Adding a New Business Unit
Use this checklist to onboard a new business unit (BU).
Important: Raise steps 2 to 6 in one PR, but do not merge that PR until step 7 is complete.
Step 1: Request Accounts Created in Modernisation Platform
Request member accounts for both environments:
container-platform-bu-nonlivecontainer-platform-bu-live
Guide: Modernisation Platform new account guide
Step 2: Add to CP accounts.json
Add both new accounts to terraform/environments/cloud-platform/accounts.json in the modernisation-platform-environments repository.
Step 3: Create the Terraform Workspace
The workspace is created automatically in the container-platform-bu application folder. Because Terraform is run from the cloud-platform application folder, create the workspace there as well.
Use generate-account-workspaces.sh so all accounts in accounts.json get corresponding workspaces.
Use AWS credentials for the platform-engineer-admin role in the cloud-platform-development account (any role with state access to cloud-platform is sufficient).
Step 4: Add Root Subdomain
In the cloud-platform root folder, add the BU subdomain in environment-configuration.tf.
Step 5: Add BU to Skip Plan Evaluator
Add the new accounts to .github/config/skip-plan-evaluator-workspaces.json in the modernisation-platform-environments repository.
Step 6: Add the VPC CIDR
Add the allocated VPC CIDR to the vpc_cidr block in network/locals.tf.
Step 7: RAM Share MP TGW to New Accounts
Code example: ram.tf
Raise the PR with the Modernisation Platform team and merge it before moving to the next step.
PR example: modernisation-platform#13439
Step 8: Merge the Modernisation Environments Repository PR
Merge the PR and deploy to the new cluster environments.
Expected behavior at this stage:
- cluster plan fails until the VPC is built
- cluster-core apply fails with a Route53 hosted zone error
PR example: modernisation-platform-environments#17400 (requires MP approval)
Step 9: Tag the New TGW Attachments
In the core-network-services MP account, find the new TGW attachments (these are the ones without Name tags). Use the “Resource owner ID” to identify each attachment.
Add a Name tag matching each account name, for example:
container-platform-bu-nonlivecontainer-platform-bu-live
An MP engineer is required for this step.
Note the TGW attachment IDs for the next step.
Step 10: Add New TGW Attachments to TGW Route Tables in MP
Code example: container_platform_tgw_connections.tf
PR example: modernisation-platform#13440
Get approval and merge.
Step 11: Add Route 53 Records for the New BU Subdomain
Code example: route53.tf
Get the hosted zone NS records from each new BU account and add them to route53.tf.
Step 12: Add the New BU to External DNS
Code example: cluster-core/external-dns.tf
Step 13: Apply Workflows to Build Out Clusters
PR example: modernisation-platform-environments#17412
Approve and merge the PR, then apply the cloud-platform and container-platform workflows.
Step 14: RAM Share the Route53 Profiles from MP to the New BU Accounts
PR example: modernisation-platform#13516
Step 15: Add the New BU Accounts to Identity
Add the new container-platform-<bu>-nonlive and container-platform-<bu>-live account names to the identity Terraform configuration in the container-platform-environments repository.
This change should include:
- adding new providers for the BU accounts
- creating a
namespace_team_access_assignmentslocal for the BU - adding the BU to named clusters
- adding access entries for the BU accounts
PR example: container-platform-environments#10