From 13f1e0b319cf5316e4346b2e29f0fb350bfb2dc4 Mon Sep 17 00:00:00 2001 From: "james.macbeth" Date: Fri, 14 Aug 2026 13:47:27 +0100 Subject: [PATCH] PAROM-7 - Create hmpps-parom-service-preprod namespace --- .../00-namespace.yaml | 17 ++++ .../hmpps-parom-service-preprod/01-rbac.yaml | 23 +++++ .../02-limitrange.yaml | 15 +++ .../03-resourcequota.yaml | 9 ++ .../04-networkpolicy.yaml | 28 ++++++ .../06-certificate.yaml | 29 ++++++ .../07-rbac-haar-client-admin-team.yaml | 39 ++++++++ .../resources/api.tf | 18 ++++ .../resources/audit-queue.tf | 14 +++ .../resources/irsa.tf | 29 ++++++ .../resources/main.tf | 45 +++++++++ .../resources/queue.tf | 98 +++++++++++++++++++ .../resources/rds.tf | 60 ++++++++++++ .../scheduled-downtime-serviceaccount.tf | 23 +++++ .../resources/topic.tf | 13 +++ .../resources/ui.tf | 56 +++++++++++ .../resources/variables.tf | 72 ++++++++++++++ .../resources/versions.tf | 18 ++++ 18 files changed, 606 insertions(+) create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/00-namespace.yaml create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/01-rbac.yaml create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/02-limitrange.yaml create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/03-resourcequota.yaml create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/04-networkpolicy.yaml create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/06-certificate.yaml create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/07-rbac-haar-client-admin-team.yaml create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/api.tf create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/audit-queue.tf create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/irsa.tf create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/main.tf create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/queue.tf create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/rds.tf create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/scheduled-downtime-serviceaccount.tf create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/topic.tf create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/ui.tf create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/variables.tf create mode 100644 namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/versions.tf diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/00-namespace.yaml b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/00-namespace.yaml new file mode 100644 index 00000000000..3311f7822c8 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/00-namespace.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: hmpps-parom-service-preprod + labels: + cloud-platform.justice.gov.uk/is-production: "false" + cloud-platform.justice.gov.uk/environment-name: "preprod" + pod-security.kubernetes.io/enforce: restricted + annotations: + cloud-platform.justice.gov.uk/business-unit: "HMPPS" + cloud-platform.justice.gov.uk/slack-channel: "ndelius_service_team" + cloud-platform.justice.gov.uk/slack-alert-channel: "hmpps-parom-notifications" + cloud-platform.justice.gov.uk/application: "HMPPS Parom Service" + cloud-platform.justice.gov.uk/owner: "National Delius Service Team / Unilink " + cloud-platform.justice.gov.uk/source-code: "https://github.com/ministryofjustice/hmpps-parom-service-ui" + cloud-platform.justice.gov.uk/team-name: "unilink" diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/01-rbac.yaml b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/01-rbac.yaml new file mode 100644 index 00000000000..5c8e2d766bc --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/01-rbac.yaml @@ -0,0 +1,23 @@ +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: hmpps-parom-service-preprod-admin + namespace: hmpps-parom-service-preprod +subjects: + - kind: Group + name: "github:unilink" + apiGroup: rbac.authorization.k8s.io + - kind: Group + name: "github:version-1-sit-team" # Version1 team access to support testing + apiGroup: rbac.authorization.k8s.io +############## COPY - DO NOT REPLACE ############## + - kind: Group + name: "github:hmpps-sre" + apiGroup: rbac.authorization.k8s.io +# hmpps-sre group is required for support functions +################################################### +roleRef: + kind: ClusterRole + name: admin + apiGroup: rbac.authorization.k8s.io diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/02-limitrange.yaml b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/02-limitrange.yaml new file mode 100644 index 00000000000..3d9e78ae162 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/02-limitrange.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: v1 +kind: LimitRange +metadata: + name: limitrange + namespace: hmpps-parom-service-preprod +spec: + limits: + - default: + cpu: 2000m + memory: 1024Mi + defaultRequest: + cpu: 10m + memory: 512Mi + type: Container \ No newline at end of file diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/03-resourcequota.yaml b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/03-resourcequota.yaml new file mode 100644 index 00000000000..c585d9bf60b --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/03-resourcequota.