breaking: Core on italy (#116)

* packer images moved to italy

* minor fix

* core in italy

* pre-commit fixs

* terraform lock updated

* added azure devops agent

* pre-commit fixs

src/.env/dev/terraform.tfvars

@@ -28,16 +28,16 @@ key_vault_name    = "dvopla-d-neu-kv"
 key_vault_rg_name = "dvopla-d-sec-rg"
 
 # ☁️ networking
-cidr_vnet                             = ["10.1.0.0/16"]
-cidr_subnet_appgateway                = ["10.1.128.0/24"]
-cidr_subnet_postgres                  = ["10.1.129.0/24"]
-cidr_subnet_azdoa                     = ["10.1.130.0/24"]
-cidr_subnet_app_docker                = ["10.1.132.0/24"]
-cidr_subnet_flex_dbms                 = ["10.1.133.0/24"]
-cidr_subnet_apim                      = ["10.1.136.0/24"]
-cidr_subnet_appgateway_beta           = ["10.1.138.0/24"]
-cidr_subnet_vpn                       = ["10.1.139.0/24"]
-cidr_subnet_dnsforwarder              = ["10.1.140.0/29"]
+cidr_vnet                   = ["10.1.0.0/16"]
+cidr_subnet_appgateway      = ["10.1.128.0/24"]
+cidr_subnet_postgres        = ["10.1.129.0/24"]
+cidr_subnet_azdoa           = ["10.1.130.0/24"]
+cidr_subnet_app_docker      = ["10.1.132.0/24"]
+cidr_subnet_flex_dbms       = ["10.1.133.0/24"]
+cidr_subnet_apim            = ["10.1.136.0/24"]
+cidr_subnet_appgateway_beta = ["10.1.138.0/24"]
+cidr_subnet_vpn             = ["10.1.139.0/24"]
+# cidr_subnet_dnsforwarder              = ["10.1.140.0/29"]
 cidr_subnet_private_endpoints         = ["10.1.141.0/24"]
 cidr_subnet_eventhub                  = ["10.1.142.0/24"]
 cidr_subnet_redis                     = ["10.1.143.0/24"]

src/core/00_entra.tf

@@ -0,0 +1,18 @@
+#
+# Azure AD Access Policy
+#
+data "azuread_group" "adgroup_admin" {
+  display_name = "${local.project}-adgroup-admin"
+}
+
+data "azuread_group" "adgroup_developers" {
+  display_name = "${local.project}-adgroup-developers"
+}
+
+data "azuread_group" "adgroup_externals" {
+  display_name = "${local.project}-adgroup-externals"
+}
+
+data "azuread_group" "adgroup_security" {
+  display_name = "${local.project}-adgroup-security"
+}

src/core/00_keyvault.tf

@@ -0,0 +1,14 @@
+data "azurerm_key_vault" "kv" {
+  name                = var.key_vault_name
+  resource_group_name = var.key_vault_rg_name
+}
+
+data "azurerm_key_vault_secret" "monitor_notification_slack_email" {
+  name         = "monitor-notification-slack-email"
+  key_vault_id = data.azurerm_key_vault.kv.id
+}
+
+data "azurerm_key_vault_secret" "monitor_notification_email" {
+  name         = "monitor-notification-email"
+  key_vault_id = data.azurerm_key_vault.kv.id
+}

