diff --git a/.github/workflows/continuous-integration-terraform.yml b/.github/workflows/continuous-integration-terraform.yml index 92faa7e..c95133d 100644 --- a/.github/workflows/continuous-integration-terraform.yml +++ b/.github/workflows/continuous-integration-terraform.yml @@ -4,10 +4,10 @@ on: push: branches: main paths: - - './terraform' + - 'terraform/**' pull_request: paths: - - './terraform' + - 'terraform/**' jobs: continuous-integration-terraform: diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl index 230ce2c..e6bb79b 100644 --- a/terraform/.terraform.lock.hcl +++ b/terraform/.terraform.lock.hcl @@ -42,43 +42,23 @@ provider "registry.terraform.io/hashicorp/archive" { ] } -provider "registry.terraform.io/hashicorp/azuread" { - version = "2.53.1" - constraints = "~> 2.37" - hashes = [ - "h1:EZNO8sEtUABuRxujQrDrW1z1QsG0dq6iLbzWtnG7Om4=", - "zh:162916b037e5133f49298b0ffa3e7dcef7d76530a8ca738e7293373980f73c68", - "zh:1c3e89cf19118fc07d7b04257251fc9897e722c16e0a0df7b07fcd261f8c12e7", - "zh:492931cea4f30887ab5bca36a8556dfcb897288eddd44619c0217fc5da2d57e7", - "zh:4c895e450e18335ad8714cc6d3488fc1a78816ad2851a91b06cb2ef775dd7c66", - "zh:60d92fdaf7235574201f2d8f68f733ee00a822993b3fc95e6952e09e6ec76999", - "zh:67a169119efa41c1fb867ef1a8e79bf03472a2324384c36eb55370c817dcce42", - "zh:9dd4d5ed9233cf9329262200bc5a1aa60942b80dbc611e2ef4b09f47531b39b1", - "zh:a3c160e35b9e40fc1497b83c2f37a8e24565b05a1783c7733609f3695735c2a9", - "zh:a4a221da42b1f46e7c436c7145e5beaadfd9d03f3be6fd526d132c03f18a5979", - "zh:af0d3476a9702d2287e168e3baa670e64daab9c9b01c01e17025a5248f3e28e9", - "zh:e3579bff7894f3d36066b74ec324be6d28f56a42a387a2b8a0eabf33cbff86df", - "zh:f1749ee8ad972ae6424665aa9d2c0ece8c40c51d41ec2f38b863148cb437e865", - ] -} - provider "registry.terraform.io/hashicorp/azurerm" { - version = "4.76.0" + version = "4.81.0" constraints = "~> 4.0, ~> 4.37" hashes = [ - "h1:4VD01UBYjsa3w7zeEBKnDtwClwpsPw6Dk+V9evhiKqU=", - "zh:07bb3a087abca8bd14cc28e3d3d4abb71e0ed711ecec65e7c0a2f1a97b948cf4", - "zh:0fa6640b5d6c0b0fe0b7fa25cebc0091b7dda2efd83ec0347c5a50dfce0957bc", - "zh:3c8618c8a5ab07fadfcb53ecf614f7b99e25bb6c407cf0af703a6b0647d4461d", - "zh:5f23fdda6ff290bc99b25b68f612bf67fbb503b04b1e38664e66d3204a51e99e", - "zh:68e6794cbe5e3b021657035c2465767b8296beed6c9acc8a9e032c4b90ba5746", + "h1:XhToZua4gtih1Kv8RdStcfND83G4Tmb6GZFT4jEUhDU=", + "zh:0732e7b74264ddfa2b90ba69d01c283d3cbae9f72ed3e506c6ac92529fed7fd3", + "zh:12afb524e232fe4e3d6161927724af5dfa4831d71edd9c174917ca9b7377bfae", + "zh:169d619ae202c4145e02fb706fb7c3679445ab3e3ff722edbf89597517a8c92e", + "zh:6beb95a3ef2f2d9c76abaa48e5450e90686a3fb6a47f1cb0ff7c5e94b6960151", + "zh:705e075fb5ffc4bf66fd7cbabf1a65007a41621e80030a2c158a4c83b6046216", "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:8a51dad112248d3fdfb19cdd65a182bd6a37e7fb7f1af801ab72a962813b5188", - "zh:945ff59c36de8c2128487f4ae0838655feef7c869112430ffa24ea69ff483b76", - "zh:b7306af0ecc8ad78771c17e0e911dd7a561251e4255ffe80516f0654a53f42bb", - "zh:c584de4858fc4ece330f1986f371acd235a5444e9b14ecea177779b1214539e0", - "zh:daa3675af21f8cdf330532af0b420287388f62ac57eaf0bd4c48e732d1052f35", - "zh:e76d972712b48a689f8deae41a3ad796c31d8b3798074d66c6f68e2b3b0aaa1f", + "zh:79a8d17fefe647040fcb9ee8821a4f09f395427c4fd49493489b9a93a9a1038e", + "zh:8cc3f900b3774c0ae37ae42365c4579a199cf9e5edf88e476fdf5ab1048f84ea", + "zh:dec373b9390fa95e257291acd018ed65a7d512b428645d35e22cdbe8b245a08b", + "zh:e60f1e9fb45df6defade2855ed6e68547409ea75d30655c556adb0c08579749b", + "zh:f901d12ec82f3f8b5880a27b5cbcd7bd0d97e60c9367a2d7ed82fdd1157b39ff", + "zh:facf68ea5bf0f2b8ba720e7fba5f86492e1d4c591100460bb91c3f79f391f4b6", ] } diff --git a/terraform/README.md b/terraform/README.md index e2568b9..80d5845 100644 --- a/terraform/README.md +++ b/terraform/README.md @@ -127,13 +127,14 @@ If everything looks good, answer `yes` and wait for the new infrastructure to be | [terraform](#requirement\_terraform) | ~> 1.9 | | [azapi](#requirement\_azapi) | ~> 1.13 | | [azurerm](#requirement\_azurerm) | ~> 4.0 | +| [null](#requirement\_null) | ~> 3.2 | | [statuscake](#requirement\_statuscake) | ~> 2.1 | ## Providers | Name | Version | | ---- | ------- | -| [azurerm](#provider\_azurerm) | 4.76.0 | +| [azurerm](#provider\_azurerm) | 4.81.0 | | [null](#provider\_null) | 3.3.0 | ## Modules @@ -141,7 +142,6 @@ If everything looks good, answer `yes` and wait for the new infrastructure to be | Name | Source | Version | | ---- | ------ | ------- | | [azure\_container\_apps\_hosting](#module\_azure\_container\_apps\_hosting) | github.com/DFE-Digital/terraform-azurerm-container-apps-hosting | v2.8.1 | -| [statuscake-tls-monitor](#module\_statuscake-tls-monitor) | github.com/dfe-digital/terraform-statuscake-tls-monitor | v0.1.5 | ## Resources @@ -162,33 +162,20 @@ If everything looks good, answer `yes` and wait for the new infrastructure to be | [azure\_location](#input\_azure\_location) | Azure location in which to launch resources. | `string` | n/a | yes | | [azure\_subscription\_id](#input\_azure\_subscription\_id) | Service Principal Subscription ID | `string` | n/a | yes | | [azure\_tenant\_id](#input\_azure\_tenant\_id) | Service Principal