feat: Zabbix poc

src/.env/dev/terraform.tfvars

@@ -21,25 +21,26 @@ key_vault_name    = "dvopla-d-neu-kv"
 key_vault_rg_name = "dvopla-d-sec-rg"
 
 # ☁️ networking
-cidr_vnet                             = ["10.1.0.0/16"]
-cidr_subnet_k8s                       = ["10.1.0.0/17"]
-cidr_subnet_appgateway                = ["10.1.128.0/24"]
-cidr_subnet_postgres                  = ["10.1.129.0/24"]
-cidr_subnet_azdoa                     = ["10.1.130.0/24"]
-cidr_subnet_app_docker                = ["10.1.132.0/24"]
-cidr_subnet_flex_dbms                 = ["10.1.133.0/24"]
-cidr_subnet_apim                      = ["10.1.136.0/24"]
-cidr_subnet_appgateway_beta           = ["10.1.138.0/24"]
-cidr_subnet_vpn                       = ["10.1.139.0/24"]
-cidr_subnet_dnsforwarder              = ["10.1.140.0/29"]
-cidr_subnet_private_endpoints         = ["10.1.141.0/24"]
-cidr_subnet_eventhub                  = ["10.1.142.0/24"]
-cidr_subnet_redis                     = ["10.1.143.0/24"]
-cidr_subnet_funcs_diego_domain        = ["10.1.144.0/24"]
-cidr_subnet_app_diego_app             = ["10.1.145.0/24"]
-cidr_subnet_container_apps            = ["10.1.146.0/23"]
-cidr_subnet_github_runner_self_hosted = ["10.1.148.0/23"]
-cidr_subnet_container_apps_dapr       = ["10.1.150.0/23"] #placeholder
+cidr_vnet                      = ["10.1.0.0/16"]
+cidr_subnet_k8s                = ["10.1.0.0/17"]
+cidr_subnet_appgateway         = ["10.1.128.0/24"]
+cidr_subnet_postgres           = ["10.1.129.0/24"]
+cidr_subnet_azdoa              = ["10.1.130.0/24"]
+cidr_subnet_app_docker         = ["10.1.132.0/24"]
+cidr_subnet_flex_dbms          = ["10.1.133.0/24"]
+cidr_subnet_apim               = ["10.1.136.0/24"]
+cidr_subnet_appgateway_beta    = ["10.1.138.0/24"]
+cidr_subnet_vpn                = ["10.1.139.0/24"]
+cidr_subnet_dnsforwarder       = ["10.1.140.0/29"]
+cidr_subnet_private_endpoints  = ["10.1.141.0/24"]
+cidr_subnet_eventhub           = ["10.1.142.0/24"]
+cidr_subnet_redis              = ["10.1.143.0/24"]
+cidr_subnet_funcs_diego_domain = ["10.1.144.0/24"]
+cidr_subnet_pg_flex_zabbix     = ["10.1.146.0/24"]
+cidr_subnet_zabbix_server      = ["10.1.147.0/24"]
+# cidr_subnet_github_runner_self_hosted = ["10.1.148.0/23"]
+# cidr_subnet_container_apps_dapr       = ["10.1.150.0/23"] #placeholder
+cidr_subnet_container_app_diego_env = ["10.1.250.0/23"]
 
 # dns
 prod_dns_zone_prefix = "devopslab"

src/domains/diego-app/00_key_vault.tf

@@ -4,7 +4,7 @@ data "azurerm_key_vault" "kv_domain" {
 }
 
 module "domain_key_vault_secrets_query" {
-  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault_secrets_query?ref=v6.20.1"
+  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault_secrets_query?ref=v7.2.0"
 
   key_vault_name = local.key_vault_domain_name
   resource_group = local.key_vault_domain_resource_group