src/core/01_keyvault.tf

@@ -1,14 +1,72 @@
-data "azurerm_key_vault" "kv" {
-  name                = var.key_vault_name
-  resource_group_name = var.key_vault_rg_name
+resource "azurerm_resource_group" "sec_rg" {
+  name     = "${local.project_ita}-sec-rg"
+  location = var.location_ita
+
+  tags = var.tags
+}
+
+module "key_vault_core_ita" {
+  source              = "github.com/pagopa/terraform-azurerm-v3.git//key_vault?ref=v8.5.0"
+  name                = "${local.project_ita}-core-kv"
+  location            = azurerm_resource_group.sec_rg.location
+  resource_group_name = azurerm_resource_group.sec_rg.name
+  tenant_id           = data.azurerm_client_config.current.tenant_id
+
+  tags = var.tags
+}
+
+## ad group policy ##
+resource "azurerm_key_vault_access_policy" "adgroup_admin_policy" {
+  key_vault_id = module.key_vault_core_ita.id
+
+  tenant_id = data.azurerm_client_config.current.tenant_id
+  object_id = data.azuread_group.adgroup_admin.object_id
+
+  key_permissions         = ["Get", "List", "Update", "Create", "Import", "Delete", ]
+  secret_permissions      = ["Get", "List", "Set", "Delete", "Recover", "Backup", "Restore"]
+  storage_permissions     = []
+  certificate_permissions = ["Get", "List", "Update", "Create", "Import", "Delete", "Restore", "Purge", "Recover", ]
+}
+
+## ad group policy ##
+resource "azurerm_key_vault_access_policy" "adgroup_developers_policy" {
+  key_vault_id = module.key_vault_core_ita.id
+
+  tenant_id = data.azurerm_client_config.current.tenant_id
+  object_id = data.azuread_group.adgroup_developers.object_id
+
+  key_permissions         = var.env_short == "d" ? ["Get", "List", "Update", "Create", "Import", "Delete", ] : ["Get", "List", "Update", "Create", "Import", ]
+  secret_permissions      = var.env_short == "d" ? ["Get", "List", "Set", "Delete", ] : ["Get", "List", "Set", ]
+  storage_permissions     = []
+  certificate_permissions = var.env_short == "d" ? ["Get", "List", "Update", "Create", "Import", "Delete", "Restore", "Purge", "Recover", ] : ["Get", "List", "Update", "Create", "Import", "Restore", "Recover", ]
 }
 
-data "azurerm_key_vault_secret" "monitor_notification_slack_email" {
-  name         = "monitor-notification-slack-email"
-  key_vault_id = data.azurerm_key_vault.kv.id
+## ad group policy ##
+resource "azurerm_key_vault_access_policy" "adgroup_externals_policy" {
+  count = var.env_short == "d" ? 1 : 0
+
+  key_vault_id = module.key_vault_core_ita.id
+
+  tenant_id = data.azurerm_client_config.current.tenant_id
+  object_id = data.azuread_group.adgroup_externals.object_id
+
+  key_permissions         = ["Get", "List", "Update", "Create", "Import", "Delete", ]
+  secret_permissions      = ["Get", "List", "Set", "Delete", ]
+  storage_permissions     = []
+  certificate_permissions = ["Get", "List", "Update", "Create", "Import", "Delete", "Restore", "Purge", "Recover", ]
 }
 
-data "azurerm_key_vault_secret" "monitor_notification_email" {
-  name         = "monitor-notification-email"
-  key_vault_id = data.azurerm_key_vault.kv.id
+## ad group policy ##
+resource "azurerm_key_vault_access_policy" "adgroup_security_policy" {
+  count = var.env_short == "d" ? 1 : 0
+
+  key_vault_id = module.key_vault_core_ita.id
+
+  tenant_id = data.azurerm_client_config.current.tenant_id
+  object_id = data.azuread_group.adgroup_security.object_id
+
+  key_permissions         = ["Get", "List", "Update", "Create", "Import", "Delete", ]
+  secret_permissions      = ["Get", "List", "Set", "Delete", ]
+  storage_permissions     = []
+  certificate_permissions = ["Get", "List", "Update", "Create", "Import", "Delete", "Restore", "Purge", "Recover", ]
 }

src/core/01_network.tf

@@ -5,18 +5,11 @@ resource "azurerm_resource_group" "rg_vnet" {
   tags = var.tags
 }
 
-resource "azurerm_resource_group" "rg_ita_vnet" {
-  name     = "${local.project_ita}-vnet-rg"
-  location = var.location_ita
-
-  tags = var.tags
-}
-
 #
 # vnet
 #
 module "vnet" {
-  source              = "git::https://github.com/pagopa/terraform-azurerm-v3.git//virtual_network?ref=v7.77.0"
+  source              = "git::https://github.com/pagopa/terraform-azurerm-v3.git//virtual_network?ref=v8.5.0"
   name                = local.vnet_name
   location            = azurerm_resource_group.rg_vnet.location
   resource_group_name = azurerm_resource_group.rg_vnet.name
@@ -25,35 +18,6 @@ module "vnet" {
   tags = var.tags
 }
 