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: v1 +kind: ResourceQuota +metadata: + name: namespace-quota + namespace: hmpps-parom-service-preprod +spec: + hard: + pods: "50" diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/04-networkpolicy.yaml b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/04-networkpolicy.yaml new file mode 100644 index 00000000000..d80e7fc9477 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/04-networkpolicy.yaml @@ -0,0 +1,28 @@ +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default + namespace: hmpps-parom-service-preprod +spec: + podSelector: {} + policyTypes: + - Ingress + ingress: + - from: + - podSelector: {} +--- +kind: NetworkPolicy +apiVersion: networking.k8s.io/v1 +metadata: + name: allow-ingress-controllers + namespace: hmpps-parom-service-preprod +spec: + podSelector: {} + policyTypes: + - Ingress + ingress: + - from: + - namespaceSelector: + matchLabels: + component: ingress-controllers diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/06-certificate.yaml b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/06-certificate.yaml new file mode 100644 index 00000000000..1438ed617e6 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/06-certificate.yaml @@ -0,0 +1,29 @@ +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: hmpps-parom-service-api-cert + namespace: hmpps-parom-service-preprod +spec: + secretName: hmpps-parom-service-api-cert + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + dnsNames: + - parom-service-api-preprod.hmpps.service.justice.gov.uk + - '*.parom-service-api-preprod.hmpps.service.justice.gov.uk' + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: hmpps-parom-service-ui-cert + namespace: hmpps-parom-service-preprod +spec: + secretName: hmpps-parom-service-ui-cert + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + dnsNames: + - parom-service-ui-preprod.hmpps.service.justice.gov.uk + - '*.parom-service-ui-preprod.hmpps.service.justice.gov.uk' diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/07-rbac-haar-client-admin-team.yaml b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/07-rbac-haar-client-admin-team.yaml new file mode 100644 index 00000000000..908ca552918 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/07-rbac-haar-client-admin-team.yaml @@ -0,0 +1,39 @@ +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: hmpps-haar-client-admin-team + namespace: hmpps-parom-service-preprod +rules: + - apiGroups: ["extensions", "apps"] + resources: ["deployments"] + verbs: ["get", "list", "watch", "create", "update", "patch"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch", "create", "update", "patch"] + - apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list", "watch", "create", "update", "patch"] + - apiGroups: ["cert-manager.io"] + resources: ["certificates", "issuers"] + verbs: ["get", "list", "watch", "create", "update", "patch"] + - apiGroups: [ "", "extensions" ] + resources: [ "services", "ingresses", "configmaps", "pods/log" ] + verbs: [ "get", "list", "watch" ] + - apiGroups: [""] + resources: ["events"] + verbs: [ "get", "list", "watch", "create", "update", "patch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: hmpps-haar-client-admin-team + namespace: hmpps-parom-service-preprod +subjects: + - kind: Group + name: "github:hmpps-haar-client-admin" + apiGroup: rbac.authorization.k8s.io +roleRef: + kind: Role + name: hmpps-haar-client-admin-team + apiGroup: rbac.authorization.k8s.io diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/api.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/api.tf new file mode 100644 index 00000000000..6a49d9c46a0 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/api.tf @@ -0,0 +1,18 @@ +module "hmpps_template_kotlin" { + source = "github.com/ministryofjustice/cloud-platform-terraform-hmpps-template?ref=1.2.1" + force_rotate_token = true + custom_token_rotation_date = "2026-03-20" + github_repo = "hmpps-parom-service-api" + application = "hmpps-parom-service-api" + github_team = "unilink" + environment = var.environment_name # Should match environment name used in helm values file e.g. values-dev.yaml + reviewer_teams = ["unilink_admin"] # Optional team that should review deployments to this environment. + selected_branch_patterns = ["main"] # Optional + #protected_branches_only = true # Optional, defaults to true unless selected_branch_patterns is set + is_production = var.is_production + application_insights_instance = "preprod" # Either "dev", "preprod" or "prod" + source_template_repo = "hmpps-template-kotlin" + github_token = var.github_token + namespace = var.namespace + kubernetes_cluster = var.kubernetes_cluster +} diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/audit-queue.