Skip to content

Commit bde111b

Browse files
Krusty93Krusty93
committed
add fixtures
1 parent b683caa commit bde111b

File tree

7 files changed

+305
-10
lines changed

7 files changed

+305
-10
lines changed

‎infra/modules/azure_app_configuration/examples/network_access/README.md‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,23 +7,40 @@
77
|------|---------|
88
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.13.0 |
99
| <a name="requirement_azurerm"></a> [azurerm](#requirement\_azurerm) | ~> 4.0 |
10-
| <a name="requirement_pagopa-dx"></a> [pagopa-dx](#requirement\_pagopa-dx) | ~> 0.8 |
10+
| <a name="requirement_dx"></a> [dx](#requirement\_dx) | ~> 0.8 |
1111
| <a name="requirement_random"></a> [random](#requirement\_random) | ~> 3.7 |
1212

1313
## Modules
1414

1515
| Name | Source | Version |
1616
|------|--------|---------|
17-
| <a name="module_private_appcs"></a> [private\_appcs](#module\_private\_appcs) | pagopa-dx/azure-app-configuration/azurerm | ~> 0.0 |
17+
| <a name="module_integration_github_roles"></a> [integration\_github\_roles](#module\_integration\_github\_roles) | pagopa-dx/azure-role-assignments/azurerm | ~> 1.0 |
18+
| <a name="module_private_appcs"></a> [private\_appcs](#module\_private\_appcs) | ../../ | n/a |
19+
| <a name="module_role_appcs_private"></a> [role\_appcs\_private](#module\_role\_appcs\_private) | pagopa-dx/azure-role-assignments/azurerm | ~> 1.0 |
20+
| <a name="module_role_appcs_public"></a> [role\_appcs\_public](#module\_role\_appcs\_public) | pagopa-dx/azure-role-assignments/azurerm | ~> 1.0 |
1821

1922
## Resources
2023

2124
| Name | Type |
2225
|------|------|
26+
| [azurerm_app_configuration_key.test_secret](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_configuration_key) | resource |
27+
| [azurerm_app_configuration_key.test_setting](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_configuration_key) | resource |
28+
| [azurerm_container_group.private_app](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/container_group) | resource |
29+
| [azurerm_container_group.public_app](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/container_group) | resource |
30+
| [azurerm_key_vault.kv](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault) | resource |
31+
| [azurerm_key_vault_secret.test_secret](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |
32+
| [azurerm_private_endpoint.kv](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint) | resource |
2333
| [azurerm_resource_group.e2e_appcs](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) | resource |
34+
| [azurerm_subnet.private_app](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet) | resource |
35+
| [dx_available_subnet_cidr.private_app](https://registry.terraform.io/providers/pagopa-dx/azure/latest/docs/resources/available_subnet_cidr) | resource |
2436
| [random_integer.appcs_instance](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/integer) | resource |
37+
| [azurerm_client_config.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) | data source |
38+
| [azurerm_log_analytics_workspace.e2e](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/log_analytics_workspace) | data source |
39+
| [azurerm_private_dns_zone.kv](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/private_dns_zone) | data source |
2540
| [azurerm_resource_group.network](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/resource_group) | data source |
2641
| [azurerm_subnet.pep](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subnet) | data source |
42+
| [azurerm_subscription.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscription) | data source |
43+
| [azurerm_user_assigned_identity.integration_github](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/user_assigned_identity) | data source |
2744
| [azurerm_virtual_network.e2e](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/virtual_network) | data source |
2845

2946
## Inputs
@@ -35,4 +52,6 @@ No inputs.
3552
| Name | Description |
3653
|------|-------------|
3754
| <a name="output_name"></a> [name](#output\_name) | n/a |
55+
| <a name="output_private_app_ip_address"></a> [private\_app\_ip\_address](#output\_private\_app\_ip\_address) | n/a |
56+
| <a name="output_public_app_ip_address"></a> [public\_app\_ip\_address](#output\_public\_app\_ip\_address) | n/a |
3857
<!-- END_TF_DOCS -->

‎infra/modules/azure_app_configuration/examples/network_access/data.tf‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,28 @@
1+
data "azurerm_client_config" "current" {}
2+
3+
data "azurerm_subscription" "current" {}
4+
5+
data "azurerm_log_analytics_workspace" "e2e" {
6+
name = local.e2e_log_analytics_workspace.name
7+
resource_group_name = local.e2e_virtual_network.resource_group_name
8+
}
9+
10+
data "azurerm_private_dns_zone" "kv" {
11+
name = "privatelink.vaultcore.azure.net"
12+
resource_group_name = data.azurerm_resource_group.network.name
13+
}
14+
15+
data "azurerm_user_assigned_identity" "integration_github" {
16+
name = "dx-d-itn-devex-integration-id-01"
17+
resource_group_name = "dx-d-itn-devex-rg-01"
18+
}
119
data "azurerm_virtual_network" "e2e" {
220
name = local.e2e_virtual_network.name
321
resource_group_name = local.e2e_virtual_network.resource_group_name
422
}
523

624
data "azurerm_subnet" "pep" {
7-
name = provider::pagopa-dx::resource_name(merge(local.naming_config, {
25+
name = provider::dx::resource_name(merge(local.naming_config, {
826
name = "pep",
927
resource_type = "subnet"
1028
}))
@@ -13,7 +31,7 @@ data "azurerm_subnet" "pep" {
1331
}
1432

1533
data "azurerm_resource_group" "network" {
16-
name = provider::pagopa-dx::resource_name(merge(local.naming_config, {
34+
name = provider::dx::resource_name(merge(local.naming_config, {
1735
name = "network"
1836
resource_type = "resource_group"
1937
}))

‎infra/modules/azure_app_configuration/examples/network_access/fixtures.tf‎

Lines changed: 215 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
resource "azurerm_resource_group" "e2e_appcs" {
2-
name = provider::pagopa-dx::resource_name(merge(local.naming_config, {
2+
name = provider::dx::resource_name(merge(local.naming_config, {
33
domain = "e2e"
44
name = "appcs",
55
resource_type = "resource_group"
@@ -8,3 +8,217 @@ resource "azurerm_resource_group" "e2e_appcs" {
88

99
tags = local.tags
1010
}
11+
12+
resource "azurerm_container_group" "public_app" {
13+
name = provider::dx::resource_name(
14+
merge(local.naming_config, { name = "appcs-public", resource_type = "container_instance" })
15+
)
16+
location = local.environment.location
17+
resource_group_name = azurerm_resource_group.e2e_appcs.name
18+
19+
identity { type = "SystemAssigned" }
20+
21+
os_type = "Linux"
22+
23+
container {
24+
name = "network-access"
25+
image = local.docker_image
26+
cpu = "0.5"
27+
memory = "1.5"
28+
ports {
29+
port = 8080
30+
}
31+
}
32+
33+
diagnostics {
34+
log_analytics {
35+
workspace_id = data.azurerm_log_analytics_workspace.e2e.workspace_id
36+
workspace_key = data.azurerm_log_analytics_workspace.e2e.primary_shared_key
37+
}
38+
}
39+
40+
tags = local.tags
41+
}
42+
43+
resource "dx_available_subnet_cidr" "private_app" {
44+
virtual_network_id = data.azurerm_virtual_network.e2e.id
45+
prefix_length = 26
46+
}
47+
48+
resource "azurerm_subnet" "private_app" {
49+
name = provider::dx::resource_name(merge(local.naming_config, {
50+
name = "appcs-private",
51+
resource_type = "container_instance_subnet"
52+
}))
53+
resource_group_name = local.e2e_virtual_network.resource_group_name
54+
virtual_network_name = local.e2e_virtual_network.name
55+
address_prefixes = [dx_available_subnet_cidr.private_app.cidr_block]
56+
57+
delegation {
58+
name = "Microsoft.ContainerInstance/containerGroups"
59+
60+
service_delegation {
61+
name = "Microsoft.ContainerInstance/containerGroups"
62+
actions = [
63+
"Microsoft.Network/virtualNetworks/subnets/action",
64+
]
65+
}
66+
}
67+
}
68+
69+
resource "azurerm_container_group" "private_app" {
70+
name = provider::dx::resource_name(
71+
merge(local.naming_config, { name = "appcs-private", resource_type = "container_instance" })
72+
)
73+
location = local.environment.location
74+
resource_group_name = azurerm_resource_group.e2e_appcs.name
75+
76+
identity { type = "SystemAssigned" }
77+
78+
os_type = "Linux"
79+
80+
container {
81+
name = "network-access"
82+
image = local.docker_image
83+
cpu = "0.5"
84+
memory = "1.5"
85+
ports {
86+
port = 8080
87+
}
88+
}
89+
90+
ip_address_type = "Private"
91+
92+
subnet_ids = [
93+
azurerm_subnet.private_app.id
94+
]
95+
96+
diagnostics {
97+
log_analytics {
98+
workspace_id = data.azurerm_log_analytics_workspace.e2e.workspace_id
99+
workspace_key = data.azurerm_log_analytics_workspace.e2e.primary_shared_key
100+
}
101+
}
102+
103+
tags = local.tags
104+
}
105+
106+
#trivy:ignore:AVD-AZU-0016
107+
resource "azurerm_key_vault" "kv" {
108+
name = provider::dx::resource_name(merge(local.naming_config, { resource_type = "key_vault", instance_number = random_integer.appcs_instance.result }))
109+
location = azurerm_resource_group.e2e_appcs.location
110+
resource_group_name = azurerm_resource_group.e2e_appcs.name
111+
tenant_id = data.azurerm_client_config.current.tenant_id
112+
rbac_authorization_enabled = true
113+
sku_name = "standard"
114+
purge_protection_enabled = false
115+
public_network_access_enabled = false
116+
117+
network_acls {
118+
bypass = "AzureServices"
119+
default_action = "Deny"
120+
}
121+
122+
tags = local.tags
123+
}
124+
125+
#trivy:ignore:AVD-AZU-0015
126+
#trivy:ignore:AVD-AZU-0017
127+
resource "azurerm_key_vault_secret" "test_secret" {
128+
name = "secret-key"
129+
key_vault_id = azurerm_key_vault.kv.id
130+
value = "secret-value"
131+
132+
depends_on = [
133+
module.integration_github_roles
134+
]
135+
}
136+
137+
resource "azurerm_private_endpoint" "kv" {
138+
name = provider::dx::resource_name(merge(local.naming_config, { resource_type = "key_vault_private_endpoint", instance_number = random_integer.appcs_instance.result }))
139+
location = azurerm_resource_group.e2e_appcs.location
140+
resource_group_name = azurerm_resource_group.e2e_appcs.name
141+
subnet_id = data.azurerm_subnet.pep.id
142+
143+
private_service_connection {
144+
name = provider::dx::resource_name(merge(local.naming_config, { resource_type = "key_vault_private_endpoint", instance_number = random_integer.appcs_instance.result }))
145+
private_connection_resource_id = azurerm_key_vault.kv.id
146+
is_manual_connection = false
147+
subresource_names = ["vault"]
148+
}
149+
150+
private_dns_zone_group {
151+
name = "private-dns-zone-group"
152+
private_dns_zone_ids = [data.azurerm_private_dns_zone.kv.id]
153+
}
154+
155+
tags = local.tags
156+
}
157+
158+
module "role_appcs_private" {
159+
source = "pagopa-dx/azure-role-assignments/azurerm"
160+
version = "~> 1.0"
161+
162+
principal_id = azurerm_container_group.private_app.identity[0].principal_id
163+
subscription_id = data.azurerm_subscription.current.subscription_id
164+
165+
app_config = [
166+
{
167+
name = module.private_appcs.name
168+
resource_group_name = module.private_appcs.resource_group_name
169+
description = "Allow private Container Instance to read from App Configuration"
170+
role = "reader"
171+
}
172+
]
173+
174+
# key_vault = {
175+
# name = module.private_keyvault.key_vault_name
176+
# resource_group_name = module.private_keyvault.resource_group_name
177+
# has_rbac_enabled = true
178+
# }
179+
}
180+
181+
module "role_appcs_public" {
182+
source = "pagopa-dx/azure-role-assignments/azurerm"
183+
version = "~> 1.0"
184+
185+
principal_id = azurerm_container_group.public_app.identity[0].principal_id
186+
subscription_id = data.azurerm_subscription.current.subscription_id
187+
188+
app_config = [
189+
{
190+
name = module.private_appcs.name
191+
resource_group_name = module.private_appcs.resource_group_name
192+
description = "Allow public Container Instance to read from App Configuration"
193+
role = "reader"
194+
}
195+
]
196+
}
197+
198+
module "integration_github_roles" {
199+
source = "pagopa-dx/azure-role-assignments/azurerm"
200+
version = "~> 1.0"
201+
202+
principal_id = data.azurerm_user_assigned_identity.integration_github.principal_id
203+
subscription_id = data.azurerm_subscription.current.subscription_id
204+
205+
app_config = [
206+
{
207+
name = module.private_appcs.name
208+
resource_group_name = module.private_appcs.resource_group_name
209+
description = "Allow GitHub to write settings on App Configuration"
210+
role = "writer"
211+
}
212+
]
213+
214+
key_vault = [
215+
{
216+
name = azurerm_key_vault.kv.name
217+
resource_group_name = azurerm_key_vault.kv.resource_group_name
218+
description = "Allow GitHub to write secrets on Key Vault"
219+
roles = {
220+
secrets = "writer"
221+
}
222+
}
223+
]
224+
}

‎infra/modules/azure_app_configuration/examples/network_access/locals.tf‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,22 @@ locals {
2626
}
2727

2828
e2e_virtual_network = {
29-
name = provider::pagopa-dx::resource_name(merge(local.naming_config, {
29+
name = provider::dx::resource_name(merge(local.naming_config, {
3030
name = "e2e",
3131
resource_type = "virtual_network"
3232
}))
33-
resource_group_name = provider::pagopa-dx::resource_name(merge(local.naming_config, {
33+
resource_group_name = provider::dx::resource_name(merge(local.naming_config, {
3434
name = "e2e",
3535
resource_type = "resource_group"
3636
}))
3737
}
38+
39+
e2e_log_analytics_workspace = {
40+
name = provider::dx::resource_name(merge(local.naming_config, {
41+
name = "e2e",
42+
resource_type = "log_analytics"
43+
}))
44+
}
45+
46+
docker_image = "ghcr.io/pagopa/e2e-appconfiguration-all-scenarios:latest"
3847
}

‎infra/modules/azure_app_configuration/examples/network_access/mut.tf‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,9 @@ resource "random_integer" "appcs_instance" {
44
}
55

66
module "private_appcs" {
7-
source = "pagopa-dx/azure-app-configuration/azurerm"
8-
version = "~> 0.0"
7+
# source = "pagopa-dx/azure-app-configuration/azurerm"
8+
# version = "~> 0.0"
9+
source = "../../"
910

1011
environment = (merge(local.environment, { instance_number = random_integer.appcs_instance.result }))
1112
resource_group_name = azurerm_resource_group.e2e_appcs.name
@@ -20,3 +21,26 @@ module "private_appcs" {
2021
private_dns_zone_resource_group_name = data.azurerm_resource_group.network.name
2122
tags = local.tags
2223
}
24+
25+
resource "azurerm_app_configuration_key" "test_setting" {
26+
configuration_store_id = module.private_appcs.id
27+
key = "Setting:test-key"
28+
value = "test value"
29+
content_type = "application/json"
30+
31+
depends_on = [
32+
module.integration_github_roles
33+
]
34+
}
35+
36+
resource "azurerm_app_configuration_key" "test_secret" {
37+
configuration_store_id = module.private_appcs.id
38+
key = "Secret:secret-key"
39+
type = "vault"
40+
vault_key_reference = azurerm_key_vault_secret.test_secret.versionless_id
41+
42+
depends_on = [
43+
module.integration_github_roles,
44+
azurerm_key_vault_secret.test_secret
45+
]
46+
}

‎infra/modules/azure_app_configuration/examples/network_access/outputs.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,11 @@
11
output "name" {
22
value = module.private_appcs.name
33
}
4+
5+
output "public_app_ip_address" {
6+
value = azurerm_container_group.public_app.ip_address
7+
}
8+
9+
output "private_app_ip_address" {
10+
value = azurerm_container_group.private_app.ip_address
11+
}

0 commit comments

Comments
 (0)