Base secrets configs

src/core/main.tf

@@ -9,6 +9,11 @@ terraform {
       version = "= 2.5.0"
     }
 
+    pkcs12 = {
+      source  = "chilicat/pkcs12"
+      version = "0.0.7"
+    }
+
   }
 
   backend "azurerm" {}

src/core/security.tf

@@ -172,3 +172,48 @@ data "azurerm_key_vault_secret" "sec_storage_id" {
   name         = "sec-storage-id"
   key_vault_id = module.key_vault.id
 }
+
+# JWT
+resource "tls_private_key" "jwt" {
+  algorithm = "RSA"
+  rsa_bits  = 2048
+}
+
+resource "tls_self_signed_cert" "jwt_self" {
+  allowed_uses = [
+    "crl_signing",
+    "data_encipherment",
+    "digital_signature",
+    "key_agreement",
+    "cert_signing",
+    "key_encipherment"
+  ]
+  key_algorithm         = "RSA"
+  private_key_pem       = tls_private_key.jwt.private_key_pem
+  validity_period_hours = 8640
+  subject {
+    common_name = "apim"
+  }
+}
+
+resource "pkcs12_from_pem" "jwt_pkcs12" {
+  password        = ""
+  cert_pem        = tls_self_signed_cert.jwt_self.cert_pem
+  private_key_pem = tls_private_key.jwt.private_key_pem
+}
+
+resource "azurerm_key_vault_secret" "jwt_private_key" {
+  name         = "jwt-private-key"
+  value        = tls_private_key.jwt.private_key_pem
+  content_type = "text/plain"
+
+  key_vault_id = module.key_vault.id
+}
+
+resource "azurerm_key_vault_secret" "jwt_public_key" {
+  name         = "jwt-public-key"
+  value        = tls_private_key.jwt.public_key_pem
+  content_type = "text/plain"
+
+  key_vault_id = module.key_vault.id
+}

src/k8s/locals.tf

@@ -1,6 +1,8 @@
 locals {
-  project                  = format("%s-%s", var.prefix, var.env_short)
-  key_vault_name           = format("%s-kv", local.project)
-  key_vault_resource_group = format("%s-sec-rg", local.project)
-  key_vault_id             = "${data.azurerm_subscription.current.id}/resourceGroups/${local.key_vault_resource_group}/providers/Microsoft.KeyVault/vaults/${local.key_vault_name}"
+  project                         = format("%s-%s", var.prefix, var.env_short)
+  key_vault_name                  = format("%s-kv", local.project)
+  key_vault_resource_group        = format("%s-sec-rg", local.project)
+  key_vault_id                    = "${data.azurerm_subscription.current.id}/resourceGroups/${local.key_vault_resource_group}/providers/Microsoft.KeyVault/vaults/${local.key_vault_name}"
+  redis_url                       = "${format("%s-redis", local.project)}.redis.database.azure.com"
+  appinsights_instrumentation_key = format("InstrumentationKey=%s", module.key_vault_secrets_query.values["appinsights-instrumentation-key"].value)
 }

src/k8s/secrets.tf

@@ -5,6 +5,8 @@ module "key_vault_secrets_query" {
   key_vault_name = local.key_vault_name
 
   secrets = [
-    "appinsights-instrumentation-key"
+    "appinsights-instrumentation-key",
+    "redis-primary-access-key",
+    "jwt-private-key"
   ]
 }

