diff --git a/azure-devops/.env/printit_state.tfvars b/azure-devops/.env/printit_state.tfvars new file mode 100644 index 00000000..3e86f265 --- /dev/null +++ b/azure-devops/.env/printit_state.tfvars @@ -0,0 +1,4 @@ +resource_group_name = "terraform-state-rg" +storage_account_name = "tfinfprodpagopa" +container_name = "terraform-state" +key = "azdo-printit.terraform.tfstate" diff --git a/azure-devops/printit/.terraform.lock.hcl b/azure-devops/printit/.terraform.lock.hcl new file mode 100644 index 00000000..b08434b4 --- /dev/null +++ b/azure-devops/printit/.terraform.lock.hcl @@ -0,0 +1,81 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/hashicorp/azurerm" { + version = "3.64.0" + constraints = ">= 3.30.0, <= 3.64.0, <= 3.85.0, <= 3.90.0, <= 3.94.0" + hashes = [ + "h1:cmleWBjFp4eK0iQICvCKxTxECx8nvl0MAfth9mLzT70=", + "zh:08463ceca4208419715b5816d120fe05f2abda9bea083cfe1818e25517483581", + "zh:130760c5ab791bd114b3edbb79b95138a60cd97f1b72e4096b33a207b367d126", + "zh:26403fc9be70b60fddf09b1510067763b2da57cf3b116d375b5bee048acad8d2", + "zh:352c79bb75c1a0d88a686c4e22fded1114de0249aba081e34265d4b11c878fc7", + "zh:52ee37390b70e89add8b70b43c05bc90037a723a726c63440943f9bf2f064817", + "zh:79ad0c72e2b15b9412f1fdb5461dfcec6ca192ab4512e70fcbcea4585c02d71e", + "zh:7a60226f41064a95db14e64dc0250063a621df254ee41e4b3b25ccc5ce47936d", + "zh:9191136871cf2ffa4f1963a6b79d6868f911f827330234421af869df616bacd0", + "zh:a32cb5eb225ccea6d3d5e70f948dfc4b4ed442cd20ceb80ce014a3df05ab93e8", + "zh:de16cb2726016e0eb9a04599fdb81b503a96263b1805243b75b202c559051a5e", + "zh:ee636ddb5281772071f9952f75b2c7ad7f443f25c84c96e6e78d628a151ec4ac", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + ] +} + +provider "registry.terraform.io/hashicorp/null" { + version = "3.2.1" + constraints = "<= 3.2.1" + hashes = [ + "h1:tSj1mL6OQ8ILGqR2mDu7OYYYWf+hoir0pf9KAQ8IzO8=", + "zh:58ed64389620cc7b82f01332e27723856422820cfd302e304b5f6c3436fb9840", + "zh:62a5cc82c3b2ddef7ef3a6f2fedb7b9b3deff4ab7b414938b08e51d6e8be87cb", + "zh:63cff4de03af983175a7e37e52d4bd89d990be256b16b5c7f919aff5ad485aa5", + "zh:74cb22c6700e48486b7cabefa10b33b801dfcab56f1a6ac9b6624531f3d36ea3", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:79e553aff77f1cfa9012a2218b8238dd672ea5e1b2924775ac9ac24d2a75c238", + "zh:a1e06ddda0b5ac48f7e7c7d59e1ab5a4073bbcf876c73c0299e4610ed53859dc", + "zh:c37a97090f1a82222925d45d84483b2aa702ef7ab66532af6cbcfb567818b970", + "zh:e4453fbebf90c53ca3323a92e7ca0f9961427d2f0ce0d2b65523cc04d5d999c2", + "zh:e80a746921946d8b6761e77305b752ad188da60688cfd2059322875d363be5f5", + "zh:fbdb892d9822ed0e4cb60f2fedbdbb556e4da0d88d3b942ae963ed6ff091e48f", + "zh:fca01a623d90d0cad0843102f9b8b9fe0d3ff8244593bd817f126582b52dd694", + ] +} + +provider "registry.terraform.io/hashicorp/time" { + version = "0.7.2" + constraints = ">= 0.7.0, < 0.8.0" + hashes = [ + "h1:NKy1QrNLlP5mKy5Tea6lQSRsVoyydJQKh6WvNTdBF4I=", + "zh:0bbe0158c2a9e3f5be911b7e94477586110c51746bb13d102054f22754565bda", + "zh:3250af7fd49b8aaf2ccc895588af05197d886e38b727e3ba33bcbb8cc96ad34d", + "zh:35e4de0437f4fa9c1ad69aaf8136413be2369ea607d78e04bb68dc66a6a520b8", + "zh:369756417a6272e79cad31eb2c82c202f6a4b6e4204a893f656644ba9e149fa2", + "zh:390370f1179d89b33c3a0731691e772d5450a7d59fc66671ec625e201db74aa2", + "zh:3d12ac905259d225c685bc42e5507ed0fbdaa5a09c30dce7c1932d908df857f7", + "zh:75f63e5e1c68e6c5bccba4568c3564e2774eb3a7a19189eb8e2b6e0d58c8f8cc", + "zh:7c22a2078a608e3e0278c4cbc9c483909062ebd1843bddaf8f176346c6d378b1", + "zh:7cfb3c02f78f0060d59c757c4726ab45a962ce4a9cf4833beca704a1020785bd", + "zh:a0325917f47c28a2ed088dedcea0d9520d91b264e63cc667fe4336ac993c0c11", + "zh:c181551d4c0a40b52e236f1755cc340aeca0fb5dcfd08b3b1c393a7667d2f327", + ] +} + +provider "registry.terraform.io/microsoft/azuredevops" { + version = "0.11.0" + constraints = ">= 0.10.0, <= 0.11.0, <= 0.12.0" + hashes = [ + "h1:yb4AQ29LbPHyx2P/R4iaYqc2kscGU1aJ21NRwpBnc2c=", + "zh:12cc42735217c3f7ae7da9ef581837f11fc2afdb5fd9ff442ff5e6a9d8368246", + "zh:1d302bc38a67769908c8dc2a796176c9ba255f7b41b7b577da87e15ab7660079", + "zh:281e68315547896254281a57a73044c65f879a8b17e367053b2c9b06c2b44bfd", + "zh:2ce6ee1c5a24ef20a0ee8f14da18fe8a20b7d30e220eb3dc8b32e69553093664", + "zh:2e976cf1bc1b8838b1692e0d9e81785a5acb038c2f88bf16f5179035062aa900", + "zh:63e741f34ff94ce20bdea93310e880c5f32600050edf2f7d3ea360fc485229cd", + "zh:8aca777d8f5c40de91463eb4b832c57f6057a1f6f7d0cea1b939a9661fff5190", + "zh:b63aad78bddcdb6851b09734dcc5c238623277c127670f3f8fea1fe56a54a921", + "zh:be17c718fc83192f95cfd37bbe5263f1c1bf93c41cca93479f24126e4f11bb51", + "zh:d29ddf5287fa08e41fce6587efe75d69a53daf485620d864f848ebb432fb2bdc", + "zh:f86182f7c1c74e4a4903271156218044e2032958e2097ec745ba4271359e5a3a", + "zh:fb58350182a0e5a48ae9a88ad3ab062a76b4f5779539a5f101657c51dd50abdf", + ] +} diff --git a/azure-devops/printit/00_key_vault.tf b/azure-devops/printit/00_key_vault.tf new file mode 100644 index 00000000..6ee5f285 --- /dev/null +++ b/azure-devops/printit/00_key_vault.tf @@ -0,0 +1,24 @@ +data "azurerm_key_vault" "domain_kv_dev" { + + provider = azurerm.dev + + resource_group_name = local.dev_printit_key_vault_resource_group + name = local.dev_printit_key_vault_name +} + +#data "azurerm_key_vault" "domain_kv_uat" { +# +# provider = azurerm.uat +# +# resource_group_name = local.uat_printit_key_vault_resource_group +# name = local.uat_printit_key_vault_name +#} +# +#data "azurerm_key_vault" "domain_kv_prod" { +# +# provider = azurerm.prod +# +# resource_group_name = local.prod_printit_key_vault_resource_group +# name = local.prod_printit_key_vault_name +#} + diff --git a/azure-devops/printit/00_secrets_printit.tf b/azure-devops/printit/00_secrets_printit.tf new file mode 100644 index 00000000..d8348b43 --- /dev/null +++ b/azure-devops/printit/00_secrets_printit.tf @@ -0,0 +1,54 @@ +module "printit_dev_secrets" { + + providers = { + azurerm = azurerm.dev + } + + source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault_secrets_query?ref=v7.67.1" + + resource_group = local.dev_printit_key_vault_resource_group + key_vault_name = local.dev_printit_key_vault_name + + secrets = [ + "pagopa-d-itn-dev-aks-azure-devops-sa-token", + "pagopa-d-itn-dev-aks-azure-devops-sa-cacrt", + "pagopa-d-itn-dev-aks-apiserver-url", + ] +} +# +#module "printit_uat_secrets" { +# +# providers = { +# azurerm = azurerm.uat +# } +# +# source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault_secrets_query?ref=v7.67.1" +# +# resource_group = local.uat_printit_key_vault_resource_group +# key_vault_name = local.uat_printit_key_vault_name +# +# secrets = [ +# "pagopa-u-itn-uat-aks-azure-devops-sa-token", +# "pagopa-u-itn-uat-aks-azure-devops-sa-cacrt", +# "pagopa-u-itn-uat-aks-apiserver-url", +# ] +#} +# +#module "printit_prod_secrets" { +# +# providers = { +# azurerm = azurerm.prod +# } +# +# source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault_secrets_query?ref=v7.67.1" +# +# resource_group = local.prod_printit_key_vault_resource_group +# key_vault_name = local.prod_printit_key_vault_name +# +# secrets = [ +# "pagopa-p-itn-prod-aks-azure-devops-sa-token", +# "pagopa-p-itn-prod-aks-azure-devops-sa-cacrt", +# "pagopa-p-itn-prod-aks-apiserver-url" +# ] +#} + diff --git a/azure-devops/printit/00_secrets_prod.tf b/azure-devops/printit/00_secrets_prod.tf new file mode 100644 index 00000000..f7d8fb3c --- /dev/null +++ b/azure-devops/printit/00_secrets_prod.tf @@ -0,0 +1,33 @@ +# +# PROD KEYVAULT +# + +module "secrets" { + source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault_secrets_query?ref=v7.67.1" + + resource_group = local.prod_key_vault_resource_group + key_vault_name = local.prod_key_vault_azdo_name + + secrets = [ + "DANGER-GITHUB-API-TOKEN", + "azure-devops-github-ro-TOKEN", + "azure-devops-github-rw-TOKEN", + "azure-devops-github-pr-TOKEN", + "azure-devops-github-EMAIL", + "azure-devops-github-USERNAME", + ] +} + + + +data "azurerm_subscriptions" "prod" { + display_name_prefix = local.prod_subscription_name +} + +data "azurerm_subscriptions" "uat" { + display_name_prefix = local.uat_subscription_name +} + +data "azurerm_subscriptions" "dev" { + display_name_prefix = local.dev_subscription_name +} diff --git a/azure-devops/printit/00_service_connections.tf b/azure-devops/printit/00_service_connections.tf new file mode 100644 index 00000000..bb357332 --- /dev/null +++ b/azure-devops/printit/00_service_connections.tf @@ -0,0 +1,53 @@ +# +# GITHUB +# +data "azuredevops_serviceendpoint_github" "github_pr" { + project_id = data.azuredevops_project.project.id + service_endpoint_name = "io-azure-devops-github-pr" +} + +data "azuredevops_serviceendpoint_github" "github_ro" { + project_id = data.azuredevops_project.project.id + service_endpoint_name = "io-azure-devops-github-ro" +} + +data "azuredevops_serviceendpoint_github" "github_rw" { + project_id = data.azuredevops_project.project.id + service_endpoint_name = "io-azure-devops-github-rw" +} + +# +# AZURERM +# +data "azuredevops_serviceendpoint_azurerm" "dev" { + project_id = data.azuredevops_project.project.id + service_endpoint_name = var.service_connection_dev_azurerm_name +} + +#data "azuredevops_serviceendpoint_azurerm" "uat" { +# project_id = data.azuredevops_project.project.id +# service_endpoint_name = var.service_connection_uat_azurerm_name +#} +# +#data "azuredevops_serviceendpoint_azurerm" "prod" { +# project_id = data.azuredevops_project.project.id +# service_endpoint_name = var.service_connection_prod_azurerm_name +#} + +# +# ACR +# +data "azuredevops_serviceendpoint_azurecr" "dev" { + project_id = data.azuredevops_project.project.id + service_endpoint_name = var.service_connection_dev_acr_name +} + +#data "azuredevops_serviceendpoint_azurecr" "uat" { +# project_id = data.azuredevops_project.project.id +# service_endpoint_name = var.service_connection_uat_acr_name +#} +# +#data "azuredevops_serviceendpoint_azurecr" "prod" { +# project_id = data.azuredevops_project.project.id +# service_endpoint_name = var.service_connection_prod_acr_name +#} diff --git a/azure-devops/printit/01_project.tf b/azure-devops/printit/01_project.tf new file mode 100644 index 00000000..215912ba --- /dev/null +++ b/azure-devops/printit/01_project.tf @@ -0,0 +1,3 @@ +data "azuredevops_project" "project" { + name = var.project_name +} \ No newline at end of file diff --git a/azure-devops/printit/03_service_connections_aks.tf b/azure-devops/printit/03_service_connections_aks.tf new file mode 100644 index 00000000..83ddd60d --- /dev/null +++ b/azure-devops/printit/03_service_connections_aks.tf @@ -0,0 +1,38 @@ +resource "azuredevops_serviceendpoint_kubernetes" "aks_dev" { + depends_on = [data.azuredevops_project.project] + project_id = data.azuredevops_project.project.id + service_endpoint_name = local.srv_endpoint_name_aks_dev + apiserver_url = module.printit_dev_secrets.values["pagopa-d-itn-dev-aks-apiserver-url"].value + authorization_type = "ServiceAccount" + service_account { + # base64 values + token = module.printit_dev_secrets.values["pagopa-d-itn-dev-aks-azure-devops-sa-token"].value + ca_cert = module.printit_dev_secrets.values["pagopa-d-itn-dev-aks-azure-devops-sa-cacrt"].value + } +} + +#resource "azuredevops_serviceendpoint_kubernetes" "aks_uat" { +# depends_on = [data.azuredevops_project.project] +# project_id = data.azuredevops_project.project.id +# service_endpoint_name = local.srv_endpoint_name_aks_uat +# apiserver_url = module.printit_uat_secrets.values["pagopa-u-itn-uat-aks-apiserver-url"].value +# authorization_type = "ServiceAccount" +# service_account { +# # base64 values +# token = module.printit_uat_secrets.values["pagopa-u-itn-uat-aks-azure-devops-sa-token"].value +# ca_cert = module.printit_uat_secrets.values["pagopa-u-itn-uat-aks-azure-devops-sa-cacrt"].value +# } +#} +# +#resource "azuredevops_serviceendpoint_kubernetes" "aks_prod" { +# depends_on = [data.azuredevops_project.project] +# project_id = data.azuredevops_project.project.id +# service_endpoint_name = local.srv_endpoint_name_aks_prod +# apiserver_url = module.printit_prod_secrets.values["pagopa-p-itn-prod-aks-apiserver-url"].value +# authorization_type = "ServiceAccount" +# service_account { +# # base64 values +# token = module.printit_prod_secrets.values["pagopa-p-itn-prod-aks-azure-devops-sa-token"].value +# ca_cert = module.printit_prod_secrets.values["pagopa-p-itn-prod-aks-azure-devops-sa-cacrt"].value +# } +#} diff --git a/azure-devops/printit/03_service_connections_tls_certificate.tf b/azure-devops/printit/03_service_connections_tls_certificate.tf new file mode 100644 index 00000000..1fbdaea1 --- /dev/null +++ b/azure-devops/printit/03_service_connections_tls_certificate.tf @@ -0,0 +1,127 @@ +# +# DEV +# +module "DEV-PRINTIT-TLS-CERT-SERVICE-CONN" { + + providers = { + azurerm = azurerm.dev + } + + depends_on = [data.azuredevops_project.project] + source = "git::https://github.com/pagopa/azuredevops-tf-modules.git//azuredevops_serviceendpoint_federated?ref=v7.1.0" + + project_id = data.azuredevops_project.project.id + name = "${local.prefix}-${local.domain}-d-tls-cert-azdo" + tenant_id = data.azurerm_client_config.current.tenant_id + subscription_name = var.dev_subscription_name + subscription_id = data.azurerm_subscriptions.dev.subscriptions[0].subscription_id + resource_group_name = local.dev_identity_rg_name + location = local.location_westeurope + +} + +resource "azurerm_key_vault_access_policy" "DEV-PRINTIT-TLS-CERT-SERVICE-CONN_kv_access_policy" { + provider = azurerm.dev + key_vault_id = data.azurerm_key_vault.domain_kv_dev.id + tenant_id = data.azurerm_client_config.current.tenant_id + object_id = module.DEV-PRINTIT-TLS-CERT-SERVICE-CONN.service_principal_object_id + + certificate_permissions = ["Get", "Import"] +} + +# create let's encrypt credential used to create SSL certificates +module "letsencrypt_dev" { + source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//letsencrypt_credential?ref=v7.1.0" + + providers = { + azurerm = azurerm.dev + } + prefix = local.prefix + env = "d" + key_vault_name = local.dev_printit_key_vault_name + subscription_name = var.dev_subscription_name +} + +## +## UAT +## +#module "UAT-PRINTIT-TLS-CERT-SERVICE-CONN" { +# providers = { +# azurerm = azurerm.uat +# } +# +# depends_on = [data.azuredevops_project.project] +# source = "git::https://github.com/pagopa/azuredevops-tf-modules.git//azuredevops_serviceendpoint_federated?ref=v7.1.0" +# +# project_id = data.azuredevops_project.project.id +# name = "${local.prefix}-${local.domain}-u-tls-cert-azdo" +# tenant_id = data.azurerm_client_config.current.tenant_id +# subscription_name = var.uat_subscription_name +# subscription_id = data.azurerm_subscriptions.uat.subscriptions[0].subscription_id +# location = local.location_westeurope +# resource_group_name = local.uat_identity_rg_name +#} +# +#resource "azurerm_key_vault_access_policy" "UAT-PRINTIT-TLS-CERT-SERVICE-CONN_kv_access_policy" { +# provider = azurerm.uat +# key_vault_id = data.azurerm_key_vault.domain_kv_uat.id +# tenant_id = data.azurerm_client_config.current.tenant_id +# object_id = module.UAT-PRINTIT-TLS-CERT-SERVICE-CONN.service_principal_object_id +# +# certificate_permissions = ["Get", "Import"] +#} +# +## create let's encrypt credential used to create SSL certificates +#module "letsencrypt_uat" { +# source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//letsencrypt_credential?ref=v7.1.0" +# +# providers = { +# azurerm = azurerm.uat +# } +# prefix = local.prefix +# env = "u" +# key_vault_name = local.uat_printit_key_vault_name +# subscription_name = var.uat_subscription_name +#} +# +## +## PROD +## +#module "PROD-PRINTIT-TLS-CERT-SERVICE-CONN" { +# providers = { +# azurerm = azurerm.prod +# } +# +# depends_on = [data.azuredevops_project.project] +# source = "git::https://github.com/pagopa/azuredevops-tf-modules.git//azuredevops_serviceendpoint_federated?ref=v7.1.0" +# +# project_id = data.azuredevops_project.project.id +# name = "${local.prefix}-${local.domain}-p-tls-cert-azdo" +# tenant_id = data.azurerm_client_config.current.tenant_id +# subscription_name = var.prod_subscription_name +# subscription_id = data.azurerm_subscriptions.prod.subscriptions[0].subscription_id +# location = local.location_westeurope +# resource_group_name = local.prod_identity_rg_name +#} +# +#resource "azurerm_key_vault_access_policy" "PROD-PRINTIT-TLS-CERT-SERVICE-CONN_kv_access_policy" { +# provider = azurerm.prod +# key_vault_id = data.azurerm_key_vault.domain_kv_prod.id +# tenant_id = data.azurerm_client_config.current.tenant_id +# object_id = module.PROD-PRINTIT-TLS-CERT-SERVICE-CONN.service_principal_object_id +# +# certificate_permissions = ["Get", "Import"] +#} +# +## create let's encrypt credential used to create SSL certificates +#module "letsencrypt_prod" { +# source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//letsencrypt_credential?ref=v7.1.0" +# +# providers = { +# azurerm = azurerm.prod +# } +# prefix = local.prefix +# env = "p" +# key_vault_name = local.prod_printit_key_vault_name +# subscription_name = var.prod_subscription_name +#} diff --git a/azure-devops/printit/05_tlscert-printit-itn-internal-dev-platform-pagopa-it.tf b/azure-devops/printit/05_tlscert-printit-itn-internal-dev-platform-pagopa-it.tf new file mode 100644 index 00000000..110786a5 --- /dev/null +++ b/azure-devops/printit/05_tlscert-printit-itn-internal-dev-platform-pagopa-it.tf @@ -0,0 +1,90 @@ +variable "tlscert-printit-itn-internal-dev-platform-pagopa-it" { + default = { + repository = { + organization = "pagopa" + name = "le-azure-acme-tiny" + branch_name = "refs/heads/master" + pipelines_path = "." + } + pipeline = { + enable_tls_cert = true + path = "TLS-Certificates\\DEV" + dns_record_name = "printit.itn.internal" + dns_zone_name = "dev.platform.pagopa.it" + dns_zone_resource_group = "pagopa-d-vnet-rg" + # common variables to all pipelines + variables = { + CERT_NAME_EXPIRE_SECONDS = "2592000" #30 days + KEY_VAULT_NAME = "pagopa-d-itn-printit-kv" + } + # common secret variables to all pipelines + variables_secret = { + } + } + } +} + +locals { + tlscert-printit-itn-internal-dev-platform-pagopa-it = { + tenant_id = data.azurerm_client_config.current.tenant_id + subscription_name = "DEV-PAGOPA" + subscription_id = data.azurerm_subscriptions.dev.subscriptions[0].subscription_id + } + tlscert-printit-itn-internal-dev-platform-pagopa-it-variables = { + KEY_VAULT_SERVICE_CONNECTION = module.DEV-PRINTIT-TLS-CERT-SERVICE-CONN.service_endpoint_name + } + tlscert-printit-itn-internal-dev-platform-pagopa-it-variables_secret = { + } +} + +module "tlscert-printit-itn-internal-dev-platform-pagopa-it-cert_az" { + + providers = { + azurerm = azurerm.dev + } + + source = "git::https://github.com/pagopa/azuredevops-tf-modules.git//azuredevops_build_definition_tls_cert_federated?ref=v7.1.0" + count = var.tlscert-printit-itn-internal-dev-platform-pagopa-it.pipeline.enable_tls_cert == true ? 