Tenant ID | `string` | n/a | yes | -| [container\_app\_file\_share\_mount\_path](#input\_container\_app\_file\_share\_mount\_path) | A path inside your container where the File Share will be mounted to | `string` | `"/uploads"` | no | | [container\_app\_name\_override](#input\_container\_app\_name\_override) | A custom name for the Container App | `string` | `""` | no | | [container\_apps\_allow\_ips\_inbound](#input\_container\_apps\_allow\_ips\_inbound) | Restricts access to the Container Apps by creating a network security group rule that only allow inbound traffic from the provided list of IPs | `list(string)` | `[]` | no | -| [container\_apps\_infra\_subnet\_cidr](#input\_container\_apps\_infra\_subnet\_cidr) | Specify a subnet prefix to use for the container\_apps\_infra subnet | `string` | `"172.16.110.16/28"` | no | +| [container\_apps\_infra\_subnet\_cidr](#input\_container\_apps\_infra\_subnet\_cidr) | Specify a subnet prefix to use for the container\_apps\_infra subnet | `string` | `"172.16.110.48/28"` | no | | [container\_command](#input\_container\_command) | Container command | `list(any)` | n/a | yes | | [container\_health\_probe\_path](#input\_container\_health\_probe\_path) | Specifies the path that is used to determine the liveness of the Container | `string` | n/a | yes | | [container\_min\_replicas](#input\_container\_min\_replicas) | Container min replicas | `number` | `1` | no | | [container\_port](#input\_container\_port) | Container port | `number` | `8080` | no | | [container\_scale\_http\_concurrency](#input\_container\_scale\_http\_concurrency) | When the number of concurrent HTTP requests exceeds this value, then another replica is added. Replicas continue to add to the pool up to the max-replicas amount. | `number` | `10` | no | | [container\_secret\_environment\_variables](#input\_container\_secret\_environment\_variables) | Container secret environment variables | `map(string)` | n/a | yes | -| [custom\_container\_apps](#input\_custom\_container\_apps) | Custom container apps, by default deployed within the container app environment managed by this module. | 
map(object({
    container_app_environment_id = optional(string, "")
    resource_group_name          = optional(string, "")
    revision_mode                = optional(string, "Single")
    container_port               = optional(number, 0)
    ingress = optional(object({
      external_enabled = optional(bool, true)
      target_port      = optional(number, null)
      traffic_weight = object({
        percentage = optional(number, 100)
      })
      cdn_frontdoor_custom_domain                = optional(string, "")
      cdn_frontdoor_origin_fqdn_override         = optional(string, "")
      cdn_frontdoor_origin_host_header_override  = optional(string, "")
      enable_cdn_frontdoor_health_probe          = optional(bool, false)
      cdn_frontdoor_health_probe_protocol        = optional(string, "")
      cdn_frontdoor_health_probe_interval        = optional(number, 120)
      cdn_frontdoor_health_probe_request_type    = optional(string, "")
      cdn_frontdoor_health_probe_path            = optional(string, "")
      cdn_frontdoor_forwarding_protocol_override = optional(string, "")
    }), null)
    identity = optional(list(object({
      type         = string
      identity_ids = list(string)
    })), [])
    secrets = optional(list(object({
      name  = string
      value = string
    })), [])
    registry = optional(object({
      server               = optional(string, "")
      username             = optional(string, "")
      password_secret_name = optional(string, "")
      identity             = optional(string, "")
    }), null),
    image   = string
    cpu     = number
    memory  = number
    command = list(string)
    liveness_probes = optional(list(object({
      interval_seconds = number
      transport        = string
      port             = number
      path             = optional(string, null)
    })), [])
    env = optional(list(object({
      name      = string
      value     = optional(string, null)
      secretRef = optional(string, null)
    })), [])
    min_replicas = number
    max_replicas = number
  }))
| `{}` | no | -| [dns\_alias\_records](#input\_dns\_alias\_records) | DNS ALIAS records to add to the DNS Zone | 
map(
    object({
      ttl : optional(number, 300),
      target_resource_id : string
    })
  )
| `{}` | no | -| [dns\_mx\_records](#input\_dns\_mx\_records) | DNS MX records to add to the DNS Zone | 
map(
    object({
      ttl : optional(number, 300),
      records : list(
        object({
          preference : number,
          exchange : string
        })
      )
    })
  )
| `{}` | no | -| [dns\_ns\_records](#input\_dns\_ns\_records) | DNS NS records to add to the DNS Zone | 
map(
    object({
      ttl : optional(number, 300),
      records : list(string)
    })
  )
| n/a | yes | -| [dns\_txt\_records](#input\_dns\_txt\_records) | DNS TXT records to add to the DNS Zone | 
map(
    object({
      ttl : optional(number, 300),
      records : list(string)
    })
  )
