[EC-260] Fundamental Terraform Core setup for Italy North region

[Krusty93]

List of changes

This PR contains a definition of new resources to be deployed in Italy North region.

They are completely separated from West Europe region resources, in order to break the coupling between the two.
They use the modules-approach, to simplify resource searching, breaking coupling and get rid of the long file list.

This core folder is intended to be used especially by cloud engineers, NOT developers; they instead shall define resources in their mono repos/application repos/domain folder, according to their patterns. Core folder shall contain fundamental blocks and nothing else. An RFC with more details and explanations have been opened some times ago.

This PR also uses HashiCorp module to auto generate CIDR blocks for subnets. This is useful to avoid CIDR collision in concurrent PRs, especially in "distributed repositories", and is intended to be used also in all Terraform configuration which are going to interact with North Italy region.

Also naming conventions have been updated: location is introduced, as well as the instance number. The former is useful to distinguish resources based on location (pattern in part already adopted in West Europe but then abandoned); the latter is useful for migrations, in order to be more ripetitive than creative (aka inventing names to create unique resources similar to old ones and creating confusion). This approach is also suggested by Microsoft.

Motivation and context

Getting the new region opportunity to fix some historical issues.
We need to deploy first resources in Italy very very very soon (this week)

Type of changes

• Add new resources
• Update configuration to existing resources
• Remove existing resources

Env to apply

• DEV
• UAT
• PROD

Does this introduce a change to production resources with possible user impact?

• Yes, users may be impacted applying this change
• No

Does this introduce an unwanted change on infrastructure? Check terraform plan execution result

• Yes
• No

Other information

---

If PR is partially applied, why? (reserved to mantainers)

How to apply

After PR is approved

1. run deploy pipeline from Azure DevOps io-platform-iac-projects
2. select PR branch
3. wait for approval

[Krusty93]

I would like also to integrate this

[Krusty93]

I would like also to integrate this

Discarded because of lack of support

[github-actions]

Terraform Plan ('src/core/prod/italynorth') 📖

Terraform Plan

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # azurerm_resource_group.vnet will be created
  + resource "azurerm_resource_group" "vnet" {
      + id       = (known after apply)
      + location = "italynorth"
      + name     = "io-p-itn-common-rg-001"
      + tags     = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }
    }

  # module.networking.azurerm_private_dns_zone_virtual_network_link.azurewebsites_private_vnet_itn_common will be created
  + resource "azurerm_private_dns_zone_virtual_network_link" "azurewebsites_private_vnet_itn_common" {
      + id                    = (known after apply)
      + name                  = "io-p-itn-common-vnet-001"
      + private_dns_zone_name = "privatelink.azurewebsites.net"
      + registration_enabled  = false
      + resource_group_name   = "io-p-rg-common"
      + tags                  = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }
      + virtual_network_id    = (known after apply)
    }

  # module.networking.azurerm_private_dns_zone_virtual_network_link.blob_core_private_vnet_itn_common will be created
  + resource "azurerm_private_dns_zone_virtual_network_link" "blob_core_private_vnet_itn_common" {
      + id                    = (known after apply)
      + name                  = "io-p-itn-common-vnet-001"
      + private_dns_zone_name = "privatelink.blob.core.windows.net"
      + registration_enabled  = false
      + resource_group_name   = "io-p-rg-common"
      + tags                  = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }
      + virtual_network_id    = (known after apply)
    }

  # module.networking.azurerm_private_dns_zone_virtual_network_link.documents_private_vnet_itn_common will be created
  + resource "azurerm_private_dns_zone_virtual_network_link" "documents_private_vnet_itn_common" {
      + id                    = (known after apply)
      + name                  = "io-p-itn-common-vnet-001"
      + private_dns_zone_name = "privatelink.documents.azure.com"
      + registration_enabled  = false
      + resource_group_name   = "io-p-rg-common"
      + tags                  = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }
      + virtual_network_id    = (known after apply)
    }

  # module.networking.azurerm_private_dns_zone_virtual_network_link.file_core_private_vnet_itn_common will be created
  + resource "azurerm_private_dns_zone_virtual_network_link" "file_core_private_vnet_itn_common" {
      + id                    = (known after apply)
      + name                  = "io-p-itn-common-vnet-001"
      + private_dns_zone_name = "privatelink.file.core.windows.net"
      + registration_enabled  = false
      + resource_group_name   = "io-p-rg-common"
      + tags                  = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }
      + virtual_network_id    = (known after apply)
    }

