feat: Added testit-app domain (#121)

* init testit app

* init testit app

* updated modules

* start creation resources

* renamed env folders

* added cert checker

* pre-commit fixs

src/domains/testit-app/00_aks.tf

@@ -0,0 +1,4 @@
+data "azurerm_kubernetes_cluster" "aks" {
+  name                = var.aks_name
+  resource_group_name = var.aks_resource_group_name
+}

src/domains/testit-app/00_azuread.tf

@@ -0,0 +1,16 @@
+# Azure AD
+data "azuread_group" "adgroup_admin" {
+  display_name = "${local.product}-adgroup-admin"
+}
+
+data "azuread_group" "adgroup_developers" {
+  display_name = "${local.product}-adgroup-developers"
+}
+
+data "azuread_group" "adgroup_externals" {
+  display_name = "${local.product}-adgroup-externals"
+}
+
+data "azuread_group" "adgroup_security" {
+  display_name = "${local.product}-adgroup-security"
+}

src/domains/testit-app/00_key_vault.tf

@@ -0,0 +1,4 @@
+data "azurerm_key_vault" "kv_domain" {
+  name                = local.key_vault_domain_name
+  resource_group_name = local.key_vault_domain_resource_group
+}

src/domains/testit-app/00_monitor.tf

@@ -0,0 +1,23 @@
+data "azurerm_resource_group" "monitor_rg" {
+  name = var.monitor_resource_group_name
+}
+
+data "azurerm_log_analytics_workspace" "log_analytics" {
+  name                = var.log_analytics_workspace_name
+  resource_group_name = var.log_analytics_workspace_resource_group_name
+}
+
+data "azurerm_application_insights" "application_insights" {
+  name                = local.monitor_appinsights_name
+  resource_group_name = data.azurerm_resource_group.monitor_rg.name
+}
+
+data "azurerm_monitor_action_group" "slack" {
+  resource_group_name = var.monitor_resource_group_name
+  name                = local.monitor_action_group_slack_name
+}
+
+data "azurerm_monitor_action_group" "email" {
+  resource_group_name = var.monitor_resource_group_name
+  name                = local.monitor_action_group_email_name
+}

src/domains/testit-app/00_network.tf

@@ -0,0 +1,8 @@
+data "azurerm_virtual_network" "vnet_core" {
+  name                = local.vnet_core_name
+  resource_group_name = local.vnet_core_resource_group_name
+}
+
+data "azurerm_resource_group" "rg_vnet_core" {
+  name = local.vnet_core_resource_group_name
+}

src/domains/testit-app/01_keyvault.tf

@@ -0,0 +1,16 @@
+#tfsec:ignore:AZU023
+resource "azurerm_key_vault_secret" "aks_apiserver_url" {
+  name         = "${local.aks_name}-apiserver-url"
+  value        = "https://${local.aks_api_url}:443"
+  content_type = "text/plain"
+
+  key_vault_id = data.azurerm_key_vault.kv_domain.id
+}
+
+resource "azurerm_key_vault_secret" "app_insights_connection_string" {
+  name         = "${local.monitor_appinsights_name}-connection-string"
+  value        = data.azurerm_application_insights.application_insights.connection_string
+  content_type = "text/plain"
+
+  key_vault_id = data.azurerm_key_vault.kv_domain.id
+}

src/domains/testit-app/01_network.tf

@@ -0,0 +1,12 @@
+data "azurerm_private_dns_zone" "internal" {
+  name                = local.internal_dns_zone_name
+  resource_group_name = local.internal_dns_zone_resource_group_name
+}
+
+resource "azurerm_private_dns_a_record" "itn_testit_ingress" {
+  name                = local.ingress_hostname_prefix
+  zone_name           = data.azurerm_private_dns_zone.internal.name
+  resource_group_name = local.internal_dns_zone_resource_group_name
+  ttl                 = 3600
+  records             = [var.ingress_load_balancer_ip]
+}

src/domains/testit-app/02_namespace_domain.tf

@@ -0,0 +1,34 @@
+resource "kubernetes_namespace" "domain_namespace" {
+  metadata {
+    name = var.domain
+  }
+}
+
+module "domain_pod_identity" {
+  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_pod_identity?ref=v8.13.0"
+
+  resource_group_name = local.aks_resource_group_name
+  location            = var.location
+  tenant_id           = data.azurerm_subscription.current.tenant_id
+  cluster_name        = local.aks_name
+
+  identity_name = "${var.domain}-pod-identity"
+  namespace     = kubernetes_namespace.domain_namespace.metadata[0].name
+  key_vault_id  = data.azurerm_key_vault.kv_domain.id
+
+  secret_permissions      = ["Get"]
+  certificate_permissions = ["Get"]
+}
+
+resource "helm_release" "reloader" {
+  name       = "reloader"
+  repository = "https://stakater.github.io/stakater-charts"
+  chart      = "reloader"
+  version    = "v1.0.30"
+  namespace  = kubernetes_namespace.domain_namespace.metadata[0].name
+
+  set {
+    name  = "reloader.watchGlobally"
+    value = "false"
+  }
+}