| n/a | yes | -| [dns\_zone\_domain\_name](#input\_dns\_zone\_domain\_name) | DNS zone domain name. If created, records will automatically be created to point to the CDN. | `string` | n/a | yes | -| [enable\_container\_app\_file\_share](#input\_enable\_container\_app\_file\_share) | Create an Azure Storage Account and File Share to be mounted to the Container Apps | `bool` | `true` | no | -| [enable\_container\_registry](#input\_enable\_container\_registry) | Set to true to create a container registry | `bool` | n/a | yes | -| [enable\_dns\_zone](#input\_enable\_dns\_zone) | Conditionally create a DNS zone | `bool` | n/a | yes | +| [enable\_container\_registry](#input\_enable\_container\_registry) | Set to true to create a container registry | `bool` | `false` | no | | [enable\_health\_insights\_api](#input\_enable\_health\_insights\_api) | Deploys a Function App that exposes the last 3 HTTP Web Tests via an API endpoint. 'enable\_app\_insights\_integration' and 'enable\_monitoring' must be set to 'true'. | `bool` | `false` | no | | [enable\_init\_container](#input\_enable\_init\_container) | Deploy an Init Container. Init containers run before the primary app container and are used to perform initialization tasks such as downloading data or preparing the environment | `bool` | `false` | no | -| [enable\_keyvault\_private\_endpoint](#input\_enable\_keyvault\_private\_endpoint) | Set to true to create a private endpoint for key vault. | `bool` | n/a | yes | | [enable\_monitoring](#input\_enable\_monitoring) | Create an App Insights instance and notification group for the Container App | `bool` | n/a | yes | | [enable\_monitoring\_traces](#input\_enable\_monitoring\_traces) | Monitor App Insights traces for error messages | `bool` | `true` | no | -| [enable\_mssql\_database](#input\_enable\_mssql\_database) | Set to true to create an Azure SQL server/database, with a private endpoint within the virtual network | `bool` | `false` | no | -| [enable\_mssql\_vulnerability\_assessment](#input\_enable\_mssql\_vulnerability\_assessment) | Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities | `bool` | `true` | no | -| [enable\_signalr](#input\_enable\_signalr) | Enable serverless Azure SignalR service | `bool` | n/a | yes | | [environment](#input\_environment) | Environment name. Will be used along with `project_name` as a prefix for all resources. | `string` | n/a | yes | | [existing\_container\_app\_environment](#input\_existing\_container\_app\_environment) | Conditionally launch resources into an existing Container App environment. Specifying this will NOT create an environment. | 
object({
    name           = string
    resource_group = string
  })
| n/a | yes | | [existing\_logic\_app\_workflow](#input\_existing\_logic\_app\_workflow) | Name, and Resource Group of an existing Logic App Workflow. Leave empty to create a new Resource | 
object({
    name : string
    resource_group_name : string
  })
| 
{
  "name": "",
  "resource_group_name": ""
}
| no | @@ -204,38 +191,15 @@ If everything looks good, answer `yes` and wait for the new infrastructure to be | [monitor\_email\_receivers](#input\_monitor\_email\_receivers) | A list of email addresses that should be notified by monitoring alerts | `list(string)` | n/a | yes | | [monitor\_endpoint\_healthcheck](#input\_monitor\_endpoint\_healthcheck) | Specify a route that should be monitored for a 200 OK status | `string` | n/a | yes | | [monitor\_http\_availability\_fqdn](#input\_monitor\_http\_availability\_fqdn) | Specify a FQDN to monitor for HTTP Availability. Leave unset to dynamically calculate the correct FQDN | `string` | `""` | no | -| [mssql\_azuread\_admin\_object\_id](#input\_mssql\_azuread\_admin\_object\_id) | Object ID of a User within Azure AD that you want to assign as the SQL Server Administrator | `string` | `""` | no | -| [mssql\_azuread\_admin\_username](#input\_mssql\_azuread\_admin\_username) | Username of a User within Azure AD that you want to assign as the SQL Server Administrator | `string` | `""` | no | -| [mssql\_azuread\_auth\_only](#input\_mssql\_azuread\_auth\_only) | Set to true to only permit SQL logins from Azure AD users | `bool` | `false` | no | -| [mssql\_database\_name](#input\_mssql\_database\_name) | The name of the MSSQL database to create. Must be set if `enable_mssql_database` is true | `string` | `""` | no | -| [mssql\_extra\_databases](#input\_mssql\_extra\_databases) | A map of extra database configurations (key is used as database name) | 
map(object({
    sku_name : optional(string, "Basic"),
    max_size_gb : optional(number, 2),
    enable_extended_auditing_policy : optional(bool, true)
  }))
| `{}` | no | -| [mssql\_firewall\_ipv4\_allow\_list](#input\_mssql\_firewall\_ipv4\_allow\_list) | A list of IPv4 Addresses that require remote access to the MSSQL Server | 
map(object({
    start_ip_range : string,
    end_ip_range : optional(string, "")
  }))
