@newskit-render/core 0.0.0-d55b7d88

package/infrastructure/terraform-ecr/ecr.tf

@@ -0,0 +1,69 @@
+resource "aws_ecr_repository" "ecr_repo" {
+  name  = var.project_name
+  tags  = var.default_tags
+}
+
+resource "aws_ecr_repository_policy" "ecr_repo_policy" {
+  repository = aws_ecr_repository.ecr_repo.name
+  policy     = data.aws_iam_policy_document.ecr_cross_account.json
+}
+
+resource "aws_ecr_lifecycle_policy" "ecr_repo_lifecycle_policy" {
+  repository = aws_ecr_repository.ecr_repo.name
+  policy     = <<EOF
+{
+    "rules": [
+        {
+            "rulePriority": 1,
+            "description": "Expire untagged images older than 7 days",
+            "selection": {
+                "tagStatus": "untagged",
+                "countType": "sinceImagePushed",
+                "countUnit": "days",
+                "countNumber": 1
+            },
+            "action": {
+                "type": "expire"
+            }
+        },
+        {
+            "rulePriority": 2,
+            "description": "Keep last 10 PR images",
+            "selection": {
+                "tagStatus": "tagged",
+                "tagPrefixList": ["PR-"],
+                "countType": "imageCountMoreThan",
+                "countNumber": 100
+            },
+            "action": {
+                "type": "expire"
+            }
+        }
+    ]
+}
+EOF
+}
+
+data "aws_iam_policy_document" "ecr_cross_account" {
+  statement {
+    sid    = "Cross-AWS-Account-ECR-Read"
+    effect = "Allow"
+
+    principals {
+      type        = "AWS"
+      identifiers = formatlist("arn:aws:iam::%s:root", var.ecr_read_only_principals)
+    }
+
+    actions = [
+      "ecr:BatchCheckLayerAvailability",
+      "ecr:BatchGetImage",
+      "ecr:DescribeImages",
+      "ecr:DescribeRepositories",
+      "ecr:GetDownloadUrlForLayer",
+      "ecr:GetLifecyclePolicy",
+      "ecr:GetLifecyclePolicyPreview",
+      "ecr:GetRepositoryPolicy",
+      "ecr:ListImages",
+    ]
+  }
+}

package/infrastructure/terraform-ecr/main.tf

@@ -0,0 +1,3 @@
+provider "aws" {
+  region = "eu-west-1"
+}

package/infrastructure/terraform-ecr/variables.tf

@@ -0,0 +1,19 @@
+variable "ecr_read_only_principals" {
+  type        = list(string)
+  description = "Read only access for following AWS principals"
+}
+
+variable "project_name" {
+  description = "Project name"
+  default     = "<% PROJECT_NAME >"
+}
+
+variable "default_tags" {
+  type = map(string)
+
+  default = {
+    ServiceCatalogueId = "<% SERVICE_CATALOGUE_ID >"
+    ServiceName        = "<% SERVICE_NAME >"
+    Environment        = "<% ENVIRONMENT >"
+  }
+}

package/infrastructure/terraform-ecr/versions.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    aws = {
+      source = "hashicorp/aws"
+    }
+  }
+  backend "s3" {
+    bucket = "<% S3_BUCKET_NAME >"
+    region = "eu-west-1"
+  }
+  required_version = ">= 1.3.9"
+}