src/domains/testit-app/03_serviceaccounts_azure_devops.tf

@@ -0,0 +1,65 @@
+resource "kubernetes_namespace" "system_domain_namespace" {
+  metadata {
+    name = "${var.domain}-system"
+  }
+}
+
+module "system_service_account" {
+  source    = "git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_service_account?ref=v8.13.0"
+  name      = "azure-devops"
+  namespace = kubernetes_namespace.system_domain_namespace.metadata[0].name
+}
+
+#tfsec:ignore:AZU023
+resource "azurerm_key_vault_secret" "azure_devops_sa_token" {
+  name         = "${var.aks_name}-azure-devops-sa-token"
+  value        = module.system_service_account.sa_token
+  content_type = "text/plain"
+
+  key_vault_id = data.azurerm_key_vault.kv_domain.id
+}
+
+#tfsec:ignore:AZU023
+resource "azurerm_key_vault_secret" "azure_devops_sa_cacrt" {
+  name         = "${var.aks_name}-azure-devops-sa-cacrt"
+  value        = module.system_service_account.sa_ca_cert
+  content_type = "text/plain"
+
+  key_vault_id = data.azurerm_key_vault.kv_domain.id
+}
+
+#-------------------------------------------------------------
+
+resource "kubernetes_role_binding" "deployer_binding" {
+  metadata {
+    name      = "deployer-binding"
+    namespace = kubernetes_namespace.domain_namespace.metadata[0].name
+  }
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = "cluster-deployer"
+  }
+  subject {
+    kind      = "ServiceAccount"
+    name      = "azure-devops"
+    namespace = kubernetes_namespace.system_domain_namespace.metadata[0].name
+  }
+}
+
+resource "kubernetes_role_binding" "system_deployer_binding" {
+  metadata {
+    name      = "system-deployer-binding"
+    namespace = kubernetes_namespace.system_domain_namespace.metadata[0].name
+  }
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "ClusterRole"
+    name      = "system-cluster-deployer"
+  }
+  subject {
+    kind      = "ServiceAccount"
+    name      = "azure-devops"
+    namespace = kubernetes_namespace.system_domain_namespace.metadata[0].name
+  }
+}

src/domains/testit-app/04_aks_aad_github.tf

@@ -0,0 +1,70 @@
+# #
+# # CI
+# #
+
+# data "azuread_service_principal" "github_runner_ci" {
+#   display_name = "github-pagopa-devopslab-infra-dev-ci"
+# }
+
+# resource "azurerm_key_vault_access_policy" "github_runner_ci" {
+#   key_vault_id = data.azurerm_key_vault.kv_domain.id
+#   tenant_id    = data.azurerm_client_config.current.tenant_id
+#   object_id    = data.azuread_service_principal.github_runner_ci.object_id
+
+#   secret_permissions = ["Get", "List", "Set", ]
+
+#   certificate_permissions = ["SetIssuers", "DeleteIssuers", "Purge", "List", "Get", ]
+
+#   storage_permissions = []
+# }
+
+# resource "null_resource" "aks_with_iac_aad_plus_namespace_ci" {
+#   triggers = {
+#     aks_id               = data.azurerm_kubernetes_cluster.aks.id
+#     service_principal_id = data.azuread_service_principal.github_runner_ci.id
+#     namespace            = var.domain
+#   }
+
+#   provisioner "local-exec" {
+#     command = <<EOT
+#       az role assignment create --role "Azure Kubernetes Service RBAC Admin" \
+#       --assignee ${self.triggers.service_principal_id} \
+#       --scope ${self.triggers.aks_id}/namespaces/${self.triggers.namespace}
+#     EOT
+#   }
+
+#   provisioner "local-exec" {
+#     when    = destroy
+#     command = <<EOT
+#       az role assignment delete --role "Azure Kubernetes Service RBAC Admin" \
+#       --assignee ${self.triggers.service_principal_id} \
+#       --scope ${self.triggers.aks_id}/namespaces/${self.triggers.namespace}
+#     EOT
+#   }
+# }
+
+# #
+# # CD
+# #
+
+# data "azuread_service_principal" "github_runner_cd" {
+#   display_name = "github-pagopa-devopslab-infra-dev-cd"
+# }
+
+# resource "azurerm_key_vault_access_policy" "github_runner_cd" {
+#   key_vault_id = data.azurerm_key_vault.kv_domain.id
+#   tenant_id    = data.azurerm_client_config.current.tenant_id
+#   object_id    = data.azuread_service_principal.github_runner_cd.object_id
+
+#   secret_permissions = ["Get", "List", "Set", ]
+
+#   certificate_permissions = ["SetIssuers", "DeleteIssuers", "Purge", "List", "Get", ]
+
+#   storage_permissions = []
+# }
+
+# resource "azurerm_role_assignment" "aks_cluster_role" {
+#   scope                = data.azurerm_kubernetes_cluster.aks.id
+#   role_definition_name = "Azure Kubernetes Service RBAC Cluster Admin"
+#   principal_id         = data.azuread_service_principal.github_runner_cd.id
+# }