| `{}` | no | -| [mssql\_managed\_identity\_assign\_role](#input\_mssql\_managed\_identity\_assign\_role) | Assign the 'Storage Blob Data Contributor' Role to the SQL Server User-Assigned Managed Identity. Note: If you do not have 'Microsoft.Authorization/roleAssignments/write' permission, you will need to manually assign the 'Storage Blob Data Contributor' Role to the identity | `bool` | `false` | no | -| [mssql\_private\_endpoint\_subnet\_cidr](#input\_mssql\_private\_endpoint\_subnet\_cidr) | Specify a subnet prefix to use for the mssql private endpoint subnet | `string` | n/a | yes | -| [mssql\_server\_admin\_password](#input\_mssql\_server\_admin\_password) | The local administrator password for the MSSQL server | `string` | `""` | no | -| [mssql\_server\_public\_access\_enabled](#input\_mssql\_server\_public\_access\_enabled) | Enable public internet access to your MSSQL instance. Be sure to specify 'mssql\_firewall\_ipv4\_allow\_list' to restrict inbound connections | `bool` | `true` | no | -| [mssql\_sku\_name](#input\_mssql\_sku\_name) | Specifies the name of the SKU used by the database | `string` | `"Basic"` | no | | [project\_name](#input\_project\_name) | Project name. Will be used along with `environment` as a prefix for all resources. | `string` | n/a | yes | -| [registry\_admin\_enabled](#input\_registry\_admin\_enabled) | Do you want to enable access key based authentication for your Container Registry? | `bool` | `true` | no | +| [registry\_admin\_enabled](#input\_registry\_admin\_enabled) | Do you want to enable access key based authentication for your Container Registry? | `bool` | `false` | no | | [registry\_managed\_identity\_assign\_role](#input\_registry\_managed\_identity\_assign\_role) | Assign the 'AcrPull' Role to the Container App User-Assigned Managed Identity. Note: If you do not have 'Microsoft.Authorization/roleAssignments/write' permission, you will need to manually assign the 'AcrPull' Role to the identity | `bool` | `false` | no | | [registry\_server](#input\_registry\_server) | Container registry server (required if `enable_container_registry` is false) | `string` | `""` | no | | [registry\_use\_managed\_identity](#input\_registry\_use\_managed\_identity) | Create a User-Assigned Managed Identity for the Container App. Note: If you do not have 'Microsoft.Authorization/roleAssignments/write' permission, you will need to manually assign the 'AcrPull' Role to the identity | `bool` | `true` | no | | [restrict\_container\_apps\_to\_cdn\_inbound\_only](#input\_restrict\_container\_apps\_to\_cdn\_inbound\_only) | Restricts access to the Container Apps by creating a network security group rule that only allows 'AzureFrontDoor.Backend' inbound, and attaches it to the subnet of the container app environment. | `bool` | `false` | no | -| [signalr\_service\_mode](#input\_signalr\_service\_mode) | SignalR service mode | `string` | `"Default"` | no | -| [signalr\_sku](#input\_signalr\_sku) | SignalR SKU name | `string` | `"Free_F1"` | no | -| [statuscake\_api\_token](#input\_statuscake\_api\_token) | API token for StatusCake | `string` | `"00000000000000000000000000000"` | no | -| [statuscake\_contact\_group\_email\_addresses](#input\_statuscake\_contact\_group\_email\_addresses) | List of email address that should receive notifications from StatusCake | `list(string)` | `[]` | no | -| [statuscake\_contact\_group\_integrations](#input\_statuscake\_contact\_group\_integrations) | List of Integration IDs to connect to your Contact Group | `list(string)` | `[]` | no | -| [statuscake\_contact\_group\_name](#input\_statuscake\_contact\_group\_name) | Name of the contact group in StatusCake | `string` | `""` | no | -| [statuscake\_monitored\_resource\_addresses](#input\_statuscake\_monitored\_resource\_addresses) | The URLs to perform TLS checks on | `list(string)` | `[]` | no | -| [storage\_account\_file\_share\_quota\_gb](#input\_storage\_account\_file\_share\_quota\_gb) | The maximum size of the share, in gigabytes. | `number` | `1` | no | -| [storage\_account\_ipv4\_allow\_list](#input\_storage\_account\_ipv4\_allow\_list) | A list of public IPv4 address to grant access to the Storage Account | `list(string)` | `[]` | no | -| [storage\_account\_public\_access\_enabled](#input\_storage\_account\_public\_access\_enabled) | Should the Azure Storage Account have Public visibility? | `bool` | `false` | no | -| [storage\_subnet\_cidr](#input\_storage\_subnet\_cidr) | Specify a subnet prefix to use for the storage subnet | `string` | n/a | yes | | [tags](#input\_tags) | Tags to be applied to all resources | `map(string)` | n/a | yes | | [tfvars\_access\_ipv4](#input\_tfvars\_access\_ipv4) | List of IPv4 Addresses that are permitted to access the tfvars storage | `list(string)` | n/a | yes | | [tfvars\_filename](#input\_tfvars\_filename) | tfvars filename. This file is uploaded and stored encrupted within Key Vault, to ensure that the latest tfvars are stored in a shared place. | `string` | n/a | yes | -| [virtual\_network\_address\_space](#input\_virtual\_network\_address\_space) | Virtual network address space CIDR | `string` | n/a | yes | ## Outputs diff --git a/terraform/container-apps-hosting.tf b/terraform/container-apps-hosting.tf index 131bf7e..22dfe16 100644 --- a/terraform/container-apps-hosting.tf +++ b/terraform/container-apps-hosting.tf @@ -7,22 +7,11 @@ module "azure_container_apps_hosting" { tags = local.tags enable_container_registry = local.enable_container_registry - registry_admin_enabled = local.registry_admin_enabled + registry_server = local.registry_server registry_use_managed_identity = local.registry_use_managed_identity registry_managed_identity_assign_role = local.registry_managed_identity_assign_role - registry_server = local.registry_server + registry_admin_enabled = local.registry_admin_enabled - enable_dns_zone = local.enable_dns_zone - dns_zone_domain_name = local.dns_zone_domain_name - dns_ns_records = local.dns_ns_records - dns_txt_records = local.dns_txt_records - dns_mx_records = local.dns_mx_records - dns_alias_records = local.dns_alias_records - enable_container_app_file_share = local.enable_container_app_file_share - storage_account_file_share_quota_gb = local.storage_account_file_share_quota_gb - container_app_file_share_mount_path = local.container_app_file_share_mount_path - storage_account_public_access_enabled = local.storage_account_public_access_enabled - storage_account_ipv4_allow_list = local.storage_account_ipv4_allow_list image_name = local.image_name container_command = local.container_command container_secret_environment_variables = local.container_secret_environment_variables @@ -42,9 +31,6 @@ module "azure_container_apps_hosting" { launch_in_vnet = true container_app_name_override = local.container_app_name_override - storage_subnet_cidr = local.storage_subnet_cidr - mssql_private_endpoint_subnet_cidr = local.mssql_private_endpoint_subnet_cidr - enable_monitoring = local.enable_monitoring monitor_email_receivers = local.monitor_email_receivers container_health_probe_path = local.container_health_probe_path @@ -57,25 +43,7 @@ module "azure_container_apps_hosting" { existing_network_watcher_resource_group_name = local.existing_network_watcher_resource_group_name restrict_container_apps_to_cdn_inbound_only = local.restrict_container_apps_to_cdn_inbound_only - custom_container_apps = local.custom_container_apps enable_init_container = local.enable_init_container init_container_image = local.init_container_image init_container_command = local.init_container_command - - enable_mssql_database = local.enable_mssql_database - mssql_server_admin_password = local.mssql_server_admin_password - mssql_azuread_admin_username = local.mssql_azuread_admin_username - mssql_azuread_admin_object_id = local.mssql_azuread_admin_object_id - mssql_sku_name = local.mssql_sku_name - mssql_database_name = local.mssql_database_name - mssql_extra_databases = local.mssql_extra_databases - mssql_firewall_ipv4_allow_list = local.mssql_firewall_ipv4_allow_list - enable_mssql_vulnerability_assessment = local.enable_mssql_vulnerability_assessment - mssql_managed_identity_assign_role = local.mssql_managed_identity_assign_role - mssql_server_public_access_enabled = local.mssql_server_public_access_enabled - mssql_azuread_auth_only = local.mssql_azuread_auth_only - - enable_signalr = local.enable_signalr - signalr_sku = local.signalr_sku - signalr_service_mode = local.signalr_service_mode } diff --git a/terraform/locals.tf b/terraform/locals.tf index bf91315..78dbe60 100644 --- a/terraform/locals.tf +++ b/terraform/locals.tf @@ -4,26 +4,16 @@ locals { azure_location = var.azure_location tags = var.tags enable_container_registry = var.enable_container_registry - registry_admin_enabled = var.registry_admin_enabled + registry_server = var.registry_server registry_use_managed_identity = var.registry_use_managed_identity registry_managed_identity_assign_role = var.registry_managed_identity_assign_role - registry_server = var.registry_server + registry_admin_enabled = var.registry_admin_enabled image_name = var.image_name container_command = var.container_command container_secret_environment_variables = var.container_secret_environment_variables container_scale_http_concurrency = var.container_scale_http_concurrency container_min_replicas = var.container_min_replicas container_port = var.container_port - enable_container_app_file_share = var.enable_container_app_file_share - storage_account_file_share_quota_gb = var.storage_account_file_share_quota_gb - container_app_file_share_mount_path = var.container_app_file_share_mount_path - storage_account_public_access_enabled = var.storage_account_public_access_enabled - storage_account_ipv4_allow_list = var.storage_account_ipv4_allow_list - enable_dns_zone = var.enable_dns_zone - dns_zone_domain_name = var.dns_zone_domain_name - dns_ns_records = var.dns_ns_records - dns_txt_records = var.dns_txt_records - dns_mx_records = var.dns_mx_records tfvars_access_ipv4 = var.tfvars_access_ipv4 tfvars_filename = var.tfvars_filename enable_monitoring = var.enable_monitoring @@ -34,11 +24,6 @@ locals { existing_logic_app_workflow = var.existing_logic_app_workflow existing_network_watcher_name = var.existing_network_watcher_name existing_network_watcher_resource_group_name = var.existing_network_watcher_resource_group_name - statuscake_monitored_resource_addresses = var.statuscake_monitored_resource_addresses - statuscake_contact_group_name = var.statuscake_contact_group_name - statuscake_contact_group_integrations = var.statuscake_contact_group_integrations - statuscake_contact_group_email_addresses = var.statuscake_contact_group_email_addresses - custom_container_apps = var.custom_container_apps enable_health_insights_api = var.enable_health_insights_api health_insights_api_cors_origins = var.health_insights_api_cors_origins health_insights_api_ipv4_allow_list = var.health_insights_api_ipv4_allow_list @@ -46,33 +31,11 @@ locals { init_container_image = var.init_container_image init_container_command = var.init_container_command monitor_http_availability_fqdn = var.monitor_http_availability_fqdn - dns_alias_records = var.dns_alias_records enable_monitoring_traces = var.enable_monitoring_traces existing_container_app_environment = var.existing_container_app_environment existing_virtual_network = var.existing_virtual_network - virtual_network_address_space = var.virtual_network_address_space - virtual_network_address_space_mask = element(split("/", local.virtual_network_address_space), 1) - key_vault_subnet_cidr = cidrsubnet(local.virtual_network_address_space, 21 - local.virtual_network_address_space_mask, 2) - enable_keyvault_private_endpoint = var.enable_keyvault_private_endpoint - storage_subnet_cidr = var.storage_subnet_cidr - mssql_private_endpoint_subnet_cidr = var.mssql_private_endpoint_subnet_cidr existing_resource_group = var.existing_resource_group container_app_name_override = var.container_app_name_override - enable_mssql_database = var.enable_mssql_database - mssql_server_admin_password = var.mssql_server_admin_password - mssql_azuread_admin_username = var.mssql_azuread_admin_username - mssql_azuread_admin_object_id = var.mssql_azuread_admin_object_id - mssql_sku_name = var.mssql_sku_name - mssql_database_name = var.mssql_database_name - mssql_extra_databases = var.mssql_extra_databases - mssql_firewall_ipv4_allow_list = var.mssql_firewall_ipv4_allow_list - enable_mssql_vulnerability_assessment = var.enable_mssql_vulnerability_assessment - mssql_managed_identity_assign_role = var.mssql_managed_identity_assign_role - mssql_server_public_access_enabled = var.mssql_server_public_access_enabled - mssql_azuread_auth_only = var.mssql_azuread_auth_only - enable_signalr = var.enable_signalr - signalr_sku = var.signalr_sku - signalr_service_mode = var.signalr_service_mode restrict_container_apps_to_cdn_inbound_only = var.restrict_container_apps_to_cdn_inbound_only container_apps_infra_subnet_cidr = var.container_apps_infra_subnet_cidr diff --git a/terraform/providers.tf b/terraform/providers.tf index 1f88c3e..1f0a7ef 100644 --- a/terraform/providers.tf +++ b/terraform/providers.tf @@ -11,7 +11,3 @@ provider "azurerm" { provider "azapi" { enable_hcl_output_for_data_source = true } - -provider "statuscake" { - api_token = var.statuscake_api_token -} diff --git a/terraform/statuscake-tls-monitor.tf b/terraform/statuscake-tls-monitor.tf deleted file mode 100644 index 40d836d..0000000 --- a/terraform/statuscake-tls-monitor.tf +++ /dev/null @@ -1,11 +0,0 @@ -module "statuscake-tls-monitor" { - source = "github.com/dfe-digital/terraform-statuscake-tls-monitor?ref=v0.1.5" - - statuscake_monitored_resource_addresses = local.statuscake_monitored_resource_addresses - statuscake_alert_at = [ # days to alert on - 40, 20, 5 - ] - statuscake_contact_group_name = local.statuscake_contact_group_name - statuscake_contact_group_integrations = local.statuscake_contact_group_integrations - statuscake_contact_group_email_addresses = local.statuscake_contact_group_email_addresses -} diff --git a/terraform/tfvars-storage.tf b/terraform/tfvars-storage.tf index bd112fa..4b9c92a 100644 --- a/terraform/tfvars-storage.tf +++ b/terraform/tfvars-storage.tf @@ -1,5 +1,5 @@ resource "azurerm_storage_account" "tfvars" { - name = "${replace(local.existing_resource_group, "-", "")}tfvars" + name = "${replace("${local.environment}${local.project_name}", "-", "")}tfvar" resource_group_name = local.existing_resource_group location = local.azure_location account_tier = "Standard" @@ -12,7 +12,7 @@ resource "azurerm_storage_account" "tfvars" { } resource "azurerm_storage_container" "tfvars" { - name = "${local.existing_resource_group}-tfvars" + name = "${local.environment}${local.project_name}-tfvar" storage_account_name = azurerm_storage_account.tfvars.name container_access_type = "private" } diff --git a/terraform/variables.tf b/terraform/variables.tf index 270c1d1..761a60d 100644 --- a/terraform/variables.tf +++ b/terraform/variables.tf @@ -29,16 +29,6 @@ variable "tfvars_access_ipv4" { type = list(string) } -variable "virtual_network_address_space" { - description = "Virtual network address space CIDR" - type = string -} - -variable "enable_keyvault_private_endpoint" { - description = "Set to true to create a private endpoint for key vault." - type = bool -} - variable "tfvars_filename" { description = "tfvars filename. This file is uploaded and stored encrupted within Key Vault, to ensure that the latest tfvars are stored in a shared place." type = string @@ -62,28 +52,13 @@ variable "tags" { variable "container_apps_infra_subnet_cidr" { description = "Specify a subnet prefix to use for the container_apps_infra subnet" type = string - default = "172.16.110.16/28" -} - -variable "storage_subnet_cidr" { - description = "Specify a subnet prefix to use for the storage subnet" - type = string -} - -variable "mssql_private_endpoint_subnet_cidr" { - description = "Specify a subnet prefix to use for the mssql private endpoint subnet" - type = string + default = "172.16.110.48/28" } variable "enable_container_registry" { description = "Set to true to create a container registry" type = bool -} - -variable "registry_admin_enabled" { - description = "Do you want to enable access key based authentication for your Container Registry?" - type = bool - default = true + default = false } variable "registry_server" { @@ -104,6 +79,12 @@ variable "registry_managed_identity_assign_role" { default = false } +variable "registry_admin_enabled" { + description = "Do you want to enable access key based authentication for your Container Registry?" + type = bool + default = false +} + variable "image_name" { description = "Image name" type = string @@ -126,52 +107,6 @@ variable "container_scale_http_concurrency" { default = 10 } -variable "enable_dns_zone" { - description = "Conditionally create a DNS zone" - type = bool -} - -variable "dns_zone_domain_name" { - description = "DNS zone domain name. If created, records will automatically be created to point to the CDN." - type = string -} - -variable "dns_ns_records" { - description = "DNS NS records to add to the DNS Zone" - type = map( - object({ - ttl : optional(number, 300), - records : list(string) - }) - ) -} - -variable "dns_txt_records" { - description = "DNS TXT records to add to the DNS Zone" - type = map( - object({ - ttl : optional(number, 300), - records : list(string) - }) - ) -} - -variable "dns_mx_records" { - description = "DNS MX records to add to the DNS Zone" - type = map( - object({ - ttl : optional(number, 300), - records : list( - object({ - preference : number, - exchange : string - }) - ) - }) - ) - default = {} -} - variable "container_apps_allow_ips_inbound" { description = "Restricts access to the Container Apps by creating a network security group rule that only allow inbound traffic from the provided list of IPs" type = list(string) @@ -220,95 +155,6 @@ variable "existing_network_watcher_resource_group_name" { type = string } -variable "statuscake_api_token" { - description = "API token for StatusCake" - type = string - sensitive = true - default = "00000000000000000000000000000" -} - -variable "statuscake_contact_group_name" { - description = "Name of the contact group in StatusCake" - type = string - default = "" -} - -variable "statuscake_contact_group_integrations" { - description = "List of Integration IDs to connect to your Contact Group" - type = list(string) - default = [] -} - -variable "statuscake_monitored_resource_addresses" { - description = "The URLs to perform TLS checks on" - type = list(string) - default = [] -} - -variable "statuscake_contact_group_email_addresses" { - description = "List of email address that should receive notifications from StatusCake" - type = list(string) - default = [] -} - -variable "custom_container_apps" { - description = "Custom container apps, by default deployed within the container app environment managed by this module." - type = map(object({ - container_app_environment_id = optional(string, "") - resource_group_name = optional(string, "") - revision_mode = optional(string, "Single") - container_port = optional(number, 0) - ingress = optional(object({ - external_enabled = optional(bool, true) - target_port = optional(number, null) - traffic_weight = object({ - percentage = optional(number, 100) - }) - cdn_frontdoor_custom_domain = optional(string, "") - cdn_frontdoor_origin_fqdn_override = optional(string, "") - cdn_frontdoor_origin_host_header_override = optional(string, "") - enable_cdn_frontdoor_health_probe = optional(bool, false) - cdn_frontdoor_health_probe_protocol = optional(string, "") - cdn_frontdoor_health_probe_interval = optional(number, 120) - cdn_frontdoor_health_probe_request_type = optional(string, "") - cdn_frontdoor_health_probe_path = optional(string, "") - cdn_frontdoor_forwarding_protocol_override = optional(string, "") - }), null) - identity = optional(list(object({ - type = string - identity_ids = list(string) - })), []) - secrets = optional(list(object({ - name = string - value = string - })), []) - registry = optional(object({ - server = optional(string, "") - username = optional(string, "") - password_secret_name = optional(string, "") - identity = optional(string, "") - }), null), - image = string - cpu = number - memory = number - command = list(string) - liveness_probes = optional(list(object({ - interval_seconds = number - transport = string - port = number - path = optional(string, null) - })), []) - env = optional(list(object({ - name = string - value = optional(string, null) - secretRef = optional(string, null) - })), []) - min_replicas = number - max_replicas = number - })) - default = {} -} - variable "container_min_replicas" { description = "Container min replicas" type = number @@ -352,12 +198,7 @@ variable "init_container_image" { } variable "init_container_command" { - description = <<-EOT - Container command for the Init