wip

.github/workflows/02_check_pr.yml

@@ -36,7 +36,7 @@ jobs:
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       - name: Verify PR Labels
-        if: ${{ !contains(github.event.pull_request.labels.*.name, 'breaking-change') && !contains(github.event.pull_request.labels.*.name, 'new-release') && !contains(github.event.pull_request.labels.*.name, 'ignore-for-release') }}
+        if: ${{ !contains(github.event.pull_request.labels.*.name, 'patch') && !contains(github.event.pull_request.labels.*.name, 'ignore-for-release') }}
         uses: actions/[email protected]
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -60,7 +60,7 @@ jobs:
               issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
-              body: 'This pull request does not contain a valid label. Please add one of the following labels: `[breaking-change, new-release, ignore-for-release]`'
+              body: 'This pull request does not contain a valid label. Please add one of the following labels: `[patch, ignore-for-release]`'
             })
             core.setFailed('Missing required labels')
 

.github/workflows/04_release_deploy.yml

@@ -94,13 +94,45 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ needs.setup.outputs.semver != 'skip' }}
     steps:
-      - name: Build and Push
-        id: semver
-        uses: pagopa/github-actions-template/[email protected]
+#      - name: Build and Push
+#        id: semver
+#        uses: pagopa/github-actions-template/[email protected]
+#        with:
+#          branch: ${{ github.ref_name}}
+#          github_token: ${{ secrets.GITHUB_TOKEN }}
+#          tag: ${{ needs.release.outputs.version }}
+      - name: Checkout
+        uses: actions/checkout@v3
         with:
-          branch: ${{ github.ref_name}}
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          tag: ${{ needs.release.outputs.version }}
+          ref: ${{ github.ref_name }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker meta
+        id: meta
+        uses: docker/[email protected]
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            latest
+            ${{ needs.release.outputs.version }}
+            type=ref,event=branch
+            type=sha
+
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          secrets: |
+            GH_TOKEN=${{ secrets.READ_PACKAGES_TOKEN }}
 
   deploy_aks:
     name: Deploy on AKS

.identity/00_data.tf

@@ -50,3 +50,14 @@ data "azurerm_key_vault_secret" "key_vault_integration_test_subkey" {
   name         = "integration-test-subkey"
   key_vault_id = data.azurerm_key_vault.key_vault.id
 }
+
+data "azurerm_key_vault_secret" "key_vault_slack_webhook_url" {
+  name         = "slack-webhook-url"
+  key_vault_id = data.azurerm_key_vault.domain_key_vault.id
+}
+
+data "azurerm_key_vault_secret" "key_vault_read_package_token" {
+
+  name = "github-token-read-packages-bot"
+  key_vault_id = data.azurerm_key_vault.key_vault.id
+}

.identity/02_application_action.tf

@@ -1,21 +1,7 @@
-module "github_runner_app" {
-  source = "git::https://github.com/pagopa/github-actions-tf-modules.git//app-github-runner-creator?ref=main"
-
-  app_name = local.app_name
-
-  subscription_id = data.azurerm_subscription.current.id
-
-  github_org              = local.github.org
-  github_repository       = local.github.repository
-  github_environment_name = var.env
-
-  container_app_github_runner_env_rg = local.container_app_environment.resource_group
-}
-
 resource "null_resource" "github_runner_app_permissions_to_namespace" {
   triggers = {
     aks_id               = data.azurerm_kubernetes_cluster.aks.id
-    service_principal_id = module.github_runner_app.client_id
+    service_principal_id = module.identity_cd.identity_client_id
     namespace            = local.domain
     version              = "v2"
   }
@@ -39,58 +25,4 @@ resource "null_resource" "github_runner_app_permissions_to_namespace" {
       --scope ${self.triggers.aks_id}/namespaces/${self.triggers.namespace}
     EOT
   }
-}
-
-resource "azurerm_role_assignment" "environment_terraform_storage_account" {
-  scope                = data.azurerm_storage_account.tf_storage_account.id
-  role_definition_name = "Contributor"
-  principal_id         = module.github_runner_app.object_id
-}
-
-resource "azurerm_role_assignment" "environment_terraform_resource_group_apim" {
-  scope                = data.azurerm_resource_group.apim_resource_group.id
-  role_definition_name = "Contributor"
-  principal_id         = module.github_runner_app.object_id
-}
-
-resource "azurerm_role_assignment" "environment_terraform_resource_group_dashboards" {
-  scope                = data.azurerm_resource_group.dashboards.id
-  role_definition_name = "Contributor"
-  principal_id         = module.github_runner_app.object_id
-}
-
-resource "azurerm_role_assignment" "environment_key_vault" {
-  scope                = data.azurerm_key_vault.key_vault.id
-  role_definition_name = "Reader"
-  principal_id         = module.github_runner_app.object_id
-}
-
-resource "azurerm_role_assignment" "environment_key_vault_domain" {
-  scope                = data.azurerm_key_vault.domain_key_vault.id
-  role_definition_name = "Reader"
-  principal_id         = module.github_runner_app.object_id
-}
-
-resource "azurerm_key_vault_access_policy" "ad_kv_group_policy" {
-  key_vault_id = data.azurerm_key_vault.key_vault.id
-
-  tenant_id = data.azurerm_client_config.current.tenant_id
-  object_id = module.github_runner_app.object_id
-
-  key_permissions         = []
-  secret_permissions      = ["Get", "List"]
-  storage_permissions     = []
-  certificate_permissions = []
-}
-
-resource "azurerm_key_vault_access_policy" "ad_domain_kv_group_policy" {
-  key_vault_id = data.azurerm_key_vault.domain_key_vault.id
-
-  tenant_id = data.azurerm_client_config.current.tenant_id
-  object_id = module.github_runner_app.object_id
-
-  key_permissions         = []
-  secret_permissions      = ["Get", "List"]
-  storage_permissions     = []
-  certificate_permissions = []
-}
+}

