PAROM-7 - Create hmpps-parom-service-preprod namespace

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/00-namespace.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hmpps-parom-service-preprod
+  labels:
+    cloud-platform.justice.gov.uk/is-production: "false"
+    cloud-platform.justice.gov.uk/environment-name: "preprod"
+    pod-security.kubernetes.io/enforce: restricted
+  annotations:
+    cloud-platform.justice.gov.uk/business-unit: "HMPPS"
+    cloud-platform.justice.gov.uk/slack-channel: "ndelius_service_team"
+    cloud-platform.justice.gov.uk/slack-alert-channel: "hmpps-parom-notifications"
+    cloud-platform.justice.gov.uk/application: "HMPPS Parom Service"
+    cloud-platform.justice.gov.uk/owner: "National Delius Service Team / Unilink <hmpps-unilink-delius@digital.justice.gov.uk>"
+    cloud-platform.justice.gov.uk/source-code: "https://github.com/ministryofjustice/hmpps-parom-service-ui"
+    cloud-platform.justice.gov.uk/team-name: "unilink"

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/01-rbac.yaml

@@ -0,0 +1,23 @@
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: hmpps-parom-service-preprod-admin
+  namespace: hmpps-parom-service-preprod
+subjects:
+  - kind: Group
+    name: "github:unilink"
+    apiGroup: rbac.authorization.k8s.io
+  - kind: Group
+    name: "github:version-1-sit-team" # Version1 team access to support testing
+    apiGroup: rbac.authorization.k8s.io
+############## COPY - DO NOT REPLACE ##############
+  - kind: Group
+    name: "github:hmpps-sre"
+    apiGroup: rbac.authorization.k8s.io
+# hmpps-sre group is required for support functions
+###################################################
+roleRef:
+  kind: ClusterRole
+  name: admin
+  apiGroup: rbac.authorization.k8s.io

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/02-limitrange.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: LimitRange
+metadata:
+  name: limitrange
+  namespace: hmpps-parom-service-preprod
+spec:
+  limits:
+    - default:
+        cpu: 2000m
+        memory: 1024Mi
+      defaultRequest:
+        cpu: 10m
+        memory: 512Mi
+      type: Container

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/03-resourcequota.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: ResourceQuota
+metadata:
+  name: namespace-quota
+  namespace: hmpps-parom-service-preprod
+spec:
+  hard:
+    pods: "50"

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/04-networkpolicy.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default
+  namespace: hmpps-parom-service-preprod
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+      - podSelector: {}
+---
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: allow-ingress-controllers
+  namespace: hmpps-parom-service-preprod
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+      - namespaceSelector:
+          matchLabels:
+            component: ingress-controllers

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/06-certificate.yaml

@@ -0,0 +1,29 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: hmpps-parom-service-api-cert
+  namespace: hmpps-parom-service-preprod
+spec:
+  secretName: hmpps-parom-service-api-cert
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  dnsNames:
+    - parom-service-api-preprod.hmpps.service.justice.gov.uk
+    - '*.parom-service-api-preprod.hmpps.service.justice.gov.uk'
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: hmpps-parom-service-ui-cert
+  namespace: hmpps-parom-service-preprod
+spec:
+  secretName: hmpps-parom-service-ui-cert
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  dnsNames:
+    - parom-service-ui-preprod.hmpps.service.justice.gov.uk
+    - '*.parom-service-ui-preprod.hmpps.service.justice.gov.uk'

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/07-rbac-haar-client-admin-team.yaml

@@ -0,0 +1,39 @@
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: hmpps-haar-client-admin-team
+  namespace: hmpps-parom-service-preprod
+rules:
+  - apiGroups: ["extensions", "apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates", "issuers"]
+    verbs: ["get", "list", "watch", "create", "update", "patch"]
+  - apiGroups: [ "", "extensions" ]
+    resources: [ "services", "ingresses", "configmaps", "pods/log" ]
+    verbs: [ "get", "list", "watch" ]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: [ "get", "list", "watch", "create", "update", "patch"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: hmpps-haar-client-admin-team
+  namespace: hmpps-parom-service-preprod
+subjects:
+  - kind: Group
+    name: "github:hmpps-haar-client-admin"
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: Role
+  name: hmpps-haar-client-admin-team
+  apiGroup: rbac.authorization.k8s.io

