feat: [PPANTT-190] infra ebollo

src/domains/ebollo-app/00_alerts.tf

@@ -0,0 +1,143 @@
+## MBD Service ##
+
+resource "azurerm_monitor_scheduled_query_rules_alert" "pagopa-mbd-service-get-mbd-responsetime-upd" {
+  count               = var.env_short == "p" ? 1 : 0
+  resource_group_name = "dashboards"
+  name                = "pagopa-${var.env_short}-pagopa-ebollo-mbd-service-get-mbd-rest-responsetime @ _pagopa-mbd-service"
+  location            = var.location
+
+  action {
+    action_group           = can(data.azurerm_monitor_action_group.opsgenie[0]) ? [data.azurerm_monitor_action_group.email.id, data.azurerm_monitor_action_group.slack.id, data.azurerm_monitor_action_group.opsgenie[0].id] : [data.azurerm_monitor_action_group.email.id, data.azurerm_monitor_action_group.slack.id]
+    email_subject          = "Email Header"
+    custom_webhook_payload = "{}"
+  }
+
+  data_source_id = data.azurerm_api_management.apim.id
+  description    = "Response time for /mbd less than or equal to 1.5s - https://portal.azure.com/?l=en.en-us#@pagopait.onmicrosoft.com/dashboard/arm/subscriptions/b9fc9419-6097-45fe-9f74-ba0641c91912/resourcegroups/dashboards/providers/microsoft.portal/dashboards/pagopa-p-opex_pagopa-mbd-service"
+  enabled        = true
+  query = (<<-QUERY
+let threshold = 1500;
+AzureDiagnostics
+| where url_s matches regex "/mbd"
+| summarize
+    watermark=threshold,
+    duration_percentile_95=percentiles(DurationMs, 95) by bin(TimeGenerated, 5m)
+| where duration_percentile_95 > threshold
+  QUERY
+  )
+  severity    = 2
+  frequency   = 5
+  time_window = 10
+  trigger {
+    operator  = "GreaterThanOrEqual"
+    threshold = 2
+  }
+}
+
+resource "azurerm_monitor_scheduled_query_rules_alert" "pagopa-mbd-service-get-mbd-rest-availability-upd" {
+  count               = var.env_short == "p" ? 1 : 0
+  resource_group_name = "dashboards"
+  name                = "pagopa-${var.env_short}-pagopa-mbd-service-get-mbd-rest-availability @ _pagopa-mbd-service"
+  location            = var.location
+
+  action {
+    action_group           = can(data.azurerm_monitor_action_group.opsgenie[0]) ? [data.azurerm_monitor_action_group.email.id, data.azurerm_monitor_action_group.slack.id, data.azurerm_monitor_action_group.opsgenie[0].id] : [data.azurerm_monitor_action_group.email.id, data.azurerm_monitor_action_group.slack.id]
+    email_subject          = "Email Header"
+    custom_webhook_payload = "{}"
+  }
+
+  data_source_id = data.azurerm_api_management.apim.id
+  description    = "Availability for /mbd is less than or equal to 99% - https://portal.azure.com/?l=en.en-us#@pagopait.onmicrosoft.com/dashboard/arm/subscriptions/b9fc9419-6097-45fe-9f74-ba0641c91912/resourcegroups/dashboards/providers/microsoft.portal/dashboards/pagopa-p-opex_pagopa-mbd-service"
+  enabled        = true
+  query = (<<-QUERY
+let threshold = 0.99;
+AzureDiagnostics
+| where url_s matches regex "/mbd'"
+| summarize
+    Total=count(),
+    Success=count(responseCode_d < 500)
+    by bin(TimeGenerated, 5m)
+| extend availability=toreal(Success) / Total
+| where availability < threshold
+  QUERY
+  )
+  severity    = 1
+  frequency   = 5
+  time_window = 5
+  trigger {
+    operator  = "GreaterThanOrEqual"