.identity/03_github_environment.tf

@@ -21,10 +21,9 @@ resource "github_repository_environment" "github_repository_environment" {
 
 locals {
   env_secrets = {
-    "CLIENT_ID" : module.github_runner_app.application_id,
+    "CLIENT_ID" : module.identity_cd.identity_client_id,
     "TENANT_ID" : data.azurerm_client_config.current.tenant_id,
     "SUBSCRIPTION_ID" : data.azurerm_subscription.current.subscription_id,
-    "SUBKEY" : data.azurerm_key_vault_secret.key_vault_integration_test_subkey.value,
   }
   env_variables = {
     "CONTAINER_APP_ENVIRONMENT_NAME" : local.container_app_environment.name,
@@ -33,11 +32,12 @@ locals {
     "CLUSTER_RESOURCE_GROUP" : local.aks_cluster.resource_group_name,
     "NAMESPACE" : local.domain,
   }
-  repo_secrets = {
-    "SONAR_TOKEN" : data.azurerm_key_vault_secret.key_vault_sonar.value,
-    "BOT_TOKEN_GITHUB" : data.azurerm_key_vault_secret.key_vault_bot_token.value,
-    "CUCUMBER_PUBLISH_TOKEN" : data.azurerm_key_vault_secret.key_vault_cucumber_token.value,
-  }
+#  repo_secrets = {
+#    "SONAR_TOKEN" : data.azurerm_key_vault_secret.key_vault_sonar.value,
+#    "BOT_TOKEN_GITHUB" : data.azurerm_key_vault_secret.key_vault_bot_token.value,
+#    "CUCUMBER_PUBLISH_TOKEN" : data.azurerm_key_vault_secret.key_vault_cucumber_token.value,
+#    "SLACK_WEBHOOK_URL": data.azurerm_key_vault_secret.key_vault_slack_webhook_url.value
+#  }
 }
 
 ###############
@@ -56,7 +56,6 @@ resource "github_actions_environment_secret" "github_environment_runner_secrets"
 # ENV Variables #
 #################
 
-
 resource "github_actions_environment_variable" "github_environment_runner_variables" {
   for_each      = local.env_variables
   repository    = local.github.repository
@@ -69,17 +68,41 @@ resource "github_actions_environment_variable" "github_environment_runner_variab
 # Secrets of the Repository #
 #############################
 
+#tfsec:ignore:github-actions-no-plain-text-action-secrets # not real secret
+resource "github_actions_secret" "secret_sonar_token" {
+  repository       = local.github.repository
+  secret_name      = "SONAR_TOKEN"
+  plaintext_value  = data.azurerm_key_vault_secret.key_vault_sonar.value
+}
 
-resource "github_actions_secret" "repo_secrets" {
-  for_each        = local.repo_secrets
-  repository      = local.github.repository
-  secret_name     = each.key
-  plaintext_value = each.value
+#tfsec:ignore:github-actions-no-plain-text-action-secrets # not real secret
+resource "github_actions_secret" "secret_bot_token" {
+
+  repository       = local.github.repository
+  secret_name      = "BOT_TOKEN_GITHUB"
+  plaintext_value  = data.azurerm_key_vault_secret.key_vault_bot_token.value
+}
+
+#tfsec:ignore:github-actions-no-plain-text-action-secrets # not real secret
+resource "github_actions_secret" "secret_cucumber_token" {
+
+  repository       = local.github.repository
+  secret_name      = "CUCUMBER_PUBLISH_TOKEN"
+  plaintext_value  = data.azurerm_key_vault_secret.key_vault_cucumber_token.value
+}
+
+#tfsec:ignore:github-actions-no-plain-text-action-secrets # not real secret
+resource "github_actions_secret" "secret_read_package_token" {
+
+  repository       = local.github.repository
+  secret_name      = "READ_PACKAGES_TOKEN"
+  plaintext_value  = data.azurerm_key_vault_secret.key_vault_read_package_token.value
 }
 
