Enable TLS on Ingress Controller using Cert Manager / Let's Encrypt

.github/workflows/deployment.yaml

@@ -94,7 +94,7 @@ jobs:
           TF_ENV: ${{ steps.set-environment.outputs.tf_env }}
         run: |
           terraform init -backend-config=backend.tfvars
-          terraform workspace select $TF_ENV || terraform workspace new $TF_ENV
+          terraform workspace select -or-create $TF_ENV
           terraform apply -auto-approve -lock-timeout=30m \
             -replace="module.shared.docker_tag.tag_for_azure[\"alerts\"]" \
             -replace="module.shared.docker_tag.tag_for_azure[\"fhir-converter\"]" \
@@ -103,23 +103,3 @@ jobs:
             -replace="module.shared.docker_tag.tag_for_azure[\"tabulation\"]" \
             -replace="module.shared.docker_tag.tag_for_azure[\"validation\"]" \
             -replace="module.shared.docker_tag.tag_for_azure[\"record-linkage\"]"
-
-  azure-cli:
-    name: Run Azure CLI steps
-    needs: terraform
-    runs-on: ubuntu-latest
-    environment: main
-    defaults:
-      run:
-        shell: bash
-        working-directory: ./terraform/implementation
-    steps:
-      - name: Check Out Changes
-        uses: actions/checkout@v3
-
-      - name: Azure login
-        uses: azure/login@v1
-        with:
-          client-id: ${{ secrets.CLIENT_ID }}
-          tenant-id: ${{ secrets.TENANT_ID }}
-          subscription-id: ${{ secrets.SUBSCRIPTION_ID }}

terraform/implementation/backend.tf

@@ -12,6 +12,14 @@ terraform {
       source  = "azure/azapi"
       version = "= 1.8.0"
     }
+    helm = {
+      source  = "hashicorp/helm"
+      version = "= 2.10.1"
+    }
+    kubectl = {
+      source  = "gavinbunney/kubectl"
+      version = ">= 1.14.0"
+    }
     random = {
       source  = "hashicorp/random"
       version = "= 3.5.1"

terraform/implementation/main.tf

@@ -17,6 +17,7 @@ locals {
   services = toset([
     "fhir-converter",
     "ingestion",
+    "ingress",
     "message-parser",
     "validation",
   ])
@@ -212,6 +213,14 @@ resource "azurerm_kubernetes_cluster" "k8s" {
 
 # Helm
 
+provider "kubectl" {
+  host                   = azurerm_kubernetes_cluster.k8s.kube_config.0.host
+  client_certificate     = base64decode(azurerm_kubernetes_cluster.k8s.kube_config.0.client_certificate)
+  client_key             = base64decode(azurerm_kubernetes_cluster.k8s.kube_config.0.client_key)
+  cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.k8s.kube_config.0.cluster_ca_certificate)
+  load_config_file       = false
+}
+
 provider "helm" {
   kubernetes {
     host                   = azurerm_kubernetes_cluster.k8s.kube_config.0.host
@@ -250,6 +259,54 @@ resource "helm_release" "agic" {
   ]
 }
 
+# Cert Manager
+
+resource "helm_release" "cert_manager" {
+  name             = "cert-manager"
+  repository       = "https://charts.jetstack.io"
+  chart            = "cert-manager"
+  namespace        = "cert-manager"
+  create_namespace = true
+  depends_on       = [azurerm_kubernetes_cluster.k8s]
+
+  set {
+    name  = "installCRDs"
+    value = true
+  }
+}
+
+resource "kubectl_manifest" "cert_manager_issuer" {
+  depends_on = [helm_release.cert_manager]
+
+  yaml_body = <<YAML
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    # You must replace this email address with your own.
+    # Let's Encrypt uses this to contact you about expiring
+    # certificates, and issues related to your account.
+    email: [email protected]
+    # ACME server URL for Let’s Encrypt’s staging environment.
+    # The staging environment won't issue trusted certificates but is
+    # used to ensure that the verification process is working properly
+    # before moving to production
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      # Secret resource used to store the account's private key.
+      name: phdi-playground-issuer-account-key-prod
+    # Enable the HTTP-01 challenge provider
+    # you prove ownership of a domain by ensuring that a particular
+    # file is present at the domain
+    solvers:
+      - http01:
+          ingress:
+            class: azure/application-gateway
+YAML
+}
+
 # Helm Releases
 
 resource "helm_release" "building_blocks" {
@@ -274,4 +331,9 @@ resource "helm_release" "building_blocks" {
     name  = "smartyToken"
     value = var.smarty_auth_token
   }
+
+  set {
+    name  = "ingressHostname"
+    value = "${var.resource_group_name}-${terraform.workspace}.${var.location}.cloudapp.azure.com"
+  }
 }