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/api.tf

@@ -0,0 +1,18 @@
+module "hmpps_template_kotlin" {
+  source      = "github.com/ministryofjustice/cloud-platform-terraform-hmpps-template?ref=1.2.1"
+  force_rotate_token = true
+  custom_token_rotation_date = "2026-03-20"
+  github_repo = "hmpps-parom-service-api"
+  application = "hmpps-parom-service-api"
+  github_team = "unilink"
+  environment = var.environment_name # Should match environment name used in helm values file e.g. values-dev.yaml
+  reviewer_teams                = ["unilink_admin"] # Optional team that should review deployments to this environment.
+  selected_branch_patterns      = ["main"] # Optional
+  #protected_branches_only       = true # Optional, defaults to true unless selected_branch_patterns is set
+  is_production                 = var.is_production
+  application_insights_instance = "preprod" # Either "dev", "preprod" or "prod"
+  source_template_repo          = "hmpps-template-kotlin"
+  github_token                  = var.github_token
+  namespace                     = var.namespace
+  kubernetes_cluster            = var.kubernetes_cluster
+}

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/audit-queue.tf

@@ -0,0 +1,14 @@
+locals {
+  audit_queue_name = "Digital-Prison-Services-${var.environment_name}-hmpps_audit_queue"
+}
+
+resource "kubernetes_secret" "hmpps_audit_config" {
+  metadata {
+    namespace = var.namespace
+    name      = "hmpps-audit"
+  }
+  data = {
+    sqs_queue_url  = "https://sqs.eu-west-2.amazonaws.com/754256621582/${local.audit_queue_name}"
+    sqs_queue_name = local.audit_queue_name
+  }
+}

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/irsa.tf

@@ -0,0 +1,29 @@
+data "aws_ssm_parameter" "audit_irsa_policy_arn" {
+  name = "/hmpps-audit-${var.environment_name}/sqs/${local.audit_queue_name}/irsa-policy-arn"
+}
+
+data "aws_ssm_parameter" "domain_events_policy_arn" {
+  name     = "/hmpps-domain-events-${var.environment_name}/sns/${var.domain_events_topic_name}/irsa-policy-arn"
+}
+
+module "irsa" {
+  source = "github.com/ministryofjustice/cloud-platform-terraform-irsa?ref=2.1.0"
+
+  eks_cluster_name     = var.eks_cluster_name
+  service_account_name = "hmpps-parom-service"
+  namespace            = var.namespace
+  role_policy_arns = {
+    domain_events_queue = module.queue.irsa_policy_arn,
+    domain_events_dlq   = module.dead-letter-queue.irsa_policy_arn,
+    domain_events_topic = data.aws_ssm_parameter.domain_events_policy_arn.value,
+    audit_queue         = data.aws_ssm_parameter.audit_irsa_policy_arn.value,
+  }
+
+  # Tags
+  business_unit          = var.business_unit
+  application            = var.application
+  is_production          = var.is_production
+  team_name              = var.team_name
+  environment_name       = var.environment_name
+  infrastructure_support = var.infrastructure_support
+}