+    threshold = 1
+  }
+}
+
+resource "azurerm_monitor_scheduled_query_rules_alert" "pagopa-mbd-service-get-mbd-payment-responsetime-upd" {
+  count               = var.env_short == "p" ? 1 : 0
+  resource_group_name = "dashboards"
+  name                = "pagopa-${var.env_short}-pagopa-ebollo-mbd-service-get-mbd-payment-rest-responsetime @ _pagopa-mbd-service"
+  location            = var.location
+
+  action {
+    action_group           = can(data.azurerm_monitor_action_group.opsgenie[0]) ? [data.azurerm_monitor_action_group.email.id, data.azurerm_monitor_action_group.slack.id, data.azurerm_monitor_action_group.opsgenie[0].id] : [data.azurerm_monitor_action_group.email.id, data.azurerm_monitor_action_group.slack.id]
+    email_subject          = "Email Header"
+    custom_webhook_payload = "{}"
+  }
+
+  data_source_id = data.azurerm_api_management.apim.id
+  description    = "Response time for /mbd-payment less than or equal to 1.5s - https://portal.azure.com/?l=en.en-us#@pagopait.onmicrosoft.com/dashboard/arm/subscriptions/b9fc9419-6097-45fe-9f74-ba0641c91912/resourcegroups/dashboards/providers/microsoft.portal/dashboards/pagopa-p-opex_pagopa-mbd-service"
+  enabled        = true
+  query = (<<-QUERY
+let threshold = 1500;
+AzureDiagnostics
+| where url_s matches regex "/mbd-payment"
+| summarize
+    watermark=threshold,
+    duration_percentile_95=percentiles(DurationMs, 95) by bin(TimeGenerated, 5m)
+| where duration_percentile_95 > threshold
+  QUERY
+  )
+  severity    = 2
+  frequency   = 5
+  time_window = 10
+  trigger {
+    operator  = "GreaterThanOrEqual"
+    threshold = 2
+  }
+}
+
+resource "azurerm_monitor_scheduled_query_rules_alert" "pagopa-mbd-service-get-mbd-payment-rest-availability-upd" {
+  count               = var.env_short == "p" ? 1 : 0
+  resource_group_name = "dashboards"
+  name                = "pagopa-${var.env_short}-pagopa-mbd-service-get-mbd-payment-rest-availability @ _pagopa-mbd-service"
+  location            = var.location
+
+  action {
+    action_group           = can(data.azurerm_monitor_action_group.opsgenie[0]) ? [data.azurerm_monitor_action_group.email.id, data.azurerm_monitor_action_group.slack.id, data.azurerm_monitor_action_group.opsgenie[0].id] : [data.azurerm_monitor_action_group.email.id, data.azurerm_monitor_action_group.slack.id]
+    email_subject          = "Email Header"
+    custom_webhook_payload = "{}"
+  }
+
+  data_source_id = data.azurerm_api_management.apim.id
+  description    = "Availability for /mbd-payment is less than or equal to 99% - https://portal.azure.com/?l=en.en-us#@pagopait.onmicrosoft.com/dashboard/arm/subscriptions/b9fc9419-6097-45fe-9f74-ba0641c91912/resourcegroups/dashboards/providers/microsoft.portal/dashboards/pagopa-p-opex_pagopa-mbd-service"
+  enabled        = true
+  query = (<<-QUERY
+let threshold = 0.99;
+AzureDiagnostics
+| where url_s matches regex "/mbd-payment'"
+| summarize
+    Total=count(),
+    Success=count(responseCode_d < 500)
+    by bin(TimeGenerated, 5m)
+| extend availability=toreal(Success) / Total
+| where availability < threshold
+  QUERY
+  )
+  severity    = 1
+  frequency   = 5
+  time_window = 5
+  trigger {
+    operator  = "GreaterThanOrEqual"
+    threshold = 1
+  }
+}
+
+

