Reconfigure Keyvault

terraform/subscriptions/modules/config/main.tf

@@ -25,8 +25,16 @@ output "vnet_resource_group" {
   value = "cluster-vnet-hub-${local.config.environment}"
 }
 output "key_vault_name" {
-  value = "radix-kv-${local.config.environment}"
+  value = "radix-keyv-${local.config.environment}"
+}
+
+output "log_analytics_name" {
+  value = "radix-logs-${local.config.environment}"
 }
 output "backend" {
   value = local.config.backend
 }
+
+output "policy_aks_diagnostics_cluster" {
+  value = "Radix-Enforce-Diagnostics-AKS-Clusters"
+}

terraform/subscriptions/modules/userassignedidentity/main.tf

@@ -3,3 +3,10 @@ resource "azurerm_user_assigned_identity" "userassignedidentity" {
   location            = var.location
   resource_group_name = var.resource_group_name
 }
+
+resource "azurerm_role_assignment" "this" {
+  for_each             = var.roleassignments
+  scope                = each.value.scope_id
+  role_definition_name = each.value.role
+  principal_id         = azurerm_user_assigned_identity.userassignedidentity.principal_id
+}

terraform/subscriptions/modules/userassignedidentity/variables.tf

@@ -12,3 +12,11 @@ variable "location" {
   description = "The Azure Region where the User Assigned Identity should exist."
   type        = string
 }
+
+variable "roleassignments" {
+  type = map(object({
+    role     = string
+    scope_id = string
+  }))
+  default = {}
+}

terraform/subscriptions/s940/c2/clusters/main.tf

@@ -1,17 +1,46 @@
 
+
+module "config" {
+  source = "../../../modules/config"
+}
+
 module "resourcegroups" {
   for_each = toset(var.resource_groups)
   source   = "../../../modules/resourcegroups"
   name     = each.value
-  location = local.outputs.location
+  location = module.config.location
+}
+
+data "azurerm_key_vault" "keyvault" {
+  name                = module.config.key_vault_name
+  resource_group_name = module.config.common_resource_group
+}
+
+data "azurerm_log_analytics_workspace" "workspace" {
+  name                = module.config.log_analytics_name
+  resource_group_name = module.config.common_resource_group
+}
+
+data "azurerm_user_assigned_identity" "infrastructure_id" {
+  name                = "radix-id-infrastructure-${module.config.environment}"
+  resource_group_name = module.config.common_resource_group
+}
+
+data "azurerm_policy_definition" "policy_aks_cluster" {
+  display_name = module.config.policy_aks_diagnostics_cluster
 }
 
 module "radix_id_external_secrets_operator_mi" {
   source              = "../../../modules/userassignedidentity"
-  name                = "radix-id-external-secrets-operator-${local.external_outputs.common.data.enviroment}"
-  location            = local.outputs.location
-  resource_group_name = "common-${local.external_outputs.common.data.enviroment}"
-
+  name                = "radix-id-external-secrets-operator-${module.config.environment}"
+  location            = module.config.location
+  resource_group_name = "common-${module.config.environment}"
+  roleassignments = {
+    kv_user = {
+      role     = "Key Vault Secrets User"
+      scope_id = data.azurerm_key_vault.keyvault.id
+    }
+  }
 }
 
 module "policyassignment_resourcegroup" {
@@ -20,13 +49,11 @@ module "policyassignment_resourcegroup" {
   policy_name          = "Radix-Enforce-Diagnostics-AKS-Clusters"
   location             = each.value["data"].location
   resource_group_id    = each.value["data"].id
-  policy_definition_id = local.external_outputs.global.policy_aks_cluster_id
-  identity_ids         = local.external_outputs.common.mi_id
-  workspaceId          = local.external_outputs.common.workspace_id
-
+  policy_definition_id = data.azurerm_policy_definition.policy_aks_cluster.id
+  identity_ids         = data.azurerm_user_assigned_identity.infrastructure_id.id
+  workspaceId          = data.azurerm_log_analytics_workspace.workspace.id
 }
 