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/main.tf

@@ -0,0 +1,45 @@
+terraform {
+  backend "s3" {
+  }
+}
+
+provider "aws" {
+  region = "eu-west-2"
+
+  default_tags {
+    tags = {
+      # see https://user-guide.cloud-platform.service.justice.gov.uk/documentation/getting-started/accessing-the-cloud-console.html
+      GithubTeam = var.team_name
+    }
+  }
+}
+
+provider "aws" {
+  alias  = "london"
+  region = "eu-west-2"
+
+  default_tags {
+    tags = {
+      # see https://user-guide.cloud-platform.service.justice.gov.uk/documentation/getting-started/accessing-the-cloud-console.html
+      GithubTeam = var.team_name
+    }
+  }
+}
+
+provider "aws" {
+  alias  = "ireland"
+  region = "eu-west-1"
+
+  default_tags {
+    tags = {
+      # see https://user-guide.cloud-platform.service.justice.gov.uk/documentation/getting-started/accessing-the-cloud-console.html
+      GithubTeam = var.team_name
+    }
+  }
+}
+provider "github" {
+  token = var.github_token
+  owner = var.github_owner
+}
+
+provider "kubernetes" {}

namespaces/live.cloud-platform.service.justice.gov.uk/hmpps-parom-service-preprod/resources/queue.tf

@@ -0,0 +1,98 @@
+resource "aws_sns_topic_subscription" "queue-subscription" {
+
+  topic_arn = data.aws_sns_topic.hmpps-domain-events.arn
+  protocol  = "sqs"
+  endpoint  = module.queue.sqs_arn
+  filter_policy = jsonencode({
+    eventType = [
+      "probation-case.merge.completed",
+      "probation-case.unmerge.completed",
+      "probation-case.sentence.moved",
+      "probation-case.deleted.gdpr"
+    ]
+  })
+}
+
+module "queue" {
+  source = "github.com/ministryofjustice/cloud-platform-terraform-sqs?ref=5.1.2"
+
+  # Queue configuration
+  sqs_name = "hmpps-parom-service-queue"
+  redrive_policy = jsonencode({
+    deadLetterTargetArn = module.dead-letter-queue.sqs_arn
+    maxReceiveCount     = 3
+  })
+
+  # Tags
+  application            = var.application
+  business_unit          = var.business_unit
+  environment_name       = var.environment_name
+  infrastructure_support = var.infrastructure_support
+  is_production          = var.is_production
+  namespace              = var.namespace
+  team_name              = var.team_name # also used as queue name prefix
+}
+
+data "aws_iam_policy_document" "sns_to_sqs" {
+  statement {
+    sid     = "DomainEventsToQueue"
+    effect  = "Allow"
+    actions = ["sqs:SendMessage"]
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+    condition {
+      variable = "aws:SourceArn"
+      test     = "ArnEquals"
+      values   = [data.aws_sns_topic.hmpps-domain-events.arn]
+    }
+    resources = ["*"]
+  }
+}
+
+resource "aws_sqs_queue_policy" "queue-policy" {
+  queue_url = module.queue.sqs_id
+  policy    = data.aws_iam_policy_document.sns_to_sqs.json
+}
+
+module "dead-letter-queue" {
+  source = "github.com/ministryofjustice/cloud-platform-terraform-sqs?ref=5.1.2"
+
+  # Queue configuration
+  sqs_name                  = "hmpps-parom-service-dlq"
+  message_retention_seconds = 7 * 24 * 3600 # 1 week
+
+  # Tags
+  application            = var.application
+  business_unit          = var.business_unit
+  environment_name       = var.environment_name
+  infrastructure_support = var.infrastructure_support
+  is_production          = var.is_production
+  namespace              = var.namespace
+  team_name              = var.team_name # also used as queue name prefix
+}
+
+resource "kubernetes_secret" "queue-secret" {
+  metadata {
+    namespace = var.namespace
+    name      = "sqs-queue"
+  }
+  data = {
+    sqs_queue_url  = module.queue.sqs_id
+    sqs_queue_arn  = module.queue.sqs_arn
+    sqs_queue_name = module.queue.sqs_name
+  }
+}
+
+resource "kubernetes_secret" "dlq-secret" {
+  metadata {
+    namespace = var.namespace
+    name      = "sqs-dlq"
+  }
+  data = {
+    sqs_queue_url  = module.dead-letter-queue.sqs_id
+    sqs_queue_arn  = module.dead-letter-queue.sqs_arn
+    sqs_queue_name = module.dead-letter-queue.sqs_name
+  }
+}