src/domains/diego-app/00_network.tf

@@ -1,8 +1,8 @@
+data "azurerm_resource_group" "rg_vnet_core" {
+  name = local.vnet_core_resource_group_name
+}
+
 data "azurerm_virtual_network" "vnet_core" {
   name                = local.vnet_core_name
   resource_group_name = local.vnet_core_resource_group_name
 }
-
-data "azurerm_resource_group" "rg_vnet_core" {
-  name = local.vnet_core_resource_group_name
-}

src/domains/diego-app/02_namespace_domain.tf

@@ -5,7 +5,7 @@ resource "kubernetes_namespace" "domain_namespace" {
 }
 
 module "domain_pod_identity" {
-  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_pod_identity?ref=v6.20.2"
+  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_pod_identity?ref=v7.2.0"
 
   resource_group_name = local.aks_resource_group_name
   location            = var.location

src/domains/diego-app/10_zabbix_vm.tf

@@ -0,0 +1,74 @@
+data "azurerm_resource_group" "zabbix" {
+  name = "${local.project}-zabbix"
+}
+
+resource "azurerm_subnet" "zabbix" {
+  name                 = "zabbix-internal"
+  resource_group_name  = data.azurerm_resource_group.rg_vnet_core.name
+  virtual_network_name = data.azurerm_virtual_network.vnet_core.name
+  address_prefixes     = var.cidr_subnet_zabbix_server
+}
+
+resource "azurerm_network_interface" "zabbix_nic" {
+  name                = "zabbix-nic"
+  location            = data.azurerm_resource_group.zabbix.location
+  resource_group_name = data.azurerm_resource_group.zabbix.name
+
+  ip_configuration {
+    name                          = "internal"
+    subnet_id                     = azurerm_subnet.zabbix.id
+    private_ip_address_allocation = "Dynamic"
+  }
+}
+
+resource "tls_private_key" "zabbix_key" {
+  algorithm = "RSA"
+  rsa_bits  = 4096
+}
+
+resource "azurerm_key_vault_secret" "zabbix_private_key" {
+  name         = "zabbix-private-key"
+  value        = tls_private_key.zabbix_key.private_key_openssh
+  content_type = "text/plain"
+
+  key_vault_id = data.azurerm_key_vault.kv_domain.id
+}
+
+resource "azurerm_key_vault_secret" "zabbix_public_key" {
+  name         = "zabbix-public-key"
+  value        = tls_private_key.zabbix_key.public_key_openssh
+  content_type = "text/plain"
+
+  key_vault_id = data.azurerm_key_vault.kv_domain.id
+}
+
+#store ssh public key
+resource "azurerm_ssh_public_key" "zabbix_public_key" {
+  name                = "zabbix-admin-access-key"
+  resource_group_name = data.azurerm_resource_group.zabbix.name
+  location            = data.azurerm_resource_group.zabbix.location
+  public_key          = tls_private_key.zabbix_key.public_key_openssh
+}
+
+resource "azurerm_linux_virtual_machine" "zabbix_vm" {
+  name                = "${local.project}-zabbix"
+  resource_group_name = data.azurerm_resource_group.zabbix.name
+  location            = data.azurerm_resource_group.zabbix.location
+  size                = "Standard_B2s"
+  admin_username      = "zabbix"
+  network_interface_ids = [
+    azurerm_network_interface.zabbix_nic.id,
+  ]
+
+  admin_ssh_key {
+    username   = "zabbix"
+    public_key = tls_private_key.zabbix_key.public_key_openssh
+  }
+
+  os_disk {
+    caching              = "ReadWrite"
+    storage_account_type = "Standard_LRS"
+  }
+
+  source_image_id = "/subscriptions/ac17914c-79bf-48fa-831e-1359ef74c1d5/resourceGroups/dvopla-d-azdoa-rg/providers/Microsoft.Compute/images/azdo-agent-ubuntu2204-image-v2"
+}

src/domains/diego-app/80_middleware_tools.tf

@@ -1,5 +1,5 @@
 module "tls_checker" {
-  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//tls_checker?ref=v6.20.1"
+  source = "git::https://github.com/pagopa/terraform-azurerm-v3.git//tls_checker?ref=v7.2.0"
 