  # module.networking.azurerm_private_dns_zone_virtual_network_link.internal_io_pagopa_it_private_vnet_itn_common will be created
  + resource "azurerm_private_dns_zone_virtual_network_link" "internal_io_pagopa_it_private_vnet_itn_common" {
      + id                    = (known after apply)
      + name                  = "io-p-itn-common-vnet-001"
      + private_dns_zone_name = "internal.io.pagopa.it"
      + registration_enabled  = false
      + resource_group_name   = "io-p-rg-internal"
      + tags                  = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }
      + virtual_network_id    = (known after apply)
    }

  # module.networking.azurerm_private_dns_zone_virtual_network_link.mongo_cosmos_private_vnet_itn_common will be created
  + resource "azurerm_private_dns_zone_virtual_network_link" "mongo_cosmos_private_vnet_itn_common" {
      + id                    = (known after apply)
      + name                  = "io-p-itn-common-vnet-001"
      + private_dns_zone_name = "privatelink.mongo.cosmos.azure.com"
      + registration_enabled  = false
      + resource_group_name   = "io-p-rg-common"
      + tags                  = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }
      + virtual_network_id    = (known after apply)
    }

  # module.networking.azurerm_private_dns_zone_virtual_network_link.privatelink_postgres_database_azure_com_vnet_itn_common will be created
  + resource "azurerm_private_dns_zone_virtual_network_link" "privatelink_postgres_database_azure_com_vnet_itn_common" {
      + id                    = (known after apply)
      + name                  = "io-p-itn-common-vnet-001"
      + private_dns_zone_name = "privatelink.postgres.database.azure.com"
      + registration_enabled  = false
      + resource_group_name   = "io-p-rg-common"
      + tags                  = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }
      + virtual_network_id    = (known after apply)
    }

  # module.networking.azurerm_private_dns_zone_virtual_network_link.queue_core_private_vnet_itn_common will be created
  + resource "azurerm_private_dns_zone_virtual_network_link" "queue_core_private_vnet_itn_common" {
      + id                    = (known after apply)
      + name                  = "io-p-itn-common-vnet-001"
      + private_dns_zone_name = "privatelink.queue.core.windows.net"
      + registration_enabled  = false
      + resource_group_name   = "io-p-rg-common"
      + tags                  = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }
      + virtual_network_id    = (known after apply)
    }

  # module.networking.azurerm_private_dns_zone_virtual_network_link.servicebus_private_vnet_itn_common will be created
  + resource "azurerm_private_dns_zone_virtual_network_link" "servicebus_private_vnet_itn_common" {
      + id                    = (known after apply)
      + name                  = "io-p-itn-common-vnet-001"
      + private_dns_zone_name = "privatelink.servicebus.windows.net"
      + registration_enabled  = false
      + resource_group_name   = "io-p-evt-rg"
      + tags                  = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }
      + virtual_network_id    = (known after apply)
    }

  # module.networking.azurerm_private_dns_zone_virtual_network_link.table_core_private_vnet_itn_common will be created
  + resource "azurerm_private_dns_zone_virtual_network_link" "table_core_private_vnet_itn_common" {
      + id                    = (known after apply)
      + name                  = "io-p-itn-common-vnet-001"
      + private_dns_zone_name = "privatelink.table.core.windows.net"
      + registration_enabled  = false
      + resource_group_name   = "io-p-rg-common"
      + tags                  = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }
      + virtual_network_id    = (known after apply)
    }

  # module.networking.module.vnet_itn_common.azurerm_virtual_network.this will be created
  + resource "azurerm_virtual_network" "this" {
      + address_space       = [
          + "10.20.0.0/16",
        ]
      + dns_servers         = (known after apply)
      + guid                = (known after apply)
      + id                  = (known after apply)
      + location            = "italynorth"
      + name                = "io-p-itn-common-vnet-001"
      + resource_group_name = "io-p-itn-common-rg-001"
      + subnet              = (known after apply)
      + tags                = {
          + "CostCenter"  = "TS310 - PAGAMENTI & SERVIZI"
          + "CreatedBy"   = "Terraform"
          + "Environment" = "Prod"
          + "Owner"       = "IO"
          + "Source"      = "https://github.com/pagopa/io-infra/blob/main/src/core/prod/italynorth"
        }

      + ddos_protection_plan {
          + enable = true
          + id     = "/subscriptions/0da48c97-355f-4050-a520-f11a18b8be90/resourceGroups/sec-p-ddos/providers/Microsoft.Network/ddosProtectionPlans/sec-p-ddos-protection"
        }
    }