1 : 0 + + project_id = data.azuredevops_project.project.id + repository = var.tlscert-printit-itn-internal-dev-platform-pagopa-it.repository + path = var.tlscert-printit-itn-internal-dev-platform-pagopa-it.pipeline.path + github_service_connection_id = data.azuredevops_serviceendpoint_github.github_ro.id + + dns_record_name = var.tlscert-printit-itn-internal-dev-platform-pagopa-it.pipeline.dns_record_name + dns_zone_name = var.tlscert-printit-itn-internal-dev-platform-pagopa-it.pipeline.dns_zone_name + dns_zone_resource_group = var.tlscert-printit-itn-internal-dev-platform-pagopa-it.pipeline.dns_zone_resource_group + tenant_id = local.tlscert-printit-itn-internal-dev-platform-pagopa-it.tenant_id + subscription_name = local.tlscert-printit-itn-internal-dev-platform-pagopa-it.subscription_name + subscription_id = local.tlscert-printit-itn-internal-dev-platform-pagopa-it.subscription_id + location = local.location_westeurope + credential_key_vault_name = local.dev_printit_key_vault_name + credential_key_vault_resource_group = local.dev_printit_key_vault_resource_group + managed_identity_resource_group_name = local.dev_identity_rg_name + + variables = merge( + var.tlscert-printit-itn-internal-dev-platform-pagopa-it.pipeline.variables, + local.tlscert-printit-itn-internal-dev-platform-pagopa-it-variables, + ) + + variables_secret = merge( + var.tlscert-printit-itn-internal-dev-platform-pagopa-it.pipeline.variables_secret, + local.tlscert-printit-itn-internal-dev-platform-pagopa-it-variables_secret, + ) + + service_connection_ids_authorization = [ + module.DEV-PRINTIT-TLS-CERT-SERVICE-CONN.service_endpoint_id, + ] + + schedules = { + days_to_build = ["Fri"] + schedule_only_with_changes = false + start_hours = 3 + start_minutes = 0 + time_zone = "(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna" + branch_filter = { + include = ["master"] + exclude = [] + } + } +} diff --git a/azure-devops/printit/05_tlscert-printit-itn-internal-platform-pagopa-it.tf b/azure-devops/printit/05_tlscert-printit-itn-internal-platform-pagopa-it.tf new file mode 100644 index 00000000..f34dea34 --- /dev/null +++ b/azure-devops/printit/05_tlscert-printit-itn-internal-platform-pagopa-it.tf @@ -0,0 +1,90 @@ +#variable "tlscert-printit-itn-internal-prod-platform-pagopa-it" { +# default = { +# repository = { +# organization = "pagopa" +# name = "le-azure-acme-tiny" +# branch_name = "refs/heads/master" +# pipelines_path = "." +# } +# pipeline = { +# enable_tls_cert = true +# path = "TLS-Certificates\\DEV" +# dns_record_name = "printit.itn.internal" +# dns_zone_name = "dev.platform.pagopa.it" +# dns_zone_resource_group = "pagopa-p-itn-printit-itn-sec-rg" +# # common variables to all pipelines +# variables = { +# CERT_NAME_EXPIRE_SECONDS = "2592000" #30 days +# KEY_VAULT_NAME = "pagopa-p-itn-printit-kv" +# } +# # common secret variables to all pipelines +# variables_secret = { +# } +# } +# } +#} +# +#locals { +# tlscert-printit-itn-internal-prod-platform-pagopa-it = { +# tenant_id = data.azurerm_client_config.current.tenant_id +# subscription_name = "PROD-PAGOPA" +# subscription_id = data.azurerm_subscriptions.dev.subscriptions[0].subscription_id +# } +# tlscert-printit-itn-internal-prod-platform-pagopa-it-variables = { +# KEY_VAULT_SERVICE_CONNECTION = module.PROD-PRINTIT-TLS-CERT-SERVICE-CONN.service_endpoint_name +# } +# tlscert-printit-itn-internal-prod-platform-pagopa-it-variables_secret = { +# } +#} +# +#module "tlscert-printit-itn-internal-prod-platform-pagopa-it-cert_az" { +# +# providers = { +# azurerm = azurerm.dev +# } +# +# source = "git::https://github.com/pagopa/azuredevops-tf-modules.git//azuredevops_build_definition_tls_cert_federated?ref=v7.1.0" +# count = var.tlscert-printit-itn-internal-prod-platform-pagopa-it.pipeline.enable_tls_cert == true ? 1 : 0 +# +# project_id = data.azuredevops_project.project.id +# repository = var.tlscert-printit-itn-internal-prod-platform-pagopa-it.repository +# path = var.tlscert-printit-itn-internal-prod-platform-pagopa-it.pipeline.path +# github_service_connection_id = data.azuredevops_serviceendpoint_github.github_ro.id +# +# dns_record_name = var.tlscert-printit-itn-internal-prod-platform-pagopa-it.pipeline.dns_record_name +# dns_zone_name = var.tlscert-printit-itn-internal-prod-platform-pagopa-it.pipeline.dns_zone_name +# dns_zone_resource_group = var.tlscert-printit-itn-internal-prod-platform-pagopa-it.pipeline.dns_zone_resource_group +# tenant_id = local.tlscert-printit-itn-internal-prod-platform-pagopa-it.tenant_id +# subscription_name = local.tlscert-printit-itn-internal-prod-platform-pagopa-it.subscription_name +# subscription_id = local.tlscert-printit-itn-internal-prod-platform-pagopa-it.subscription_id +# location = local.location_westeurope +# credential_key_vault_name = local.dev_printit-itn_key_vault_name +# credential_key_vault_resource_group = local.dev_printit-itn_key_vault_resource_group +# managed_identity_resource_group_name = local.dev_identity_rg_name +# +# variables = merge( +# var.tlscert-printit-itn-internal-prod-platform-pagopa-it.pipeline.variables, +# local.tlscert-printit-itn-internal-prod-platform-pagopa-it-variables, +# ) +# +# variables_secret = merge( +# var.tlscert-printit-itn-internal-prod-platform-pagopa-it.pipeline.variables_secret, +# local.tlscert-printit-itn-internal-prod-platform-pagopa-it-variables_secret, +# ) +# +# service_connection_ids_authorization = [ +# module.PROD-PRINTIT-TLS-CERT-SERVICE-CONN.service_endpoint_id, +# ] +# +# schedules = { +# days_to_build = ["Fri"] +# schedule_only_with_changes = false +# start_hours = 3 +# start_minutes = 0 +# time_zone = "(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna" +# branch_filter = { +# include = ["master"] +# exclude = [] +# } +# } +#} diff --git a/azure-devops/printit/05_tlscert-printit-itn-internal-uat-platform-pagopa-it.tf b/azure-devops/printit/05_tlscert-printit-itn-internal-uat-platform-pagopa-it.tf new file mode 100644 index 00000000..b63abb23 --- /dev/null +++ b/azure-devops/printit/05_tlscert-printit-itn-internal-uat-platform-pagopa-it.tf @@ -0,0 +1,90 @@ +#variable "tlscert-printit-itn-internal-uat-platform-pagopa-it" { +# default = { +# repository = { +# organization = "pagopa" +# name = "le-azure-acme-tiny" +# branch_name = "refs/heads/master" +# pipelines_path = "." +# } +# pipeline = { +# enable_tls_cert = true +# path = "TLS-Certificates\\DEV" +# dns_record_name = "printit.itn.internal" +# dns_zone_name = "dev.platform.pagopa.it" +# dns_zone_resource_group = "pagopa-u-itn-printit-sec-rg" +# # common variables to all pipelines +# variables = { +# CERT_NAME_EXPIRE_SECONDS = "2592000" #30 days +# KEY_VAULT_NAME = "pagopa-u-itn-printit-kv" +# } +# # common secret variables to all pipelines +# variables_secret = { +# } +# } +# } +#} +# +#locals { +# tlscert-printit-itn-internal-uat-platform-pagopa-it = { +# tenant_id = data.azurerm_client_config.current.tenant_id +# subscription_name = "UAT-PAGOPA" +# subscription_id = data.azurerm_subscriptions.dev.subscriptions[0].subscription_id +# } +# tlscert-printit-itn-internal-uat-platform-pagopa-it-variables = { +# KEY_VAULT_SERVICE_CONNECTION = module.UAT-PRINTIT-TLS-CERT-SERVICE-CONN.service_endpoint_name +# } +# tlscert-printit-itn-internal-uat-platform-pagopa-it-variables_secret = { +# } +#} +# +#module "tlscert-printit-itn-internal-uat-platform-pagopa-it-cert_az" { +# +# providers = { +# azurerm = azurerm.dev +# } +# +# source = "git::https://github.com/pagopa/azuredevops-tf-modules.git//azuredevops_build_definition_tls_cert_federated?ref=v7.1.0" +# count = var.tlscert-printit-itn-internal-uat-platform-pagopa-it.pipeline.enable_tls_cert == true ? 1 : 0 +# +# project_id = data.azuredevops_project.project.id +# repository = var.tlscert-printit-itn-internal-uat-platform-pagopa-it.repository +# path = var.tlscert-printit-itn-internal-uat-platform-pagopa-it.pipeline.path +# github_service_connection_id = data.azuredevops_serviceendpoint_github.github_ro.id +# +# dns_record_name = var.tlscert-printit-itn-internal-uat-platform-pagopa-it.pipeline.dns_record_name +# dns_zone_name = var.tlscert-printit-itn-internal-uat-platform-pagopa-it.pipeline.dns_zone_name +# dns_zone_resource_group = var.tlscert-printit-itn-internal-uat-platform-pagopa-it.pipeline.dns_zone_resource_group +# tenant_id = local.tlscert-printit-itn-internal-uat-platform-pagopa-it.tenant_id +# subscription_name = local.tlscert-printit-itn-internal-uat-platform-pagopa-it.subscription_name +# subscription_id = local.tlscert-printit-itn-internal-uat-platform-pagopa-it.subscription_id +# location = local.location_westeurope +# credential_key_vault_name = local.dev_printit_key_vault_name +# credential_key_vault_resource_group = local.dev_printit_key_vault_resource_group +# managed_identity_resource_group_name = local.dev_identity_rg_name +# +# variables = merge( +# var.tlscert-printit-itn-internal-uat-platform-pagopa-it.pipeline.variables, +# local.tlscert-printit-itn-internal-uat-platform-pagopa-it-variables, +# ) +# +# variables_secret = merge( +# var.tlscert-printit-itn-internal-uat-platform-pagopa-it.pipeline.variables_secret, +# local.tlscert-printit-itn-internal-uat-platform-pagopa-it-variables_secret, +# ) +# +# service_connection_ids_authorization = [ +# module.UAT-PRINTIT-TLS-CERT-SERVICE-CONN.service_endpoint_id, +# ] +# +# schedules = { +# days_to_build = ["Fri"] +# schedule_only_with_changes = false +# start_hours = 3 +# start_minutes = 0 +# time_zone = "(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna" +# branch_filter = { +# include = ["master"] +# exclude = [] +# } +# } +#} diff --git a/azure-devops/printit/99_main.tf b/azure-devops/printit/99_main.tf new file mode 100644 index 00000000..d55ad5c4 --- /dev/null +++ b/azure-devops/printit/99_main.tf @@ -0,0 +1,52 @@ +terraform { + required_version = ">= 1.3.5" + required_providers { + azuredevops = { + source = "microsoft/azuredevops" + version = "<= 0.11.0" + } + azurerm = { + version = "<= 3.85.0" + } + time = { + version = ">= 0.7.0, < 0.8.0" + } + } + backend "azurerm" {} +} + +data "azurerm_client_config" "current" {} + +provider "azurerm" { + features {} +} + +provider "azurerm" { + features { + key_vault { + purge_soft_delete_on_destroy = false + } + } + alias = "dev" + subscription_id = data.azurerm_subscriptions.dev.subscriptions[0].subscription_id +} + +provider "azurerm" { + features { + key_vault { + purge_soft_delete_on_destroy = false + } + } + alias = "uat" + subscription_id = data.azurerm_subscriptions.uat.subscriptions[0].subscription_id +} + +provider "azurerm" { + features { + key_vault { + purge_soft_delete_on_destroy = false + } + } + alias = "prod" + subscription_id = data.azurerm_subscriptions.prod.subscriptions[0].subscription_id +} diff --git a/azure-devops/printit/99_variables.tf b/azure-devops/printit/99_variables.tf new file mode 100644 index 00000000..c3c85c84 --- /dev/null +++ b/azure-devops/printit/99_variables.tf @@ -0,0 +1,125 @@ +locals { + prefix = "pagopa" + azure_devops_org = "pagopaspa" + domain = "printit" + + dev_subscription_name = "dev-pagopa" + uat_subscription_name = "uat-pagopa" + prod_subscription_name = "prod-pagopa" + + dev_identity_rg_name = "pagopa-d-identity-rg" + uat_identity_rg_name = "pagopa-u-identity-rg" + prod_identity_rg_name = "pagopa-p-identity-rg" + + location = "italynorth" + location_westeurope = "westeurope" + location_short = "itn" + + # 🔐 KV + dev_key_vault_azdo_name = "${local.prefix}-d-azdo-weu-kv" + uat_key_vault_azdo_name = "${local.prefix}-u-azdo-weu-kv" + prod_key_vault_azdo_name = "${local.prefix}-p-azdo-weu-kv" + + dev_printit_key_vault_name = "${local.prefix}-d-${local.location_short}-${local.domain}-kv" + uat_printit_key_vault_name = "${local.prefix}-u-${local.location_short}-${local.domain}-kv" + prod_printit_key_vault_name = "${local.prefix}-p-${local.location_short}-${local.domain}-kv" + + dev_key_vault_resource_group = "${local.prefix}-d-sec-rg" + uat_key_vault_resource_group = "${local.prefix}-u-sec-rg" + prod_key_vault_resource_group = "${local.prefix}-p-sec-rg" + + dev_printit_key_vault_resource_group = "${local.prefix}-d-${local.location_short}-${local.domain}-sec-rg" + uat_printit_key_vault_resource_group = "${local.prefix}-u-${local.location_short}-${local.domain}-sec-rg" + prod_printit_key_vault_resource_group = "${local.prefix}-p-${local.location_short}-${local.domain}-sec-rg" + + # ☁️ VNET + dev_vnet_rg = "${local.prefix}-d-vnet-rg" + uat_vnet_rg = "${local.prefix}-u-vnet-rg" + prod_vnet_rg = "${local.prefix}-p-vnet-rg" + + # 📦 ACR DEV FOR AKS + srv_endpoint_name_aks_cr_dev = "${local.prefix}-aks-cr-dev" + aks_cr_rg_name_dev = "${local.prefix}-d-container-registry-rg" + aks_cr_name_dev = "${local.prefix}dcommonacr" + + # 📦 ACR UAT FOR AKS + srv_endpoint_name_aks_cr_uat = "${local.prefix}-aks-cr-uat" + aks_cr_rg_name_uat = "${local.prefix}-u-container-registry-rg" + aks_cr_name_uat = "${local.prefix}ucommonacr" + + # 📦 ACR PROD FOR AKS + srv_endpoint_name_aks_cr_prod = "${local.prefix}-aks-cr-prod" + aks_cr_rg_name_prod = "${local.prefix}-p-container-registry-rg" + aks_cr_name_prod = "${local.prefix}pcommonacr" + + settings_xml_ro_secure_file_name = "settings-ro.xml" + + srv_endpoint_name_aks_dev = "${local.prefix}-${local.domain}-aks-dev" + srv_endpoint_name_aks_uat = "${local.prefix}-${local.domain}-aks-uat" + srv_endpoint_name_aks_prod = "${local.prefix}-${local.domain}-aks-prod" + + # TODO azure devops terraform provider does not support SonarCloud service endpoint + azuredevops_serviceendpoint_sonarcloud_id = "9182be64-d387-465d-9acc-e79e802910c8" +} + + +variable "dev_subscription_name" { + type = string + description = "DEV Subscription name" +} + +variable "uat_subscription_name" { + type = string + description = "UAT Subscription name" +} + +variable "prod_subscription_name" { + type = string + description = "PROD Subscription name" +} + +variable "project_name" { + type = string + description = "Project name (e.g. pagoPA platform)" +} + +variable "pipeline_environments" { + type = list(any) + description = "List of environments pipeline to create" +} + +# +# AZURERM +# +variable "service_connection_dev_azurerm_name" { + type = string + description = "Azurerm service connection DEV name" +} + +variable "service_connection_uat_azurerm_name" { + type = string + description = "Azurerm service connection UAT name" +} + +variable "service_connection_prod_azurerm_name" { + type = string + description = "Azurerm service connection PROD name" +} + +# +# ACR +# +variable "service_connection_dev_acr_name" { + type = string + description = "ACR service connection DEV name" +} + +variable "service_connection_uat_acr_name" { + type = string + description = "ACR service connection UAT name" +} + +variable "service_connection_prod_acr_name" { + type = string + description = "ACR service connection PROD name" +} diff --git a/azure-devops/printit/README.md b/azure-devops/printit/README.md new file mode 100644 index 00000000..35e1947d --- /dev/null +++ b/azure-devops/printit/README.md @@ -0,0 +1,63 @@ +# printit + + + + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.3.5 | +| [azuredevops](#requirement\_azuredevops) | <= 0.11.0 | +| [azurerm](#requirement\_azurerm) | <= 3.85.0 | +| [time](#requirement\_time) | >= 0.7.0, < 0.8.0 | + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [DEV-PRINTIT-TLS-CERT-SERVICE-CONN](#module\_DEV-PRINTIT-TLS-CERT-SERVICE-CONN) | git::https://github.com/pagopa/azuredevops-tf-modules.git//azuredevops_serviceendpoint_federated | v7.1.0 | +| [letsencrypt\_dev](#module\_letsencrypt\_dev) | git::https://github.com/pagopa/terraform-azurerm-v3.git//letsencrypt_credential | v7.1.0 | +| [printit\_dev\_secrets](#module\_printit\_dev\_secrets) | git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault_secrets_query | v7.67.1 | +| [secrets](#module\_secrets) | git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault_secrets_query | v7.67.1 | +| [tlscert-printit-itn-internal-dev-platform-pagopa-it-cert\_az](#module\_tlscert-printit-itn-internal-dev-platform-pagopa-it-cert\_az) | git::https://github.com/pagopa/azuredevops-tf-modules.git//azuredevops_build_definition_tls_cert_federated | v7.1.0 | + +## Resources + +| Name | Type | +|------|------| +| [azuredevops_serviceendpoint_kubernetes.aks_dev](https://registry.terraform.io/providers/microsoft/azuredevops/latest/docs/resources/serviceendpoint_kubernetes) | resource | +| [azurerm_key_vault_access_policy.DEV-PRINTIT-TLS-CERT-SERVICE-CONN_kv_access_policy](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_access_policy) | resource | +| [azuredevops_project.project](https://registry.terraform.io/providers/microsoft/azuredevops/latest/docs/data-sources/project) | data source | +| [azuredevops_serviceendpoint_azurecr.dev](https://registry.terraform.io/providers/microsoft/azuredevops/latest/docs/data-sources/serviceendpoint_azurecr) | data source | +| [azuredevops_serviceendpoint_azurerm.dev](https://registry.terraform.io/providers/microsoft/azuredevops/latest/docs/data-sources/serviceendpoint_azurerm) | data source | +| [azuredevops_serviceendpoint_github.github_pr](https://registry.terraform.io/providers/microsoft/azuredevops/latest/docs/data-sources/serviceendpoint_github) | data source | +| [azuredevops_serviceendpoint_github.github_ro](https://registry.terraform.io/providers/microsoft/azuredevops/latest/docs/data-sources/serviceendpoint_github) | data source | +| [azuredevops_serviceendpoint_github.github_rw](https://registry.terraform.io/providers/microsoft/azuredevops/latest/docs/data-sources/serviceendpoint_github) | data source | +| [azurerm_client_config.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) | data source | +| [azurerm_key_vault.domain_kv_dev](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/key_vault) | data source | +| [azurerm_subscriptions.dev](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscriptions) | data source | +| [azurerm_subscriptions.prod](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscriptions) | data source | +| [azurerm_subscriptions.uat](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscriptions) | data source | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [dev\_subscription\_name](#input\_dev\_subscription\_name) | DEV Subscription name | `string` | n/a | yes | +| [pipeline\_environments](#input\_pipeline\_environments) | List of environments pipeline to create | `list(any)` | n/a | yes | +| [prod\_subscription\_name](#input\_prod\_subscription\_name) | PROD Subscription name | `string` | n/a | yes | +| [project\_name](#input\_project\_name) | Project name (e.g. pagoPA platform) | `string` | n/a | yes | +| [service\_connection\_dev\_acr\_name](#input\_service\_connection\_dev\_acr\_name) | ACR service connection DEV name | `string` | n/a | yes | +| [service\_connection\_dev\_azurerm\_name](#input\_service\_connection\_dev\_azurerm\_name) | Azurerm service connection DEV name | `string` | n/a | yes | +| [service\_connection\_prod\_acr\_name](#input\_service\_connection\_prod\_acr\_name) | ACR service connection PROD name | `string` | n/a | yes | +| [service\_connection\_prod\_azurerm\_name](#input\_service\_connection\_prod\_azurerm\_name) | Azurerm service connection PROD name | `string` | n/a | yes | +| [service\_connection\_uat\_acr\_name](#input\_service\_connection\_uat\_acr\_name) | ACR service connection UAT name | `string` | n/a | yes | +| [service\_connection\_uat\_azurerm\_name](#input\_service\_connection\_uat\_azurerm\_name) | Azurerm service connection UAT name | `string` | n/a | yes | +| [tlscert-printit-itn-internal-dev-platform-pagopa-it](#input\_tlscert-printit-itn-internal-dev-platform-pagopa-it) | n/a | `map` |
{| no | +| [uat\_subscription\_name](#input\_uat\_subscription\_name) | UAT Subscription name | `string` | n/a | yes | + +## Outputs + +No outputs. +
"pipeline": {
"dns_record_name": "printit.itn.internal",
"dns_zone_name": "dev.platform.pagopa.it",
"dns_zone_resource_group": "pagopa-d-vnet-rg",
"enable_tls_cert": true,
"path": "TLS-Certificates\\DEV",
"variables": {
"CERT_NAME_EXPIRE_SECONDS": "2592000",
"KEY_VAULT_NAME": "pagopa-d-itn-printit-kv"
},
"variables_secret": {}
},
"repository": {
"branch_name": "refs/heads/master",
"name": "le-azure-acme-tiny",
"organization": "pagopa",
"pipelines_path": "."
}
}