Container. - For EF migrations use ["/sql/migratedb"], which applies both ExternalApplications - and TenantConfig bundles. Requires env vars ConnectionStrings__DefaultConnection - and ConnectionStrings__TenantConfigDatabase on the Container App. - EOT + description = "Container command for the Init Container" type = list(any) default = [] } @@ -368,17 +209,6 @@ variable "monitor_http_availability_fqdn" { default = "" } -variable "dns_alias_records" { - description = "DNS ALIAS records to add to the DNS Zone" - type = map( - object({ - ttl : optional(number, 300), - target_resource_id : string - }) - ) - default = {} -} - variable "enable_monitoring_traces" { description = "Monitor App Insights traces for error messages" type = bool @@ -409,135 +239,8 @@ variable "container_app_name_override" { default = "" } -variable "enable_mssql_database" { - description = "Set to true to create an Azure SQL server/database, with a private endpoint within the virtual network" - type = bool - default = false -} - -variable "mssql_server_admin_password" { - description = "The local administrator password for the MSSQL server" - type = string - default = "" - sensitive = true -} - -variable "mssql_azuread_admin_username" { - description = "Username of a User within Azure AD that you want to assign as the SQL Server Administrator" - type = string - default = "" -} - -variable "mssql_azuread_admin_object_id" { - description = "Object ID of a User within Azure AD that you want to assign as the SQL Server Administrator" - type = string - default = "" -} - -variable "mssql_sku_name" { - description = "Specifies the name of the SKU used by the database" - type = string - default = "Basic" -} - -variable "mssql_database_name" { - description = "The name of the MSSQL database to create. Must be set if `enable_mssql_database` is true" - type = string - default = "" -} - -variable "mssql_extra_databases" { - description = "A map of extra database configurations (key is used as database name)" - type = map(object({ - sku_name : optional(string, "Basic"), - max_size_gb : optional(number, 2), - enable_extended_auditing_policy : optional(bool, true) - })) - default = {} -} - -variable "mssql_firewall_ipv4_allow_list" { - description = "A list of IPv4 Addresses that require remote access to the MSSQL Server" - type = map(object({ - start_ip_range : string, - end_ip_range : optional(string, "") - })) - default = {} -} - -variable "enable_mssql_vulnerability_assessment" { - description = "Vulnerability assessment can discover, track, and help you remediate potential database vulnerabilities" - type = bool - default = true -} - -variable "mssql_managed_identity_assign_role" { - description = "Assign the 'Storage Blob Data Contributor' Role to the SQL Server User-Assigned Managed Identity. Note: If you do not have 'Microsoft.Authorization/roleAssignments/write' permission, you will need to manually assign the 'Storage Blob Data Contributor' Role to the identity" - type = bool - default = false -} - -variable "mssql_server_public_access_enabled" { - description = "Enable public internet access to your MSSQL instance. Be sure to specify 'mssql_firewall_ipv4_allow_list' to restrict inbound connections" - type = bool - default = true -} - -variable "mssql_azuread_auth_only" { - description = "Set to true to only permit SQL logins from Azure AD users" - type = bool - default = false -} - variable "restrict_container_apps_to_cdn_inbound_only" { description = "Restricts access to the Container Apps by creating a network security group rule that only allows 'AzureFrontDoor.Backend' inbound, and attaches it to the subnet of the container app environment." type = bool default = false } - -variable "enable_container_app_file_share" { - description = "Create an Azure Storage Account and File Share to be mounted to the Container Apps" - type = bool - default = true -} - -variable "storage_account_file_share_quota_gb" { - description = "The maximum size of the share, in gigabytes." - type = number - default = 1 -} - -variable "container_app_file_share_mount_path" { - description = "A path inside your container where the File Share will be mounted to" - type = string - default = "/uploads" -} - -variable "storage_account_public_access_enabled" { - description = "Should the Azure Storage Account have Public visibility?" - type = bool - default = false -} - -variable "storage_account_ipv4_allow_list" { - description = "A list of public IPv4 address to grant access to the Storage Account" - type = list(string) - default = [] -} - -variable "enable_signalr" { - description = "Enable serverless Azure SignalR service" - type = bool -} - -variable "signalr_sku" { - description = "SignalR SKU name" - type = string - default = "Free_F1" -} - -variable "signalr_service_mode" { - description = "SignalR service mode" - type = string - default = "Default" -} diff --git a/terraform/versions.tf b/terraform/versions.tf index 73673e9..7fb1275 100644 --- a/terraform/versions.tf +++ b/terraform/versions.tf @@ -16,5 +16,10 @@ terraform { source = "Azure/azapi" version = "~> 1.13" } + + null = { + source = "hashicorp/null" + version = "~> 3.2" + } } }