 ############
 ## Labels ##
 ############
+
 resource "github_issue_label" "patch" {
   repository = local.github.repository
   name       = "patch"

.identity/04_github_identity.tf

@@ -0,0 +1,28 @@
+resource "azurerm_resource_group" "identity_rg" {
+  name     = "${local.product}-identity-rg"
+  location = var.location
+
+  tags = var.tags
+}
+
+module "identity_cd" {
+  source = "github.com/pagopa/terraform-azurerm-v3//github_federated_identity?ref=v7.28.0"
+
+  prefix    = var.prefix
+  env_short = var.env_short
+
+  identity_role = "cd"
+
+  github_federations = var.cd_github_federations
+
+  cd_rbac_roles = {
+    subscription_roles = var.environment_cd_roles.subscription
+    resource_groups    = var.environment_cd_roles.resource_groups
+  }
+
+  tags = var.tags
+
+  depends_on = [
+    azurerm_resource_group.identity_rg
+  ]
+}

.identity/99_variables.tf

@@ -22,6 +22,10 @@ locals {
   }
 }
 
+variable "location" {
+  type = string
+}
+
 variable "env" {
   type = string
 }
@@ -41,6 +45,23 @@ variable "prefix" {
   }
 }
 
+variable "cd_github_federations" {
+  type = list(object({
+    repository        = string
+    credentials_scope = optional(string, "environment")
+    subject           = string
+  }))
+  description = "GitHub Organization, repository name and scope permissions"
+}
+
+variable "environment_cd_roles" {
+  type = object({
+    subscription    = list(string)
+    resource_groups = map(list(string))
+  })
+  description = "GitHub Continous Delivery roles"
+}
+
 variable "github_repository_environment" {
   type = object({
     protected_branches     = bool
@@ -54,3 +75,14 @@ variable "github_repository_environment" {
     reviewers_teams        = ["pagopa-team-core"]
   }
 }
+
+variable "tags" {
+  type = map(any)
+  default = {
+    CreatedBy   = "Terraform"
+    Environment = "PROD"
+    Owner       = "pagoPA"
+    Source      = "https://github.com/pagopa/pagopa-gpd-upload"
+    CostCenter  = "TS310 - PAGAMENTI & SERVIZI"
+  }
+}

.identity/env/dev/terraform.tfvars

@@ -1,11 +1,43 @@
 prefix    = "pagopa"
 env       = "dev"
 env_short = "d"
+location  = "westeurope"
 
 tags = {
   CreatedBy   = "Terraform"
   Environment = "Dev"
   Owner       = "pagoPA"
-  Source      = "https://github.com/pagopa/your-repository" # TODO
+  Source      = "https://github.com/pagopa/pagopa-stand-in-manager"
   CostCenter  = "TS310 - PAGAMENTI & SERVIZI"
 }
+
+cd_github_federations = [
+  {
+    repository = "pagopa-stand-in-manager"
+    subject    = "dev"
+  }
+]
+
+environment_cd_roles = {
+#  subscription = [
+#    "Contributor",
+#    "Storage Account Contributor",
+#    "Storage Blob Data Contributor",
+#    "Storage File Data SMB Share Contributor",
+#    "Storage Queue Data Contributor",
+#    "Storage Table Data Contributor",
+#    "Key Vault Contributor"
+#  ]
+  subscription = [
+    "Contributor",
+    "Key Vault Reader"
+  ]
+  resource_groups = {
+    "pagopa-d-nodo-sec-rg" = [
+      "Key Vault Reader"
+    ],
+    "pagopa-d-weu-dev-aks-rg" = [
+      "Contributor"
+    ]
+  }
+}

.identity/env/prod/backend.tfvars

@@ -1,4 +1,4 @@
 resource_group_name  = "io-infra-rg"
 storage_account_name = "pagopainfraterraformprod"
 container_name       = "azurermstate"
-key                  = "<your-repo-name>.tfstate" # TODO
+key                  = "pagopa-stand-in-manager.tfstate"

.identity/env/prod/terraform.tfvars

@@ -6,6 +6,6 @@ tags = {
   CreatedBy   = "Terraform"
   Environment = "Prod"
   Owner       = "pagoPA"
-  Source      = "https://github.com/pagopa/your-repository" # TODO
+  Source      = "https://github.com/pagopa/pagopa-stand-in-manager"
   CostCenter  = "TS310 - PAGAMENTI & SERVIZI"
 }