add initial deploy for bootstrap api

infra/deploy/auth/variables.tf

@@ -95,12 +95,20 @@ variable "services" {
     {
       domain   = "api" # Must be present
       path     = "accesspackages"
+      domain   = "api"
+      path     = "/accesspackages"
       hostname = "accesspackages"
     },
     {
       domain   = "frontend" # Must be present
+      domain   = "frontend"
       path     = "/"
       hostname = "index"
+    },
+    {
+      domain   = "api"
+      path     = "/bootstrapper"
+      hostname = "bootstrapper"
     }
   ]
 

infra/modules/application_gateway/main.tf

@@ -155,7 +155,7 @@ resource "azurerm_application_gateway" "appgw" {
           name                       = "path_rule_container_app_${path_rule.value.domain}_${path_rule.value.hostname}"
           backend_address_pool_name  = "backend_address_pool_container_app_${path_rule.value.domain}_${path_rule.value.hostname}"
           backend_http_settings_name = "backend_http_settings_container_app_${path_rule.value.domain}_${path_rule.value.hostname}"
-          paths                      = path_rule.value.path == "/" ? ["/*"] : ["/${path_rule.value.path}/*", "/${path_rule.value.path}"]
+          paths                      = path_rule.value.path == "/" ? ["/*"] : ["${path_rule.value.path}/*", path_rule.value.path]
         }
 
         for_each = { for service in var.services : service.hostname => service if url_path_map.key == service.domain }

infra/modules/container_app_api/main.tf

@@ -62,38 +62,29 @@ resource "azurerm_role_assignment" "rbac" {
   principal_id         = azurerm_user_assigned_identity.app.principal_id
   role_definition_name = each.value.role_definition_name
   scope                = each.value.scope
+
   for_each = { for arm in [
     {
       id                   = "service_bus_mass_transit"
       scope                = data.azurerm_servicebus_namespace.sb.id
       role_definition_name = "Azure Service Bus Mass Transit"
-      should_assign        = var.can_use_service_bus
+      should_assign        = var.can_use_auth_service_bus
     },
     {
       id                   = "app_configuration"
       scope                = data.azurerm_app_configuration.appconf.id
       role_definition_name = "App Configuration Data Reader"
-      should_assign        = true
+      should_assign        = var.can_use_auth_app_configuration
     },
     {
       id                   = "key_vault"
       scope                = data.azurerm_key_vault.kv.id
       role_definition_name = "Key Vault Secrets User"
-      should_assign        = true
+      should_assign        = var.can_use_auth_key_vault
     }
   ] : arm.id => arm if try(arm.should_assign, false) }
 }
 
-data "azurerm_postgresql_flexible_server" "server" {
-  name                = "psqlsrvaltinn${local.infrastructure_suffix}"
-  resource_group_name = local.infrastructure_resource_group_name
-}
-
-data "azurerm_user_assigned_identity" "postgres_admin" {
-  name                = "mipsqlsrvadmin${local.infrastructure_suffix}"
-  resource_group_name = local.infrastructure_resource_group_name
-}
-
 resource "azurerm_container_app" "app" {
   name = "ca${local.suffix}"
 
@@ -104,10 +95,10 @@ resource "azurerm_container_app" "app" {
 
   identity {
     type = "UserAssigned"
-    identity_ids = [
-      azurerm_user_assigned_identity.app.id,
-      data.azurerm_user_assigned_identity.postgres_admin.id
-    ]
+    identity_ids = concat(
+      var.user_assigned_identities,
+      [azurerm_user_assigned_identity.app.id],
+    )
   }
 
   ingress {
@@ -127,10 +118,6 @@ resource "azurerm_container_app" "app" {
     max_replicas = var.max_replicas
 
     container {
-      env {
-        name  = "EntraId__Identities__PostgresAdmin__ClientId"
-        value = data.azurerm_user_assigned_identity.postgres_admin.client_id
-      }
       env {
         name  = "EntraId__Identities__Service__ClientId"
         value = azurerm_user_assigned_identity.app.client_id
@@ -140,6 +127,15 @@ resource "azurerm_container_app" "app" {
         value = data.azurerm_app_configuration.appconf.endpoint
       }
 
+      dynamic "env" {
+        content {
+          name  = env.key
+          value = env.value
+        }
+
+        for_each = var.variables
+      }
+
       name  = var.name
       image = var.image
 
@@ -164,4 +160,3 @@ resource "azurerm_container_app_custom_domain" "domain" {
   certificate_binding_type = "Disabled"
   container_app_id         = azurerm_container_app.app.id
 }
-

infra/modules/container_app_api/variables.tf

@@ -14,6 +14,17 @@ variable "location" {
   description = "Specifies the Azure region where the resources will be provisioned (e.g., 'norwayeast')."
 }
 
+variable "variables" {
+  type    = map(string)
+  default = {}
+}
+
+variable "user_assigned_identities" {
+  type        = list(string)
+  default     = []
+  description = "List of principal IDs"
+}
+
 variable "environment" {
   type = string
 }
@@ -31,9 +42,19 @@ variable "registry" {
   default = "ghcr.io"
 }
 