-module "vnet_italy" {
-  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//virtual_network?ref=v7.77.0"
-
-  name                = "${local.project_ita}-vnet"
-  location            = var.location_ita
-  resource_group_name = azurerm_resource_group.rg_ita_vnet.name
-
-  address_space        = var.cidr_vnet_italy
-  ddos_protection_plan = var.vnet_ita_ddos_protection_plan
-
-  tags = var.tags
-}
-
-## Peering between the vnet(main) and italy vnet
-module "vnet_ita_peering" {
-  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//virtual_network_peering?ref=v7.77.0"
-
-  source_resource_group_name       = azurerm_resource_group.rg_ita_vnet.name
-  source_virtual_network_name      = module.vnet_italy.name
-  source_remote_virtual_network_id = module.vnet_italy.id
-  source_use_remote_gateways       = true
-  source_allow_forwarded_traffic   = true
-
-  target_resource_group_name       = azurerm_resource_group.rg_vnet.name
-  target_virtual_network_name      = module.vnet.name
-  target_remote_virtual_network_id = module.vnet.id
-  target_allow_gateway_transit     = true
-
-}
 
 #
 # Public IP
@@ -133,7 +97,7 @@ resource "azurerm_public_ip" "aks_outbound" {
 # Private endpoints
 #
 module "private_endpoints_snet" {
-  source               = "git::https://github.com/pagopa/terraform-azurerm-v3.git//subnet?ref=v7.77.0"
+  source               = "git::https://github.com/pagopa/terraform-azurerm-v3.git//subnet?ref=v8.5.0"
   name                 = "${local.project}-private-endpoints-snet"
   address_prefixes     = var.cidr_subnet_private_endpoints
   virtual_network_name = module.vnet.name
@@ -147,19 +111,3 @@ module "private_endpoints_snet" {
     "Microsoft.Storage",
   ]
 }
-
-module "private_endpoints_italy_snet" {
-  source               = "git::https://github.com/pagopa/terraform-azurerm-v3.git//subnet?ref=v7.77.0"
-  name                 = "${local.project}-private-endpoints-italy-snet"
-  address_prefixes     = var.cidr_subnet_private_endpoints_italy
-  virtual_network_name = module.vnet_italy.name
-
-  resource_group_name = azurerm_resource_group.rg_ita_vnet.name
-
-  private_endpoint_network_policies_enabled = false
-  service_endpoints = [
-    "Microsoft.Web",
-    "Microsoft.AzureCosmosDB",
-    "Microsoft.Storage",
-  ]
-}

