feat: Add tls checker (#69)

add tls checker

tls_checker/main.tf

@@ -0,0 +1,63 @@
+resource "helm_release" "helm_this" {
+
+  count = var.helm_chart_present ? 1 : 0
+
+  name       = local.helm_chart_name
+  chart      = "microservice-chart"
+  repository = "https://pagopa.github.io/aks-microservice-chart-blueprint"
+  version    = var.helm_chart_version
+  namespace  = var.namespace
+
+  values = [
+    "${templatefile("${path.module}/templates/tls-cert.yaml.tpl",
+      {
+        namespace                      = var.namespace
+        image_name                     = var.helm_chart_image_name
+        image_tag                      = var.helm_chart_image_tag
+        website_site_name              = var.https_endpoint
+        time_trigger                   = var.time_trigger
+        function_name                  = var.https_endpoint
+        region                         = var.location_string
+        expiration_delta_in_days       = var.expiration_delta_in_days
+        host                           = var.https_endpoint
+        appinsights_instrumentationkey = var.application_insights_connection_string
+    })}",
+  ]
+}
+
+resource "azurerm_monitor_metric_alert" "alert_this" {
+  name                = local.alert_name
+  resource_group_name = var.application_insights_resource_group
+  scopes              = [var.application_insights_id]
+  description         = "Whenever the average availabilityresults/availabilitypercentage is less than 50%"
+  severity            = 0
+  frequency           = "PT5M"
+  auto_mitigate       = false
+  enabled             = var.alert_enabled
+
+  criteria {
+    metric_namespace = "microsoft.insights/components"
+    metric_name      = "availabilityResults/availabilityPercentage"
+    aggregation      = "Average"
+    operator         = "LessThan"
+    threshold        = 50
+
+    dimension {
+      name     = "availabilityResult/name"
+      operator = "Include"
+      values   = [var.https_endpoint]
+    }
+  }
+
+  dynamic "action" {
+    for_each = var.application_insights_action_group_ids
+
+    content {
+      action_group_id = action.value
+    }
+  }
+
+  depends_on = [
+    helm_release.helm_this[0]
+  ]
+}

tls_checker/templates/tls-cert.yaml.tpl

@@ -0,0 +1,42 @@
+namespace: '${namespace}'
+
+image:
+  repository: '${image_name}'
+  tag: '${image_tag}'
+
+ingress:
+  create: false
+
+service:
+  create: false
+
+resources:
+  requests:
+    memory: '96Mi'
+    cpu: '10m'
+  limits:
+    memory: '128Mi'
+    cpu: '50m'
+
+envConfig:
+  WEBSITE_SITE_NAME: '${website_site_name}'
+  FUNCTION_WORKER_RUNTIME: 'dotnet'
+  TIME_TRIGGER: '${time_trigger}'
+  FunctionName: '${function_name}'
+  Region: '${region}'
+  ExpirationDeltaInDays: '${expiration_delta_in_days}'
+  Host: 'https://${host}'
+  AzureWebJobsStorage: "UseDevelopmentStorage=true"
+  APPINSIGHTS_INSTRUMENTATIONKEY: '${appinsights_instrumentationkey}'
+
+sidecars:
+  - name: azurite
+    securityContext:
+      allowPrivilegeEscalation: false
+    image: mcr.microsoft.com/azure-storage/azurite:3.18.0@sha256:fbd99a4aa4259827081ff9e5cd133a531f20fa2d1d010891fd474d5798f15d7a
+    ports:
+      - containerPort: 10000
+    resources:
+      limits:
+        memory: 100Mi
+        cpu: 20m

tls_checker/variables.tf

@@ -0,0 +1,87 @@
+variable "https_endpoint" {
+  type        = string
+  description = "Https endpoint to check"
+}
+
+variable "namespace" {
+  type        = string
+  description = "(Required) Namespace where the helm chart will be installed"
+}
+
+variable "location_string" {
+  type        = string
+  description = "(Required) Location string"
+}
+
+variable "helm_chart_version" {
+  type        = string
+  description = "Helm chart version for the tls checker application"
+}
+
+variable "helm_chart_image_name" {
+  type        = string
+  description = "Docker image name"
+}
+
+variable "helm_chart_image_tag" {
+  type        = string
+  description = "Docker image tag"
+}
+
+variable "time_trigger" {
+  type        = string
+  description = "cron trigger pattern"
+  default     = "*/1 * * * *"
+}
+
+variable "expiration_delta_in_days" {
+  type        = string
+  default     = "7"
+  description = "(Optional)"
+}
+
+variable "application_insights_connection_string" {
+  type        = string
+  description = "(Required) Application Insights connection string"
+}
+
+variable "application_insights_resource_group" {
+  type        = string
+  description = "(Required) Application Insights resource group"
+}
+
+variable "application_insights_id" {
+  type        = string
+  description = "(Required) Application Insights id"
+}
+
+variable "application_insights_action_group_ids" {
+  type        = list(string)
+  description = "(Required) Application insights action group ids"
+}
+
+variable "alert_name" {
+  type        = string
+  description = "(Optional) Alert name"
+  default     = null
+}
+
+variable "alert_enabled" {
+  type        = bool
+  description = "(Optional) Is this alert enabled?"
+  default     = true
+}
+
+variable "helm_chart_present" {
+  type        = bool
+  description = "Is this helm chart present?"
+  default     = true
+}
+
+
+locals {
+  alert_name                = var.alert_name != null ? lower(replace("${var.alert_name}", "/\\W/", "-")) : lower(replace("${var.https_endpoint}", "/\\W/", "-"))
+  alert_name_sha256_limited = substr(sha256(var.alert_name), 0, 5)
+  # all this work is mandatory to avoid helm name limit of 53 chars
+  helm_chart_name = "${lower(substr(replace("chckr-${var.alert_name}", "/\\W/", "-"), 0, 47))}${local.alert_name_sha256_limited}"
+}

tls_checker/versions.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.3.0"
+
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = ">= 3.30.0, <= 3.43.0"
+    }
+    helm = {
+      source  = "hashicorp/helm"
+      version = "<= 2.7.1"
+    }
+  }
+}