   https_endpoint                                            = local.domain_aks_hostname
   alert_name                                                = local.domain_aks_hostname
@@ -20,7 +20,7 @@ module "tls_checker" {
 
 
 module "cert_mounter" {
-  source           = "git::https://github.com/pagopa/terraform-azurerm-v3.git//cert_mounter?ref=v6.20.1"
+  source           = "git::https://github.com/pagopa/terraform-azurerm-v3.git//cert_mounter?ref=v7.2.0"
   namespace        = var.domain
   certificate_name = replace(local.domain_aks_hostname, ".", "-")
   kv_name          = data.azurerm_key_vault.kv_domain.name

src/domains/diego-app/99_variables.tf

@@ -205,6 +205,11 @@ variable "cidr_subnet_container_apps" {
   description = "Subnet for container apps in diego domain"
 }
 
+variable "cidr_subnet_zabbix_server" {
+  type        = list(string)
+  description = "Subnet for zabbix vm"
+}
+
 #
 # Tls Checker
 #

src/domains/diego-app/README.md

@@ -14,10 +14,10 @@
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_cert_mounter"></a> [cert\_mounter](#module\_cert\_mounter) | git::https://github.com/pagopa/terraform-azurerm-v3.git//cert_mounter | v6.20.1 |
-| <a name="module_domain_key_vault_secrets_query"></a> [domain\_key\_vault\_secrets\_query](#module\_domain\_key\_vault\_secrets\_query) | git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault_secrets_query | v6.20.1 |
-| <a name="module_domain_pod_identity"></a> [domain\_pod\_identity](#module\_domain\_pod\_identity) | git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_pod_identity | v6.20.2 |
-| <a name="module_tls_checker"></a> [tls\_checker](#module\_tls\_checker) | git::https://github.com/pagopa/terraform-azurerm-v3.git//tls_checker | v6.20.1 |
+| <a name="module_cert_mounter"></a> [cert\_mounter](#module\_cert\_mounter) | git::https://github.com/pagopa/terraform-azurerm-v3.git//cert_mounter | v7.2.0 |
+| <a name="module_domain_key_vault_secrets_query"></a> [domain\_key\_vault\_secrets\_query](#module\_domain\_key\_vault\_secrets\_query) | git::https://github.com/pagopa/terraform-azurerm-v3.git//key_vault_secrets_query | v7.2.0 |
+| <a name="module_domain_pod_identity"></a> [domain\_pod\_identity](#module\_domain\_pod\_identity) | git::https://github.com/pagopa/terraform-azurerm-v3.git//kubernetes_pod_identity | v7.2.0 |
+| <a name="module_tls_checker"></a> [tls\_checker](#module\_tls\_checker) | git::https://github.com/pagopa/terraform-azurerm-v3.git//tls_checker | v7.2.0 |
 