src/k8s/selc_configmaps.tf

@@ -0,0 +1,54 @@
+resource "kubernetes_config_map" "hub-spid-login-ms" {
+  metadata {
+    name      = "hub-spid-login-ms"
+    namespace = kubernetes_namespace.selc.metadata[0].name
+  }
+
+  data = merge({
+    JAVA_TOOL_OPTIONS = ""
+
+    SERVER_PORT = 8080
+
+    # SPID
+    ORG_URL          = "https://pagopa.gov.it"
+    ACS_BASE_URL     = format("%s/spid/v1", var.api_gateway_url)
+    ORG_DISPLAY_NAME = "PagoPA S.p.A"
+    ORG_NAME         = "PagoPA"
+
+    AUTH_N_CONTEXT = "https://www.spid.gov.it/SpidL2"
+
+    ENDPOINT_ACS      = "/acs"
+    ENDPOINT_ERROR    = "/error"
+    ENDPOINT_SUCCESS  = format("%s/auth/login/success", var.cdn_frontend_url)
+    ENDPOINT_LOGIN    = "/login"
+    ENDPOINT_METADATA = "/metadata"
+    ENDPOINT_LOGOUT   = "/logout"
+
+    SPID_ATTRIBUTES    = "address,email,name,familyName,fiscalNumber,mobilePhone"
+    SPID_VALIDATOR_URL = "https://validator.spid.gov.it"
+
+    REQUIRED_ATTRIBUTES_SERVICE_NAME = "Selfcare Portal"
+    ENABLE_FULL_OPERATOR_METADATA    = true
+    COMPANY_EMAIL                    = "[email protected]"
+    COMPANY_FISCAL_CODE              = 15376371009
+    COMPANY_IPA_CODE                 = "PagoPA"
+    COMPANY_NAME                     = "PagoPA S.p.A"
+    COMPANY_VAT_NUMBER               = 15376371009
+
+    ENABLE_JWT                         = "true"
+    INCLUDE_SPID_USER_ON_INTROSPECTION = "true"
+
+    TOKEN_EXPIRATION = "3600"
+    JWT_TOKEN_ISSUER = "SPID"
+
+    # ADE
+    ENABLE_ADE_AA = "false"
+
+    # application insights key
+    APPINSIGHTS_DISABLED = true
+
+    SPID_TESTENV_URL = var.spid_testenv_url
+    },
+    var.configmaps_hub-spid-login-ms,
+  )
+}

src/k8s/selc_ingress.tf

@@ -0,0 +1,30 @@
+resource "kubernetes_ingress" "selc_ingress" {
+  depends_on = [helm_release.ingress]
+
+  metadata {
+    name      = "${kubernetes_namespace.selc.metadata[0].name}-ingress"
+    namespace = kubernetes_namespace.selc.metadata[0].name
+    annotations = {
+      "kubernetes.io/ingress.class"                = "nginx"
+      "nginx.ingress.kubernetes.io/rewrite-target" = "/$1"
+      "nginx.ingress.kubernetes.io/ssl-redirect"   = "false"
+      "nginx.ingress.kubernetes.io/use-regex"      = "true"
+    }
+  }
+
+  spec {
+    rule {
+      http {
+
+        path {
+          backend {
+            service_name = "hub-spid-login-ms"
+            service_port = var.default_service_port
+          }
+          path = "/hub-spid-login-ms/(.*)"
+        }
+
+      }
+    }
+  }
+}

src/k8s/selc_secrets.tf

@@ -0,0 +1,46 @@
+resource "kubernetes_secret" "hub-spid-login-ms" {
+  metadata {
+    name      = "hub-spid-login-ms"
+    namespace = kubernetes_namespace.selc.metadata[0].name
+  }
+
+  data = {
+    APPINSIGHTS_INSTRUMENTATIONKEY = local.appinsights_instrumentation_key
+    JWT_TOKEN_PRIVATE_KEY          = module.key_vault_secrets_query.values["jwt-private-key"].value
+
+    METADATA_PUBLIC_CERT  = module.key_vault_secrets_query.values["agid-spid-cert"]        # TODO actually manually populated, but to try to automate in gitops
+    METADATA_PRIVATE_CERT = module.key_vault_secrets_query.values["agid-spid-private-key"] # TODO actually manually populated, but to try to automate in gitops
+
+  }
+
+  type = "Opaque"
+}
+
+resource "kubernetes_secret" "selc-redis-credentials" {
+  metadata {
+    name      = "redis-credentials"
+    namespace = kubernetes_namespace.selc.metadata[0].name
+  }
+
+  data = {
+    REDIS_URL      = local.redis_url
+    REDIS_PASSWORD = module.key_vault_secrets_query.values["redis-primary-access-key"].value
+    REDIS_PORT     = "6379"
+  }
+
+  type = "Opaque"
+}
+
+# not yet used by any deployment, but maybe useful for the future
+resource "kubernetes_secret" "selc-application-insights" {
+  metadata {
+    name      = "application-insights"
+    namespace = kubernetes_namespace.selc.metadata[0].name
+  }
+
+  data = {
+    APPLICATIONINSIGHTS_CONNECTION_STRING = local.appinsights_instrumentation_key
+  }
+
+  type = "Opaque"
+}