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/audit-queue.tf new file mode 100644 index 00000000000..76cbfe79309 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/audit-queue.tf @@ -0,0 +1,14 @@ +locals { + audit_queue_name = "Digital-Prison-Services-${var.environment_name}-hmpps_audit_queue" +} + +resource "kubernetes_secret" "hmpps_audit_config" { + metadata { + namespace = var.namespace + name = "hmpps-audit" + } + data = { + sqs_queue_url = "https://sqs.eu-west-2.amazonaws.com/754256621582/${local.audit_queue_name}" + sqs_queue_name = local.audit_queue_name + } +} diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/irsa.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/irsa.tf new file mode 100644 index 00000000000..af2056c7361 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/irsa.tf @@ -0,0 +1,29 @@ +data "aws_ssm_parameter" "audit_irsa_policy_arn" { + name = "/hmpps-audit-${var.environment_name}/sqs/${local.audit_queue_name}/irsa-policy-arn" +} + +data "aws_ssm_parameter" "domain_events_policy_arn" { + name = "/hmpps-domain-events-${var.environment_name}/sns/${var.domain_events_topic_name}/irsa-policy-arn" +} + +module "irsa" { + source = "github.com/ministryofjustice/cloud-platform-terraform-irsa?ref=2.1.0" + + eks_cluster_name = var.eks_cluster_name + service_account_name = "hmpps-parom-service" + namespace = var.namespace + role_policy_arns = { + domain_events_queue = module.queue.irsa_policy_arn, + domain_events_dlq = module.dead-letter-queue.irsa_policy_arn, + domain_events_topic = data.aws_ssm_parameter.domain_events_policy_arn.value, + audit_queue = data.aws_ssm_parameter.audit_irsa_policy_arn.value, + } + + # Tags + business_unit = var.business_unit + application = var.application + is_production = var.is_production + team_name = var.team_name + environment_name = var.environment_name + infrastructure_support = var.infrastructure_support +} diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/main.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/main.tf new file mode 100644 index 00000000000..844c353f5e7 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/main.tf @@ -0,0 +1,45 @@ +terraform { + backend "s3" { + } +} + +provider "aws" { + region = "eu-west-2" + + default_tags { + tags = { + # see https://user-guide.cloud-platform.service.justice.gov.uk/documentation/getting-started/accessing-the-cloud-console.html + GithubTeam = var.team_name + } + } +} + +provider "aws" { + alias = "london" + region = "eu-west-2" + + default_tags { + tags = { + # see https://user-guide.cloud-platform.service.justice.gov.uk/documentation/getting-started/accessing-the-cloud-console.html + GithubTeam = var.team_name + } + } +} + +provider "aws" { + alias = "ireland" + region = "eu-west-1" + + default_tags { + tags = { + # see https://user-guide.cloud-platform.service.justice.gov.uk/documentation/getting-started/accessing-the-cloud-console.html + GithubTeam = var.team_name + } + } +} +provider "github" { + token = var.github_token + owner = var.github_owner +} + +provider "kubernetes" {} diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/queue.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/queue.tf new file mode 100644 index 00000000000..f7e20b04517 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/queue.tf @@ -0,0 +1,98 @@ +resource "aws_sns_topic_subscription" "queue-subscription" { + + topic_arn = data.aws_sns_topic.hmpps-domain-events.arn + protocol = "sqs" + endpoint = module.queue.sqs_arn + filter_policy = jsonencode({ + eventType = [ + "probation-case.merge.completed", + "probation-case.unmerge.completed", + "probation-case.sentence.moved", + "probation-case.deleted.gdpr" + ] + }) +} + +module "queue" { + source = "github.com/ministryofjustice/cloud-platform-terraform-sqs?ref=5.1.2" + + # Queue configuration + sqs_name = "hmpps-parom-service-queue" + redrive_policy = jsonencode({ + deadLetterTargetArn = module.dead-letter-queue.sqs_arn + maxReceiveCount = 3 + }) + + # Tags + application = var.application + business_unit = var.business_unit + environment_name = var.environment_name + infrastructure_support = var.infrastructure_support + is_production = var.is_production + namespace = var.namespace + team_name = var.team_name # also used as queue name prefix +} + +data "aws_iam_policy_document" "sns_to_sqs" { + statement { + sid = "DomainEventsToQueue" + effect = "Allow" + actions = ["sqs:SendMessage"] + principals { + type = "AWS" + identifiers = ["*"] + } + condition { + variable = "aws:SourceArn" + test = "ArnEquals" + values = [data.aws_sns_topic.hmpps-domain-events.arn] + } + resources = ["*"] + } +} + +resource "aws_sqs_queue_policy" "queue-policy" { + queue_url = module.queue.sqs_id + policy = data.aws_iam_policy_document.sns_to_sqs.json +} + +module "dead-letter-queue" { + source = "github.com/ministryofjustice/cloud-platform-terraform-sqs?ref=5.1.2" + + # Queue