src/domains/ebollo-app/00_data.tf

@@ -0,0 +1,26 @@
+data "azurerm_api_management" "apim" {
+  name                = "${var.prefix}-${var.env_short}-apim"
+  resource_group_name = "${var.prefix}-${var.env_short}-api-rg"
+}
+
+data "azurerm_api_management_product" "apim_node_for_psp_product" {
+  product_id          = "nodo-auth"
+  api_management_name = local.pagopa_apim_name
+  resource_group_name = local.pagopa_apim_rg
+}
+
+data "azurerm_api_management_product" "apim_carts_product" {
+  product_id          = "checkout-carts"
+  api_management_name = local.pagopa_apim_name
+  resource_group_name = local.pagopa_apim_rg
+}
+
+data "azurerm_api_management_product" "apim_gpd_payments_rest" {
+  product_id          = "gpd-payments-rest-aks"
+  api_management_name = local.pagopa_apim_name
+  resource_group_name = local.pagopa_apim_rg
+}
+
+data "azurerm_resource_group" "identity_rg" {
+  name = "${local.product}-identity-rg"
+}

src/domains/ebollo-app/00_keyvault.tf

@@ -0,0 +1,9 @@
+data "azurerm_key_vault" "kv" {
+  name                = "${local.project}-kv"
+  resource_group_name = "${local.project}-sec-rg"
+}
+
+data "azurerm_kubernetes_cluster" "aks" {
+  name                = local.aks_name
+  resource_group_name = local.aks_resource_group_name
+}

src/domains/ebollo-app/00_monitor.tf

@@ -0,0 +1,35 @@
+#
+# 🇮🇹 Monitor Italy
+#
+data "azurerm_resource_group" "monitor_italy_rg" {
+  name = var.monitor_italy_resource_group_name
+}
+
+data "azurerm_log_analytics_workspace" "log_analytics_italy" {
+  name                = var.log_analytics_italy_workspace_name
+  resource_group_name = var.log_analytics_italy_workspace_resource_group_name
+}
+
+data "azurerm_application_insights" "application_insights_italy" {
+  name                = local.monitor_appinsights_italy_name
+  resource_group_name = data.azurerm_resource_group.monitor_italy_rg.name
+}
+
+#
+# Actions Group
+#
+data "azurerm_monitor_action_group" "slack" {
+  name                = local.monitor_action_group_slack_name
+  resource_group_name = var.monitor_italy_resource_group_name
+}
+
+data "azurerm_monitor_action_group" "email" {
+  resource_group_name = var.monitor_italy_resource_group_name
+  name                = local.monitor_action_group_email_name
+}
+
+data "azurerm_monitor_action_group" "opsgenie" {
+  count               = var.env_short == "p" ? 1 : 0
+  resource_group_name = var.monitor_resource_group_name
+  name                = local.monitor_action_group_opsgenie_name
+}

src/domains/ebollo-app/00_network.tf

@@ -0,0 +1,15 @@
+data "azurerm_virtual_network" "vnet" {
+  name                = local.vnet_name
+  resource_group_name = local.vnet_resource_group_name
+}
+
+data "azurerm_private_dns_zone" "internal" {
+  name                = local.internal_dns_zone_name
+  resource_group_name = local.internal_dns_zone_resource_group_name
+}
+
+data "azurerm_subnet" "apim_vnet" {
+  name                 = local.pagopa_apim_snet
+  resource_group_name  = local.pagopa_vnet_rg
+  virtual_network_name = local.pagopa_vnet_integration
+}

src/domains/ebollo-app/01_network.tf

@@ -0,0 +1,9 @@
+#--------------------------------------------------
+
+resource "azurerm_private_dns_a_record" "ingress" {
+  name                = local.ingress_hostname
+  zone_name           = data.azurerm_private_dns_zone.internal.name
+  resource_group_name = local.internal_dns_zone_resource_group_name
+  ttl                 = 3600
+  records             = [var.ingress_load_balancer_ip]
+}

src/domains/ebollo-app/02_namespace.tf

@@ -0,0 +1,20 @@
+resource "kubernetes_namespace" "namespace" {
+  metadata {
+    name = var.domain
+  }
+}
+
+module "workload_identity" {
+  source = "./.terraform/modules/__v3__/kubernetes_workload_identity_configuration"
+
+  workload_identity_name_prefix         = var.domain
+  workload_identity_resource_group_name = data.azurerm_kubernetes_cluster.aks.resource_group_name
+  aks_name                              = data.azurerm_kubernetes_cluster.aks.name
+  aks_resource_group_name               = data.azurerm_kubernetes_cluster.aks.resource_group_name
+  namespace                             = var.domain
+
+  key_vault_id                      = data.azurerm_key_vault.kv.id
+  key_vault_certificate_permissions = ["Get"]
+  key_vault_key_permissions         = ["Get"]
+  key_vault_secret_permissions      = ["Get"]
+}