src/k8s/subscriptions/DEV-SelfCare/terraform.tfvars

@@ -4,3 +4,17 @@ env_short = "d"
 # ingress
 ingress_replica_count    = "2"
 ingress_load_balancer_ip = "10.1.0.250"
+
+# Gateway
+api_gateway_url  = "https://api.dev.selfcare.pagopa.it"
+cdn_frontend_url = "https://dev.selfcare.pagopa.it"
+spid_testenv_url = "https://" # TODO
+
+# hub-spid-login-ms
+configmaps_hub-spid-login-ms = {
+  APPLICATIONINSIGHTS_ROLE_NAME                     = "hub-spid-login-ms"
+  APPLICATIONINSIGHTS_INSTRUMENTATION_LOGGING_LEVEL = "OFF"
+
+  # SPID
+  ORG_ISSUER = "https://dev.selfcare.pagopa.it" # TODO to verify
+}

src/k8s/subscriptions/PROD-SelfCare/terraform.tfvars

@@ -4,3 +4,17 @@ env_short = "p"
 # ingress
 ingress_replica_count    = "2"
 ingress_load_balancer_ip = "10.1.0.250"
+
+# Gateway
+api_gateway_url  = "https://api.selfcare.pagopa.it"
+cdn_frontend_url = "https://selfcare.pagopa.it"
+
+
+# hub-spid-login-ms
+configmaps_hub-spid-login-ms = {
+  APPLICATIONINSIGHTS_ROLE_NAME                     = "hub-spid-login-ms"
+  APPLICATIONINSIGHTS_INSTRUMENTATION_LOGGING_LEVEL = "OFF"
+
+  # SPID
+  ORG_ISSUER = "https://selfcare.pagopa.it" # TODO to verify
+}

src/k8s/subscriptions/UAT-SelfCare/terraform.tfvars

@@ -4,3 +4,17 @@ env_short = "u"
 # ingress
 ingress_replica_count    = "2"
 ingress_load_balancer_ip = "10.1.0.250"
+
+# Gateway
+api_gateway_url  = "https://api.uat.selfcare.pagopa.it"
+cdn_frontend_url = "https://uat.selfcare.pagopa.it"
+
+
+# hub-spid-login-ms
+configmaps_hub-spid-login-ms = {
+  APPLICATIONINSIGHTS_ROLE_NAME                     = "hub-spid-login-ms"
+  APPLICATIONINSIGHTS_INSTRUMENTATION_LOGGING_LEVEL = "OFF"
+
+  # SPID
+  ORG_ISSUER = "https://uat.selfcare.pagopa.it" # TODO to verify
+}

src/k8s/variables.tf

@@ -54,3 +54,22 @@ variable "default_service_port" {
   type    = number
   default = 8080
 }
+
+# gateway
+variable "api_gateway_url" {
+  type = string
+}
+variable "cdn_frontend_url" {
+  type = string
+}
+variable "spid_testenv_url" {
+  type    = string
+  default = null
+}
+
+
+# hub-spid-login-ms
+
+variable "configmaps_hub-spid-login-ms" {
+  type = map(string)
+}