configuration + sqs_name = "hmpps-parom-service-dlq" + message_retention_seconds = 7 * 24 * 3600 # 1 week + + # Tags + application = var.application + business_unit = var.business_unit + environment_name = var.environment_name + infrastructure_support = var.infrastructure_support + is_production = var.is_production + namespace = var.namespace + team_name = var.team_name # also used as queue name prefix +} + +resource "kubernetes_secret" "queue-secret" { + metadata { + namespace = var.namespace + name = "sqs-queue" + } + data = { + sqs_queue_url = module.queue.sqs_id + sqs_queue_arn = module.queue.sqs_arn + sqs_queue_name = module.queue.sqs_name + } +} + +resource "kubernetes_secret" "dlq-secret" { + metadata { + namespace = var.namespace + name = "sqs-dlq" + } + data = { + sqs_queue_url = module.dead-letter-queue.sqs_id + sqs_queue_arn = module.dead-letter-queue.sqs_arn + sqs_queue_name = module.dead-letter-queue.sqs_name + } +} diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/rds.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/rds.tf new file mode 100644 index 00000000000..5ef8747242d --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/rds.tf @@ -0,0 +1,60 @@ +module "rds" { + source = "github.com/ministryofjustice/cloud-platform-terraform-rds-instance?ref=9.2.0" + vpc_name = var.vpc_name + team_name = var.team_name + business_unit = var.business_unit + application = var.application + is_production = var.is_production + namespace = var.namespace + + # rotating creds + db_password_rotated_date = "2026-05-22" + + # enable performance insights + performance_insights_enabled = true + # db instance class + db_instance_class = "db.t4g.small" + + # change the postgres version as you see fit. + db_engine_version = "17" + environment_name = var.environment_name + infrastructure_support = var.infrastructure_support + maintenance_window = var.maintenance_window + + prepare_for_major_upgrade = false + allow_major_version_upgrade = true + + # rds_family should be one of: postgres9.4, postgres9.5, postgres9.6, postgres10, postgres11 + # Pick the one that defines the postgres version the best + rds_family = "postgres17" + + enable_rds_auto_start_stop = true +} + +resource "kubernetes_secret" "rds" { + metadata { + name = "rds-instance-output" + namespace = var.namespace + } + + data = { + rds_instance_endpoint = module.rds.rds_instance_endpoint + database_name = module.rds.database_name + database_username = module.rds.database_username + database_password = module.rds.database_password + rds_instance_address = module.rds.rds_instance_address + } +} + +resource "kubernetes_config_map" "rds" { + metadata { + name = "rds-instance-output" + namespace = var.namespace + } + + data = { + database_name = module.rds.database_name + db_identifier = module.rds.db_identifier + + } +} diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/scheduled-downtime-serviceaccount.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/scheduled-downtime-serviceaccount.tf new file mode 100644 index 00000000000..2fefe3cb486 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/scheduled-downtime-serviceaccount.tf @@ -0,0 +1,23 @@ +module "scheduled_downtime_service_account" { + source = "github.com/ministryofjustice/cloud-platform-terraform-serviceaccount?ref=1.2.0" + + namespace = var.namespace + kubernetes_cluster = var.kubernetes_cluster + + serviceaccount_name = "scheduled-downtime-serviceaccount" + role_name = "scheduled-downtime-serviceaccount-role" + rolebinding_name = "scheduled-downtime-serviceaccount-rolebinding" + serviceaccount_rules = [ + { + api_groups = ["apps"] + resources = ["deployments"] + verbs = ["get"] + }, + { + api_groups = ["apps"] + resources = ["deployments/scale"] + verbs = ["get", "update", "patch"] + } + ] + serviceaccount_token_rotated_date = "2026-05-22" +} \ No newline at end of file diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/topic.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/topic.tf new file mode 100644 index 00000000000..86c08587b09 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/topic.tf @@ -0,0 +1,13 @@ +data "aws_sns_topic" "hmpps-domain-events" { + name = var.domain_events_topic_name +} + +resource "kubernetes_secret" "topic-secret" { + metadata { + namespace = var.namespace + name = "hmpps-domain-events" + } + data = { + topic_arn = data.aws_sns_topic.hmpps-domain-events.arn + } +} diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/ui.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/ui.tf new file mode 100644 index 00000000000..f7c7a450a25 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/ui.tf @@ -0,0 +1,56 @@ +module "hmpps_template_typescript" { + source = "github.com/ministryofjustice/cloud-platform-terraform-hmpps-template?ref=1.2.1" + force_rotate_token = true + custom_token_rotation_date = "2026-03-20" + github_repo = "hmpps-parom-service-ui" + application = "hmpps-parom-service-ui" + github_team = "unilink" + environment = var.environment_name # Should match environment name used in helm values file e.g. values-dev.yaml + reviewer_teams = ["unilink_admin"] # Optional team that should review deployments to this environment. + selected_branch_patterns = ["main"] # Optional + #protected_branches_only = true # Optional, defaults to true unless selected_branch_patterns is set + is_production = var.is_production + application_insights_instance = "preprod" # Either "dev", "preprod" or "prod" + source_template_repo = "hmpps-template-typescript" + github_token = var.github_token + namespace = var.namespace + kubernetes_cluster = var.kubernetes_cluster +} + + +# Note, redis is a requirement for hmpps-template-typescript application. +module "elasticache_redis" { + source = "github.com/ministryofjustice/cloud-platform-terraform-elasticache-cluster?ref=8.2.0" + vpc_name = var.vpc_name + team_name = var.team_name + business_unit = var.business_unit + application = module.hmpps_template_typescript.application + is_production = var.is_production + namespace = var.namespace + environment_name = var.environment_name + infrastructure_support = var.infrastructure_support + + number_cache_clusters = var.number_cache_clusters + # sized for micro in dev, preprod, suggest small for production + node_type = "cache.t4g.micro" + engine_version = "7.0" + parameter_group_name = "default.redis7" + + providers = { + aws = aws.london + } +} + +resource "kubernetes_secret" "elasticache_redis" { + metadata { + name = "${module.hmpps_template_typescript.application}-elasticache-redis" + namespace = var.namespace + } + + data = { + primary_endpoint_address = module.elasticache_redis.primary_endpoint_address + auth_token = module.elasticache_redis.auth_token + member_clusters = jsonencode(module.elasticache_redis.member_clusters) + replication_group_id = module.elasticache_redis.replication_group_id + } +} diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/variables.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/variables.tf new file mode 100644 index 00000000000..3833d8bb6d9 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/variables.tf @@ -0,0 +1,72 @@ +variable "vpc_name" { +} + +variable "kubernetes_cluster" { +} + +variable "eks_cluster_name" { +} + +variable "application" { + description = "Name of Application you are deploying" + default = "HMPPS PAROM" +} + +variable "namespace" { + default = "hmpps-parom-service-preprod" +} + +variable "business_unit" { + description = "Area of the MOJ responsible for the service." + default = "HMPPS" +} + +variable "team_name" { + description = "The name of your development team" + default = "unilink" +} + +#################################################################################################################### +### Change this environment to the environment name corresponding to this namespace (as per helm/values-ENV.dev) ### +variable "environment_name" { + description = "The type of environment you're deploying to." + default = "preprod" +} +#################################################################################################################### + +variable "infrastructure_support" { + description = "The team responsible for managing the infrastructure. Should be of the form team-email." + default = "hmpps-unilink-delius@digital.justice.gov.uk" +} + +variable "is_production" { + default = "false" +} + +variable "slack_channel" { + description = "Team slack channel to use if we need to contact your team" + default = "ndelius_service_team" +} + +variable "number_cache_clusters" { + default = "2" +} +variable "github_owner" { + description = "The GitHub organization or individual user account containing the app's code repo. Used by the Github Terraform provider. See: https://user-guide.cloud-platform.service.justice.gov.uk/documentation/getting-started/ecr-setup.html#accessing-the-credentials" + type = string + default = "ministryofjustice" +} + +variable "github_token" { + type = string + description = "Required by the GitHub Terraform provider" + default = "" +} + +variable "maintenance_window" { + default = "sun:00:00-sun:03:00" +} + +variable "domain_events_topic_name" { + default = "cloud-platform-Digital-Prison-Services-15b2b4a6af7714848baeaf5f41c85fcd" +} \ No newline at end of file diff --git a/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/versions.tf b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/versions.tf new file mode 100644 index 00000000000..a2956acf484 --- /dev/null +++ b/namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/versions.tf @@ -0,0 +1,18 @@ + +terraform { + required_version = ">= 1.2.5" + required_providers { + aws = { + source = "hashicorp/aws" + version = "~> 5.78.0" + } + github = { + source = "integrations/github" + version = "~> 6.6.0" + } + kubernetes = { + source = "hashicorp/kubernetes" + version = "~> 2.23.0" + } + } +}