  # module.networking.module.vnet_peering_itn_common_weu_beta.azurerm_virtual_network_peering.source will be created
  + resource "azurerm_virtual_network_peering" "source" {
      + allow_forwarded_traffic      = false
      + allow_gateway_transit        = false
      + allow_virtual_network_access = true
      + id                           = (known after apply)
      + name                         = "io-p-itn-common-vnet-001-to-io-p-weu-beta-vnet"
      + remote_virtual_network_id    = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-weu-beta-vnet-rg/providers/Microsoft.Network/virtualNetworks/io-p-weu-beta-vnet"
      + resource_group_name          = "io-p-itn-common-rg-001"
      + use_remote_gateways          = false
      + virtual_network_name         = "io-p-itn-common-vnet-001"
    }

  # module.networking.module.vnet_peering_itn_common_weu_beta.azurerm_virtual_network_peering.target will be created
  + resource "azurerm_virtual_network_peering" "target" {
      + allow_forwarded_traffic      = false
      + allow_gateway_transit        = false
      + allow_virtual_network_access = true
      + id                           = (known after apply)
      + name                         = "io-p-weu-beta-vnet-to-io-p-itn-common-vnet-001"
      + remote_virtual_network_id    = (known after apply)
      + resource_group_name          = "io-p-weu-beta-vnet-rg"
      + use_remote_gateways          = false
      + virtual_network_name         = "io-p-weu-beta-vnet"
    }

  # module.networking.module.vnet_peering_itn_common_weu_prod01.azurerm_virtual_network_peering.source will be created
  + resource "azurerm_virtual_network_peering" "source" {
      + allow_forwarded_traffic      = false
      + allow_gateway_transit        = false
      + allow_virtual_network_access = true
      + id                           = (known after apply)
      + name                         = "io-p-itn-common-vnet-001-to-io-p-weu-prod01-vnet"
      + remote_virtual_network_id    = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-weu-prod01-vnet-rg/providers/Microsoft.Network/virtualNetworks/io-p-weu-prod01-vnet"
      + resource_group_name          = "io-p-itn-common-rg-001"
      + use_remote_gateways          = false
      + virtual_network_name         = "io-p-itn-common-vnet-001"
    }

  # module.networking.module.vnet_peering_itn_common_weu_prod01.azurerm_virtual_network_peering.target will be created
  + resource "azurerm_virtual_network_peering" "target" {
      + allow_forwarded_traffic      = false
      + allow_gateway_transit        = false
      + allow_virtual_network_access = true
      + id                           = (known after apply)
      + name                         = "io-p-weu-prod01-vnet-to-io-p-itn-common-vnet-001"
      + remote_virtual_network_id    = (known after apply)
      + resource_group_name          = "io-p-weu-prod01-vnet-rg"
      + use_remote_gateways          = false
      + virtual_network_name         = "io-p-weu-prod01-vnet"
    }

  # module.networking.module.vnet_peering_weu_common_itn_common.azurerm_virtual_network_peering.source will be created
  + resource "azurerm_virtual_network_peering" "source" {
      + allow_forwarded_traffic      = false
      + allow_gateway_transit        = true
      + allow_virtual_network_access = true
      + id                           = (known after apply)
      + name                         = "io-p-vnet-common-to-io-p-itn-common-vnet-001"
      + remote_virtual_network_id    = (known after apply)
      + resource_group_name          = "io-p-rg-common"
      + use_remote_gateways          = false
      + virtual_network_name         = "io-p-vnet-common"
    }

  # module.networking.module.vnet_peering_weu_common_itn_common.azurerm_virtual_network_peering.target will be created
  + resource "azurerm_virtual_network_peering" "target" {
      + allow_forwarded_traffic      = false
      + allow_gateway_transit        = false
      + allow_virtual_network_access = true
      + id                           = (known after apply)
      + name                         = "io-p-itn-common-vnet-001-to-io-p-vnet-common"
      + remote_virtual_network_id    = "/subscriptions/ec285037-c673-4f58-b594-d7c480da4e8b/resourceGroups/io-p-rg-common/providers/Microsoft.Network/virtualNetworks/io-p-vnet-common"
      + resource_group_name          = "io-p-itn-common-rg-001"
      + use_remote_gateways          = true
      + virtual_network_name         = "io-p-itn-common-vnet-001"
    }

Plan: 18 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud