Merge pull request #64 from pagopa/PIDM-487

FedericoRuzzier · web-flow · commit 21894c1d2378 · 2025-05-22T13:01:04.000+02:00
chore: deploy with wl identity
diff --git a/.github/workflows/deploy_with_github_runner.yml b/.github/workflows/deploy_with_github_runner.yml
@@ -7,6 +7,10 @@ on:
         required: true
         description: The name of the environment where to deploy
         type: string
+      branch:
+        required: false
+        default: ${{ github.ref_name }}
+        type: string
 
 env:
   APP_NAME: apiconfig-selfcare-integration
@@ -17,37 +21,15 @@ permissions:
   contents: read
 
 jobs:
-  create_runner:
-    name: Create Runner
-    runs-on: ubuntu-22.04
-    environment:
-      name: ${{ inputs.environment }}
-    outputs:
-      runner_name: ${{ steps.create_github_runner.outputs.runner_name }}
-    steps:
-      - name: Create GitHub Runner
-        id: create_github_runner
-        # from https://github.com/pagopa/eng-github-actions-iac-template/tree/main/azure/github-self-hosted-runner-azure-create-action
-        uses: pagopa/eng-github-actions-iac-template/azure/github-self-hosted-runner-azure-create-action@main
-        with:
-          client_id: ${{ secrets.CLIENT_ID }}
-          tenant_id: ${{ secrets.TENANT_ID }}
-          subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
-          container_app_environment_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_NAME }}
-          resource_group_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_RESOURCE_GROUP_NAME }} # RG of the runner
-          pat_token: ${{ secrets.BOT_TOKEN_GITHUB }}
-          self_hosted_runner_image_tag: "latest"
-
   deploy:
-    needs: [ create_runner ]
-    runs-on: [ self-hosted, "${{ needs.create_runner.outputs.runner_name }}" ]
+    runs-on: [ self-hosted-job, "${{ inputs.environment }}" ]
     name: Deploy on AKS
     environment: ${{ inputs.environment }}
     steps:
       - name: Deploy
         uses: pagopa/github-actions-template/aks-deploy@main
         with:
-          branch: ${{ github.ref_name }}
+          branch: ${{ inputs.branch }}
           client_id: ${{ secrets.CLIENT_ID }}
           subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
           tenant_id: ${{ secrets.TENANT_ID }}
@@ -56,27 +38,8 @@ jobs:
           cluster_name: ${{ vars.CLUSTER_NAME }}
           resource_group: ${{ vars.CLUSTER_RESOURCE_GROUP }}
           app_name: ${{ env.APP_NAME }}
-          helm_upgrade_options: "--debug"
-          timeout: "10m0s"
-
-  cleanup_runner:
-    name: Cleanup Runner
-    needs: [ create_runner, deploy ]
-    if: ${{ success() || failure() }}
-    runs-on: ubuntu-22.04
-    environment: ${{ inputs.environment }}
-    steps:
-      - name: Cleanup GitHub Runner
-        id: cleanup_github_runner
-        # from https://github.com/pagopa/eng-github-actions-iac-template/tree/main/azure/github-self-hosted-runner-azure-cleanup-action
-        uses: pagopa/eng-github-actions-iac-template/azure/github-self-hosted-runner-azure-cleanup-action@0ee2f58fd46d10ac7f00bce4304b98db3dbdbe9a
-        with:
-          client_id: ${{ secrets.CLIENT_ID }}
-          tenant_id: ${{ secrets.TENANT_ID }}
-          subscription_id: ${{ secrets.SUBSCRIPTION_ID }}
-          resource_group_name: ${{ vars.CONTAINER_APP_ENVIRONMENT_RESOURCE_GROUP_NAME }}
-          runner_name: ${{ needs.create_runner.outputs.runner_name }}
-          pat_token: ${{ secrets.BOT_TOKEN_GITHUB }}
+          helm_upgrade_options: "--debug --set microservice-chart.azure.workloadIdentityClientId=${{vars.WORKLOAD_IDENTITY_ID}} --set postgresql.azure.workloadIdentityClientId=${{vars.WORKLOAD_IDENTITY_ID}}"
+          timeout: "15m0s"
 
   update_openapi:
     needs: [ deploy ]
diff --git a/.github/workflows/release_deploy.yml b/.github/workflows/release_deploy.yml
@@ -3,6 +3,8 @@ name: Release And Deploy
 # Controls when the workflow will run
 on:
   pull_request:
+    branches:
+      - main
     types: [ closed ]
 
   # Allows you to run this workflow manually from the Actions tab
@@ -21,7 +23,7 @@ on:
         type: choice
         description: Select the version
         options:
-          - ''
+          - patch
           - skip_or_promote
           - new_release
           - breaking_change
diff --git a/.identity/.terraform.lock.hcl b/.identity/.terraform.lock.hcl
diff --git a/.identity/00_data.tf b/.identity/00_data.tf
@@ -56,3 +56,13 @@ data "azurerm_key_vault_secret" "key_vault_read_package_token" {
   key_vault_id = data.azurerm_key_vault.key_vault.id
 }
 
+data "azurerm_user_assigned_identity" "workload_identity_clientid" {
+  name                = "apiconfig-workload-identity"
+  resource_group_name = "pagopa-${var.env_short}-${local.location_short}-${var.env}-aks-rg"
+}
+
+data "azurerm_user_assigned_identity" "identity_cd_01" {
+  resource_group_name = "${local.product}-identity-rg"
+  name                = "${local.product}-${local.domain}-job-01-github-cd-identity"
+}
+
diff --git a/.identity/03_github_environment.tf b/.identity/03_github_environment.tf
@@ -21,7 +21,7 @@ resource "github_repository_environment" "github_repository_environment" {
 
 locals {
   env_secrets = {
-    "CLIENT_ID" : module.github_runner_app.application_id,
+    "CLIENT_ID" : data.azurerm_user_assigned_identity.identity_cd_01.client_id,
     "TENANT_ID" : data.azurerm_client_config.current.tenant_id,
     "SUBSCRIPTION_ID" : data.azurerm_subscription.current.subscription_id,
   }
@@ -32,6 +32,7 @@ locals {
     "CLUSTER_RESOURCE_GROUP" : local.aks_cluster.resource_group_name,
     "DOMAIN" : local.domain,
     "NAMESPACE" : local.domain,
+    "WORKLOAD_IDENTITY_ID": data.azurerm_user_assigned_identity.workload_identity_clientid.client_id
   }
 }
 
diff --git a/.identity/99_main.tf b/.identity/99_main.tf
@@ -4,11 +4,11 @@ terraform {
   required_providers {
     azuread = {
       source  = "hashicorp/azuread"
-      version = "2.30.0"
+      version = "~> 2.53"
     }
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "3.45.0"
+      version = "~> 3.117"
     }
     github = {
       source  = "integrations/github"
diff --git a/helm/Chart.yaml b/helm/Chart.yaml
@@ -2,11 +2,11 @@ apiVersion: v2
 name: pagopa-api-config-selfcare-integration
 description: Microservice that manages requests from selfcare
 type: application
-version: 1.102.0
-appVersion: 1.12.5
+version: 1.103.0
+appVersion: 1.12.5-1-PIDM-487
 dependencies:
   - name: microservice-chart
-    version: 2.8.0
+    version: 7.5.0
     repository: "https://pagopa.github.io/aks-microservice-chart-blueprint"
     alias: postgresql
     condition: postgresql.enabled
diff --git a/helm/values-dev.yaml b/helm/values-dev.yaml
@@ -27,7 +27,7 @@ microservice-chart: &microservice-chart
       envSecret: {}
   image:
     repository: ghcr.io/pagopa/pagopa-api-config-selfcare-integration
-    tag: "1.12.5"
+    tag: "1.12.5-1-PIDM-487"
     pullPolicy: Always
   livenessProbe:
     httpGet:
@@ -45,6 +45,7 @@ microservice-chart: &microservice-chart
     periodSeconds: 10
   deployment:
     create: true
+    replicas: 1
   serviceMonitor:
     create: true
     endpoints:
@@ -64,9 +65,9 @@ microservice-chart: &microservice-chart
     host: "weudev.apiconfig.internal.dev.platform.pagopa.it"
     servicePort: 8080
   serviceAccount:
-    create: false
-    annotations: {}
-    name: ""
+    name: "apiconfig-workload-identity"
+  azure:
+    workloadIdentityClientId: <workload-identity-client-id-set-automatically-by-gha>
   podAnnotations: {}
   podSecurityContext:
     seccompProfile:
diff --git a/helm/values-prod.yaml b/helm/values-prod.yaml
@@ -27,7 +27,7 @@ microservice-chart: &microservice-chart
       envSecret: {}
   image:
     repository: ghcr.io/pagopa/pagopa-api-config-selfcare-integration
-    tag: "1.12.5"
+    tag: "1.12.5-1-PIDM-487"
     pullPolicy: Always
   livenessProbe:
     httpGet:
@@ -64,9 +64,9 @@ microservice-chart: &microservice-chart
     host: "weuprod.apiconfig.internal.platform.pagopa.it"
     servicePort: 8080
   serviceAccount:
-    create: false
-    annotations: {}
-    name: ""
+    name: "apiconfig-workload-identity"
+  azure:
+    workloadIdentityClientId: <workload-identity-client-id-set-automatically-by-gha>
   podAnnotations: {}
   podSecurityContext:
     seccompProfile:
diff --git a/helm/values-uat.yaml b/helm/values-uat.yaml
@@ -27,7 +27,7 @@ microservice-chart: &microservice-chart
       envSecret: {}
   image:
     repository: ghcr.io/pagopa/pagopa-api-config-selfcare-integration
-    tag: "1.12.5"
+    tag: "1.12.5-1-PIDM-487"
     pullPolicy: Always
   livenessProbe:
     httpGet:
@@ -45,6 +45,7 @@ microservice-chart: &microservice-chart
     periodSeconds: 10
   deployment:
     create: true
+    replicas: 1
   serviceMonitor:
     create: true
     endpoints:
@@ -64,9 +65,9 @@ microservice-chart: &microservice-chart
     host: "weuuat.apiconfig.internal.uat.platform.pagopa.it"
     servicePort: 8080
   serviceAccount:
-    create: false
-    annotations: {}
-    name: ""
+    name: "apiconfig-workload-identity"
+  azure:
+    workloadIdentityClientId: <workload-identity-client-id-set-automatically-by-gha>
   podAnnotations: {}
   podSecurityContext:
     seccompProfile:
diff --git a/openapi/openapi.json b/openapi/openapi.json
@@ -4,7 +4,7 @@
     "title": "API-Config - SelfCare Integration",
     "description": "Spring application exposes APIs for SelfCare",
     "termsOfService": "https://www.pagopa.gov.it/",
-    "version": "1.12.5"
+    "version": "1.12.5-1-PIDM-487"
   },
   "servers": [
     {
diff --git a/pom.xml b/pom.xml
@@ -12,7 +12,7 @@
 
     <groupId>it.gov.pagopa.api-config</groupId>
     <artifactId>selfcareintegration</artifactId>
-    <version>1.12.5</version>
+    <version>1.12.5-1-PIDM-487</version>
     <name>API-Config - SelfCare Integration</name>
     <description>Spring application exposes APIs for SelfCare</description>
 

Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,7 @@ resource "github_repository_environment" "github_repository_environment" {`
`21`	`21`
`22`	`22`	`locals {`
`23`	`23`	`env_secrets = {`
`24`		`- "CLIENT_ID" : module.github_runner_app.application_id,`
	`24`	`+ "CLIENT_ID" : data.azurerm_user_assigned_identity.identity_cd_01.client_id,`
`25`	`25`	`"TENANT_ID" : data.azurerm_client_config.current.tenant_id,`
`26`	`26`	`"SUBSCRIPTION_ID" : data.azurerm_subscription.current.subscription_id,`
`27`	`27`	`}`
`@@ -32,6 +32,7 @@ locals {`
`32`	`32`	`"CLUSTER_RESOURCE_GROUP" : local.aks_cluster.resource_group_name,`
`33`	`33`	`"DOMAIN" : local.domain,`
`34`	`34`	`"NAMESPACE" : local.domain,`
	`35`	`+ "WORKLOAD_IDENTITY_ID": data.azurerm_user_assigned_identity.workload_identity_clientid.client_id`
`35`	`36`	`}`
`36`	`37`	`}`
`37`	`38`
Original file line number	Diff line number	Diff line change
`@@ -4,11 +4,11 @@ terraform {`
`4`	`4`	`required_providers {`
`5`	`5`	`azuread = {`
`6`	`6`	`source = "hashicorp/azuread"`
`7`		`- version = "2.30.0"`
	`7`	`+ version = "~> 2.53"`
`8`	`8`	`}`
`9`	`9`	`azurerm = {`
`10`	`10`	`source = "hashicorp/azurerm"`
`11`		`- version = "3.45.0"`
	`11`	`+ version = "~> 3.117"`
`12`	`12`	`}`
`13`	`13`	`github = {`
`14`	`14`	`source = "integrations/github"`