| 1 | locals { |
| 2 | short_name = "aiinvestprd" |
| 3 | tags = { |
| 4 | project = var.project_name |
| 5 | environment = "prd" |
| 6 | managed_by = "terraform" |
| 7 | } |
| 8 | } |
| 9 | |
| 10 | module "resource_group" { |
| 11 | source = "../../modules/resource-group" |
| 12 | name = "rg-${var.project_name}-prd" |
| 13 | location = var.location |
| 14 | tags = local.tags |
| 15 | } |
| 16 | |
| 17 | module "networking" { |
| 18 | source = "../../modules/networking" |
| 19 | resource_group_name = module.resource_group.name |
| 20 | location = module.resource_group.location |
| 21 | project_name = var.project_name |
| 22 | address_space = ["10.42.0.0/16"] |
| 23 | aks_subnet_prefixes = ["10.42.1.0/24"] |
| 24 | tags = local.tags |
| 25 | } |
| 26 | |
| 27 | module "acr" { |
| 28 | source = "../../modules/acr" |
| 29 | name = "${local.short_name}acr" |
| 30 | resource_group_name = module.resource_group.name |
| 31 | location = module.resource_group.location |
| 32 | tags = local.tags |
| 33 | } |
| 34 | |
| 35 | module "key_vault" { |
| 36 | source = "../../modules/key-vault" |
| 37 | name = "${local.short_name}kv" |
| 38 | resource_group_name = module.resource_group.name |
| 39 | location = module.resource_group.location |
| 40 | tenant_id = var.tenant_id |
| 41 | tags = local.tags |
| 42 | } |
| 43 | |
| 44 | module "aks" { |
| 45 | source = "../../modules/aks" |
| 46 | name = "aks-${var.project_name}-prd" |
| 47 | resource_group_name = module.resource_group.name |
| 48 | location = module.resource_group.location |
| 49 | dns_prefix = "ai-investment-prd" |
| 50 | subnet_id = module.networking.aks_subnet_id |
| 51 | private_cluster_enabled = var.aks_private_cluster_enabled |
| 52 | local_account_disabled = var.aks_local_account_disabled |
| 53 | tags = local.tags |
| 54 | } |
| 55 | |
| 56 | resource "azurerm_role_assignment" "aks_acr_pull" { |
| 57 | scope = module.acr.id |
| 58 | role_definition_name = "AcrPull" |
| 59 | principal_id = module.aks.kubelet_identity_object_id |
| 60 | } |
| 61 | |
| 62 | resource "azurerm_user_assigned_identity" "platform_workload" { |
| 63 | name = "id-${var.project_name}-prd-workload" |
| 64 | resource_group_name = module.resource_group.name |
| 65 | location = module.resource_group.location |
| 66 | tags = local.tags |
| 67 | } |
| 68 | |
| 69 | resource "azurerm_federated_identity_credential" "platform_workload" { |
| 70 | name = "fic-${var.project_name}-prd" |
| 71 | parent_id = azurerm_user_assigned_identity.platform_workload.id |
| 72 | issuer = module.aks.oidc_issuer_url |
| 73 | audience = ["api://AzureADTokenExchange"] |
| 74 | subject = "system:serviceaccount:${var.workload_identity_namespace}:${var.workload_identity_service_account}" |
| 75 | } |
| 76 | |
| 77 | resource "azurerm_role_assignment" "platform_key_vault_secrets" { |
| 78 | scope = module.key_vault.id |
| 79 | role_definition_name = "Key Vault Secrets User" |
| 80 | principal_id = azurerm_user_assigned_identity.platform_workload.principal_id |
| 81 | } |