src/core/01_network_ita.tf

@@ -0,0 +1,55 @@
+resource "azurerm_resource_group" "rg_ita_vnet" {
+  name     = local.vnet_ita_resource_group_name
+  location = var.location_ita
+
+  tags = var.tags
+}
+
+module "vnet_italy" {
+  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//virtual_network?ref=v8.5.0"
+
+  name                = local.vnet_ita_name
+  location            = var.location_ita
+  resource_group_name = azurerm_resource_group.rg_ita_vnet.name
+
+  address_space        = var.cidr_vnet_italy
+  ddos_protection_plan = var.vnet_ita_ddos_protection_plan
+
+  tags = var.tags
+}
+
+## Peering between the vnet(main) and italy vnet
+module "vnet_ita_peering" {
+  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//virtual_network_peering?ref=v8.5.0"
+
+  source_resource_group_name       = azurerm_resource_group.rg_ita_vnet.name
+  source_virtual_network_name      = module.vnet_italy.name
+  source_remote_virtual_network_id = module.vnet_italy.id
+  source_use_remote_gateways       = false
+  source_allow_forwarded_traffic   = true
+
+  target_resource_group_name       = azurerm_resource_group.rg_vnet.name
+  target_virtual_network_name      = module.vnet.name
+  target_remote_virtual_network_id = module.vnet.id
+  target_allow_gateway_transit     = false
+}
+
+module "packer_azdo_snet" {
+  source                                    = "git::https://github.com/pagopa/terraform-azurerm-v3.git//subnet?ref=v8.5.0"
+  name                                      = "packer-azdo-subnet"
+  address_prefixes                          = var.cidr_subnet_packer_azdo
+  virtual_network_name                      = module.vnet_italy.name
+  resource_group_name                       = azurerm_resource_group.rg_ita_vnet.name
+  service_endpoints                         = []
+  private_endpoint_network_policies_enabled = true
+}
+
+module "packer_dns_forwarder_snet" {
+  source                                    = "git::https://github.com/pagopa/terraform-azurerm-v3.git//subnet?ref=v8.5.0"
+  name                                      = "packer-dns-forwarder-subnet"
+  address_prefixes                          = var.cidr_subnet_packer_dns_forwarder
+  virtual_network_name                      = module.vnet_italy.name
+  resource_group_name                       = azurerm_resource_group.rg_ita_vnet.name
+  service_endpoints                         = []
+  private_endpoint_network_policies_enabled = true
+}

src/core/02_dns_private.tf

@@ -4,14 +4,14 @@
 resource "azurerm_private_dns_zone" "internal_devopslab" {
   count               = (var.dns_zone_internal_prefix == null || var.external_domain == null) ? 0 : 1
   name                = local.dns_zone_private_name
-  resource_group_name = azurerm_resource_group.rg_vnet.name
+  resource_group_name = azurerm_resource_group.rg_ita_vnet.name
 
   tags = var.tags
 }
 
 resource "azurerm_private_dns_zone_virtual_network_link" "vnet_core" {
   name                  = local.vnet_resource_group_name
-  resource_group_name   = azurerm_resource_group.rg_vnet.name
+  resource_group_name   = azurerm_resource_group.rg_ita_vnet.name
   private_dns_zone_name = azurerm_private_dns_zone.internal_devopslab[0].name
   virtual_network_id    = module.vnet.id
 
@@ -22,7 +22,7 @@ resource "azurerm_private_dns_zone_virtual_network_link" "vnet_core" {
 resource "azurerm_private_dns_zone" "privatelink_postgres_database_azure_com" {
 
   name                = "privatelink.postgres.database.azure.com"
-  resource_group_name = azurerm_resource_group.rg_vnet.name
+  resource_group_name = azurerm_resource_group.rg_ita_vnet.name
 
   tags = var.tags
 }
@@ -32,7 +32,7 @@ resource "azurerm_private_dns_zone_virtual_network_link" "privatelink_postgres_d
   name                  = "${local.project}-pg-flex-link"
   private_dns_zone_name = azurerm_private_dns_zone.privatelink_postgres_database_azure_com.name
 
-  resource_group_name = azurerm_resource_group.rg_vnet.name
+  resource_group_name = azurerm_resource_group.rg_ita_vnet.name
   virtual_network_id  = module.vnet.id
 
   registration_enabled = false
@@ -43,12 +43,12 @@ resource "azurerm_private_dns_zone_virtual_network_link" "privatelink_postgres_d
 
 resource "azurerm_private_dns_zone" "storage_account" {
   name                = "privatelink.blob.core.windows.net"
-  resource_group_name = azurerm_resource_group.rg_vnet.name
+  resource_group_name = azurerm_resource_group.rg_ita_vnet.name
 }
 
 resource "azurerm_private_dns_zone_virtual_network_link" "storage_account_vnet" {
   name                  = "${local.project}-storage-account-vnet-private-dns-zone-link"
-  resource_group_name   = azurerm_resource_group.rg_vnet.name
+  resource_group_name   = azurerm_resource_group.rg_ita_vnet.name
   private_dns_zone_name = azurerm_private_dns_zone.storage_account.name
   virtual_network_id    = module.vnet.id
 }