customer account IDs

Customer Reference

Once onboarded, each customer has:

  • A dedicated AWS account (recorded in account.csv)
  • Customer-code-specific config branches in all provisioning repos
  • S3 buckets (bootstrap, backup, logs, support, proxy)
  • A TGW VPC attachment (HSCN customers) or AWS managed VPN (standard customers)

See Architecture → Standard RaaS and Architecture → HSCN RaaS for the infrastructure patterns.

Azure RaaS Customer Onboarding

Source: New Customer Config + Infrastructure — Azure (TRIB 20909064194)

Azure RaaS onboarding follows a more centralised process using the raas-azure-customer-configs repository to generate all downstream config.

Overview

raas-azure-customer-configs/
  customers/<TENANT>/<CUSTOMER_CODE>/<CUSTOMER_CODE>.yaml  ← single source of truth
      ↓ render.py
  raas-azure-terraform-v2/configs/<tenant>/<client>/       ← tfvars
  raas-azure-ansible-v2/inventory/<client>/                ← Ansible inventory

Step-by-Step Onboarding (Azure)

Phase 1: Customer Config Creation

  1. Create the customer YAML: customers/<TENANT>/<CUSTOMER_CODE>/<CUSTOMER_CODE>.yaml
  2. Only list optional modules under modules.extra — base account, core, and connectivity are DEFAULT and must NOT be listed under modules.extra
  3. Set Cosmos DB customer map entry: subscription ID, CIDR block (commonly /24, can be /22), snapshot schedule (start date must be a future date)
  4. Firewall SKU: basic — do NOT upgrade without explicit approval
  5. VPN Gateway SKU: VpnGw1 — do NOT upgrade without approval

Phase 2: Publish Config (GitHub Actions)

  1. Run the "Publish Customer Config" GitHub Action (in raas-azure-customer-configs repo)
  2. First run: set render_only: true (dry run) — review rendered output for correctness
  3. Second run: render_only: false — creates PRs in the downstream repos

Phase 3: Downstream PR Reviews

  1. PRs are created in raas-azure-terraform-v2 and raas-azure-ansible-v2
  2. A senior engineer (Lee / Cole / Emily) reviews and merges these PRs
  3. Do not merge your own downstream PRs — always get a second pair of eyes

Phase 4: Terraform Deployment (Unified Workflow)

Run the Terraform Unified Workflow (PLAN then APPLY) for each module in this order:

Order Module Notes
1 base-account Azure subscription-level resources
2 base-connectivity Hub network, peering
3 base-counter Deployment counter
4 base-core VNets, subnets
5 base-diagnostics Logging and diagnostics
6 env-raas Rhapsody application environment
7 env-snapshots VM snapshot schedule

PLAN before APPLY

Always run a PLAN first and review the output with a senior engineer before running APPLY. Never run APPLY on base-account or base-connectivity without Lee's sign-off.

Phase 5: Ansible Deployment

  1. Merge the Ansible PR (after senior review)
  2. Run the Azure Ansible deployment workflow (GitHub Actions) to provision the VMs

Day-2 Operations

For ongoing changes (software updates, config changes), typically only env-raas or the VPN module needs to be rerun.

Key Variables

Variable Notes
TENANT_NAME e.g. raas, m42, cdph
CLIENT_NAME Customer code e.g. rhapsody
DEVOPS_ENV sandbox1–sandbox4 or prod
MODULE Which Terraform module to run
TARGET_RAAS_ENV prod, nonprod, or all (application tier)