 ## Resources
 
@@ -29,8 +29,14 @@
 | [azurerm_key_vault_secret.app_insights_connection_string](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |
 | [azurerm_key_vault_secret.azure_devops_sa_cacrt](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |
 | [azurerm_key_vault_secret.azure_devops_sa_token](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |
+| [azurerm_key_vault_secret.zabbix_private_key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |
+| [azurerm_key_vault_secret.zabbix_public_key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_secret) | resource |
+| [azurerm_linux_virtual_machine.zabbix_vm](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/linux_virtual_machine) | resource |
+| [azurerm_network_interface.zabbix_nic](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/network_interface) | resource |
 | [azurerm_private_dns_a_record.ingress](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_dns_a_record) | resource |
 | [azurerm_role_assignment.aks_cluster_role](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/role_assignment) | resource |
+| [azurerm_ssh_public_key.zabbix_public_key](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/ssh_public_key) | resource |
+| [azurerm_subnet.zabbix](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/subnet) | resource |
 | [helm_release.reloader](https://registry.terraform.io/providers/hashicorp/helm/2.7.1/docs/resources/release) | resource |
 | [kubernetes_config_map.added](https://registry.terraform.io/providers/hashicorp/kubernetes/2.17.0/docs/resources/config_map) | resource |
 | [kubernetes_config_map.changed](https://registry.terraform.io/providers/hashicorp/kubernetes/2.17.0/docs/resources/config_map) | resource |
@@ -42,6 +48,7 @@
 | [kubernetes_secret_v1.azure_devops_service_account_default_secret](https://registry.terraform.io/providers/hashicorp/kubernetes/2.17.0/docs/resources/secret_v1) | resource |
 | [kubernetes_service_account.azure_devops](https://registry.terraform.io/providers/hashicorp/kubernetes/2.17.0/docs/resources/service_account) | resource |
 | [null_resource.aks_with_iac_aad_plus_namespace_ci](https://registry.terraform.io/providers/hashicorp/null/3.2.1/docs/resources/resource) | resource |
+| [tls_private_key.zabbix_key](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
 | [azuread_group.adgroup_admin](https://registry.terraform.io/providers/hashicorp/azuread/2.21.0/docs/data-sources/group) | data source |
 | [azuread_group.adgroup_developers](https://registry.terraform.io/providers/hashicorp/azuread/2.21.0/docs/data-sources/group) | data source |
 | [azuread_group.adgroup_externals](https://registry.terraform.io/providers/hashicorp/azuread/2.21.0/docs/data-sources/group) | data source |
@@ -59,6 +66,7 @@
 | [azurerm_private_dns_zone.internal](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/private_dns_zone) | data source |
 | [azurerm_resource_group.monitor_rg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/resource_group) | data source |
 | [azurerm_resource_group.rg_vnet_core](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/resource_group) | data source |
+| [azurerm_resource_group.zabbix](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/resource_group) | data source |
 | [azurerm_subscription.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/subscription) | data source |
 | [azurerm_virtual_network.vnet_core](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/virtual_network) | data source |
 | [kubernetes_secret.azure_devops_secret](https://registry.terraform.io/providers/hashicorp/kubernetes/2.17.0/docs/data-sources/secret) | data source |
@@ -71,6 +79,7 @@
 | <a name="input_aks_name"></a> [aks\_name](#input\_aks\_name) | AKS cluster name | `string` | n/a | yes |
 | <a name="input_aks_resource_group_name"></a> [aks\_resource\_group\_name](#input\_aks\_resource\_group\_name) | AKS cluster resource name | `string` | n/a | yes |
 | <a name="input_cidr_subnet_container_apps"></a> [cidr\_subnet\_container\_apps](#input\_cidr\_subnet\_container\_apps) | Subnet for container apps in diego domain | `list(string)` | n/a | yes |
+| <a name="input_cidr_subnet_zabbix_server"></a> [cidr\_subnet\_zabbix\_server](#input\_cidr\_subnet\_zabbix\_server) | Subnet for zabbix vm | `list(string)` | n/a | yes |
 | <a name="input_dns_zone_internal_prefix"></a> [dns\_zone\_internal\_prefix](#input\_dns\_zone\_internal\_prefix) | The dns subdomain. | `string` | `null` | no |
 | <a name="input_dns_zone_prefix"></a> [dns\_zone\_prefix](#input\_dns\_zone\_prefix) | The dns subdomain. | `string` | n/a | yes |
 | <a name="input_domain"></a> [domain](#input\_domain) | n/a | `string` | n/a | yes |

src/domains/diego-app/env/dev/terraform.tfvars

@@ -50,6 +50,7 @@ dns_zone_internal_prefix = "internal.devopslab"
 # VNET
 #
 cidr_subnet_container_apps = ["10.1.146.0/23"]
+cidr_subnet_zabbix_server  = ["10.1.147.0/24"]
 
 #
 # TLS Checker