-variable "can_use_service_bus" {
+variable "can_use_auth_service_bus" {
+  type    = bool
+  default = false
+}
+
+variable "can_use_auth_key_vault" {
+  type    = bool
+  default = false
+}
+
+variable "can_use_auth_app_configuration" {
   type    = bool
-  default = true
+  default = false
 }
 
 variable "max_replicas" {

src/apps/Altinn.Authorization.DeployApi/Dockerfile

@@ -0,0 +1,12 @@
+FROM mcr.microsoft.com/dotnet/sdk:8.0-alpine AS build
+WORKDIR /app
+WORKDIR /src
+COPY src/ .
+WORKDIR /src/apps/Altinn.Authorization.DeployApi/src/Altinn.Authorization.DeployApi
+RUN dotnet publish -c Release -o /app
+
+FROM mcr.microsoft.com/dotnet/aspnet:8.0-alpine AS final
+WORKDIR /app
+COPY --from=build /app .
+
+ENTRYPOINT ["dotnet", "Altinn.Authorization.DeployApi.dll"]

src/apps/Altinn.Authorization.DeployApi/deploy/at21.tfvars

@@ -0,0 +1,2 @@
+environment = "at21"
+instance    = "001"

src/apps/Altinn.Authorization.DeployApi/deploy/at22.tfvars

@@ -0,0 +1,2 @@
+environment = "at22"
+instance    = "001"

src/apps/Altinn.Authorization.DeployApi/deploy/at23.tfvars

@@ -0,0 +1,2 @@
+environment = "at23"
+instance    = "001"

src/apps/Altinn.Authorization.DeployApi/deploy/at24.tfvars

@@ -0,0 +1,2 @@
+environment = "at24"
+instance    = "001"

src/apps/Altinn.Authorization.DeployApi/deploy/main.tf

@@ -0,0 +1,37 @@
+terraform {
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "4.1.0"
+    }
+  }
+
+  backend "azurerm" {
+    use_azuread_auth = true
+  }
+}
+provider "azurerm" {
+  use_oidc = true
+  features {}
+}
+
+locals {
+  infrastructure_suffix              = "${var.infrastructure_name}${var.instance}${var.environment}"
+  infrastructure_resource_group_name = "rg${local.infrastructure_suffix}"
+}
+
+data "azurerm_user_assigned_identity" "application_admin" {
+  name                = "miappadmin${local.infrastructure_suffix}"
+  resource_group_name = local.infrastructure_resource_group_name
+}
+
+module "app" {
+  source = "../../../../infra/modules/container_app_api"
+
+  user_assigned_identities = [data.azurerm_user_assigned_identity.application_admin.principal_id]
+
+  instance    = var.instance
+  environment = var.environment
+  name        = "bootstrapper"
+  image       = var.image
+}

src/apps/Altinn.Authorization.DeployApi/deploy/prod.tfvars

@@ -0,0 +1,2 @@
+environment = "prod"
+instance    = "001"

src/apps/Altinn.Authorization.DeployApi/deploy/tt02.tfvars

@@ -0,0 +1,2 @@
+environment = "tt02"
+instance    = "001"

src/apps/Altinn.Authorization.DeployApi/deploy/variables.tf

@@ -0,0 +1,28 @@
+variable "environment" {
+  type        = string
+  description = <<EOT
+Specifies the target environment where the infrastructure will be deployed. 
+It supports specific environment values, including 'at21', 'at22', 'at23', 'at24', 'at25', 'yt01', 'tt02', and 'prod'. 
+This variable is used to differentiate between various deployment environments, such as testing (at/yt), staging (tt02), or (prod).
+  EOT
+  validation {
+    condition     = contains(["at21", "at22", "at23", "at24", "at25", "yt01", "tt02", "prod"], var.environment)
+    error_message = "The environment must be one of the following: at21, at22, at23, at24, at25, yt01, tt02, prod."
+  }
+}
+
+variable "instance" {
+  type        = string
+  description = "A string to represent the specific instance of the deployment, used for resource naming. Used distinguishing between different deployments of the same infrastructure."
+  default     = "001"
+}
+
+variable "image" {
+  type        = string
+  description = "Image of the resource that should be deployed"
+}
+
+variable "infrastructure_name" {
+  type    = string
+  default = "auth"
+}

src/apps/Altinn.Authorization.DeployApi/metadata.json

@@ -0,0 +1,3 @@
+{
+    "image_name": "altinn-authorization-bootstrapper"
+}

src/apps/Altinn.Authorization.DeployApi/src/Altinn.Authorization.DeployApi/Program.cs

@@ -31,6 +31,6 @@
 
 var app = builder.Build();
 
-app.MapPost("/api/v1/database/bootstrap", (BootstrapDatabasePipeline pipeline, HttpContext context) => pipeline.Run(context));
+app.MapPost("bootstrapper/api/v1/databases", (BootstrapDatabasePipeline pipeline, HttpContext context) => pipeline.Run(context));
 
 app.Run();