-
 module "nsg" {
   source                     = "../../../modules/networksecuritygroup"
   for_each                   = local.flattened_clusters

terraform/subscriptions/s940/c2/clusters/variables.tf

@@ -1,3 +1,14 @@
+locals {
+  flattened_clusters = {
+    for key, value in var.clusters : key => {
+      name                       = key
+      resource_group_name        = value.resource_group_name
+      location                   = value.location
+      destination_address_prefix = value.destination_address_prefix
+    }
+  }
+}
+
 variable "resource_groups" {
   type    = list(string)
   default = ["clusters-c2"]

terraform/subscriptions/s940/c2/key-vault/variables.tf

@@ -11,7 +11,7 @@ variable "keyvaults" {
     radix-vault-c2-prod = {
       resource_group = "common-westeurope"
     }
-    radix-kv-c2 = {
+    radix-keyv-c2 = {
       enable_rbac_authorization = true
     }
   }

terraform/subscriptions/s940/extmon/clusters/main.tf

@@ -1,14 +1,64 @@
+
+
+module "config" {
+  source = "../../../modules/config"
+}
+
 module "resourcegroups" {
   for_each = toset(var.resource_groups)
   source   = "../../../modules/resourcegroups"
   name     = each.value
-  location = local.outputs.location
+  location = module.config.location
+}
+
+data "azurerm_key_vault" "keyvault" {
+  name                = module.config.key_vault_name
+  resource_group_name = module.config.common_resource_group
+}
+
+data "azurerm_log_analytics_workspace" "workspace" {
+  name                = module.config.log_analytics_name
+  resource_group_name = module.config.common_resource_group
+}
+
+data "azurerm_user_assigned_identity" "infrastructure_id" {
+  name                = "radix-id-infrastructure-${module.config.environment}"
+  resource_group_name = module.config.common_resource_group
+}
+
+data "azurerm_policy_definition" "policy_aks_cluster" {
+  display_name = module.config.policy_aks_diagnostics_cluster
 }
 
 module "radix_id_external_secrets_operator_mi" {
   source              = "../../../modules/userassignedidentity"
-  name                = "radix-id-external-secrets-operator-${local.external_outputs.common.data.enviroment}"
-  location            = local.outputs.location
-  resource_group_name = "common-${local.external_outputs.common.data.enviroment}"
+  name                = "radix-id-external-secrets-operator-${module.config.environment}"
+  location            = module.config.location
+  resource_group_name = "common-${module.config.environment}"
+  roleassignments = {
+    kv_user = {
+      role     = "Key Vault Secrets User"
+      scope_id = data.azurerm_key_vault.keyvault.id
+    }
+  }
+}
+
+# module "policyassignment_resourcegroup" {
+#   for_each             = module.resourcegroups
+#   source               = "../../../modules/policyassignment_resourcegroup"
+#   policy_name          = "Radix-Enforce-Diagnostics-AKS-Clusters"
+#   location             = each.value["data"].location
+#   resource_group_id    = each.value["data"].id
+#   policy_definition_id = data.azurerm_policy_definition.policy_aks_cluster.id
+#   identity_ids         = data.azurerm_user_assigned_identity.infrastructure_id.id
+#   workspaceId          = data.azurerm_log_analytics_workspace.workspace.id
+# }
 
-}
+# module "nsg" {
+#   source                     = "../../../modules/networksecuritygroup"
+#   for_each                   = local.flattened_clusters
+#   networksecuritygroupname   = "nsg-${each.key}"
+#   location                   = each.value.location
+#   resource_group_name        = each.value.resource_group_name
+#   destination_address_prefix = each.value.destination_address_prefix
+# }

terraform/subscriptions/s940/extmon/clusters/variables.tf

@@ -1,3 +1,14 @@
+locals {
+  flattened_clusters = {
+    for key, value in var.clusters : key => {
+      name                       = key
+      resource_group_name        = value.resource_group_name
+      location                   = value.location
+      destination_address_prefix = value.destination_address_prefix
+    }
+  }
+}
+
 variable "resource_groups" {
   type    = list(string)
   default = ["clusters-extmon"]

terraform/subscriptions/s940/extmon/key-vault/variables.tf

@@ -11,7 +11,7 @@ variable "keyvaults" {
     kv-radix-monitoring-prod = {
       resource_group = "monitoring"
     }
-    radix-kv-extmon = {
+    radix-keyv-extmon = {
       enable_rbac_authorization = true
     }
   }