package/infrastructure/terraform-newrelic/alerts.tf

@@ -0,0 +1,290 @@
+resource "newrelic_alert_policy" "render_app_policy" {
+  name = "${var.prefix} - Alert Policy"
+}
+
+# Provision a Slack notification channel.
+resource "newrelic_alert_channel" "slack_channel" {
+  name = "<% PROJECT_NAME >-alerts"
+  type = "slack"
+
+  config {
+    url     = var.newrelic_slack_webhook
+    channel = "<% PROJECT_NAME >-alerts"
+  }
+
+  # Stop the resouce from being marked as changed on every run
+  # https://registry.terraform.io/providers/newrelic/newrelic/latest/docs/guides/getting_started#a-note-about-secrets
+  lifecycle {
+    ignore_changes = [config]
+  }
+}
+
+resource "newrelic_alert_policy_channel" "render_app_newrelic_alert_policy_channel" {
+  policy_id   = newrelic_alert_policy.render_app_policy.id
+  channel_ids = [newrelic_alert_channel.slack_channel.id]
+}
+
+# Response time
+resource "newrelic_alert_condition" "response_time_web" {
+  policy_id       = newrelic_alert_policy.render_app_policy.id
+  name            = "${var.prefix} - High Response Time (Web)"
+  type            = "apm_app_metric"
+  entities        = [data.newrelic_entity.render_app.application_id]
+  metric          = "response_time_web"
+  condition_scope = "application"
+  term {
+    duration      = 5
+    operator      = "above"
+    priority      = "critical"
+    threshold     = "5"
+    time_function = "all"
+  }
+}
+
+# Low throughput
+resource "newrelic_alert_condition" "throughput_web" {
+  policy_id       = newrelic_alert_policy.render_app_policy.id
+  name            = "${var.prefix} - Low Throughput (Web)"
+  type            = "apm_app_metric"
+  entities        = [data.newrelic_entity.render_app.application_id]
+  metric          = "throughput_web"
+  condition_scope = "application"
+  # Define a critical alert threshold that will
+  # trigger after 5 minutes below 5 requests per minute.
+  term {
+    priority      = "critical"
+    duration      = 5
+    operator      = "below"
+    threshold     = "5"
+    time_function = "all"
+  }
+}
+
+# Error percentage
+resource "newrelic_alert_condition" "error_percentage" {
+  policy_id       = newrelic_alert_policy.render_app_policy.id
+  name            = "${var.prefix} - High Error Percentage"
+  type            = "apm_app_metric"
+  entities        = [data.newrelic_entity.render_app.application_id]
+  metric          = "error_percentage"
+  condition_scope = "application"
+  # Define a critical alert threshold that will trigger after 5 minutes above a 5% error rate.
+  term {
+    duration      = 5
+    operator      = "above"
+    threshold     = "5"
+    time_function = "all"
+  }
+}
+
+# High CPU usage
+resource "newrelic_infra_alert_condition" "high_cpu" {
+  policy_id  = newrelic_alert_policy.render_app_policy.id
+  name       = "${var.prefix} - High CPU usage"
+  type       = "infra_metric"
+  event      = "SystemSample"
+  select     = "cpuPercent"
+  comparison = "above"
+  where      = "(`applicationId` = '${data.newrelic_entity.render_app.application_id}')"
+  # Define a critical alert threshold that will trigger after 5 minutes above 90% CPU utilization.
+  critical {
+    duration      = 5
+    value         = 90
+    time_function = "all"
+  }
+}
+
+/*
+  Newrelic Infrastructure alerts
+*/
+# Pods running less than desired for 3 minutes -> warning
+# Pods running less than desired for 10 minutes -> critical
+resource "newrelic_infra_alert_condition" "pods_availability" {
+
+  policy_id   = newrelic_alert_policy.render_app_policy.id
+  name        = "${var.prefix} - Pod availability"
+  type        = "infra_metric"
+  event       = "K8sReplicasetSample"
+  select      = "podsDesired - podsReady"
+  where       = "namespace = '${var.namespace}'"
+  comparison  = "above"
+  description = "Pods running less than desired for 3 minutes -> warning, Pods running less than desired for 5 minutes -> critical"
+
+  warning {
+    duration      = 5
+    value         = 0
+    time_function = "all"
+  }
+
+  critical {
+    duration      = 10
+    value         = 0
+    time_function = "all"
+  }
+}
+
+# Any pods unable to get scheduled
+resource "newrelic_infra_alert_condition" "pods_scheduled" {
+
+  policy_id   = newrelic_alert_policy.render_app_policy.id
+  name        = "${var.prefix} - Pods unable to schedule"
+  type        = "infra_metric"
+  event       = "K8sPodSample"
+  select      = "isScheduled"
+  where       = "namespace = '${var.namespace}'"
+  comparison  = "equal"
+  description = "Any pods unable to get scheduled"
+
+  warning {
+    duration      = 3
+    value         = 0
+    time_function = "all"
+  }
+
+  critical {
+    duration      = 5
+    value         = 0
+    time_function = "all"
+  }
+}
+
+# Any pods with High CPU Usage
+resource "newrelic_infra_alert_condition" "pods_cpu_usage" {
+
+  policy_id   = newrelic_alert_policy.render_app_policy.id
+  name        = "${var.prefix} - Pod High CPU"
+  type        = "infra_metric"
+  event       = "K8sContainerSample"
+  select      = "cpuCoresUtilization"
+  where       = "namespace = '${var.namespace}'"
+  comparison  = "above"
+  description = "Any pods with High CPU Usage"
+
+  warning {
+    duration      = 2
+    value         = 60
+    time_function = "all"
+  }
+
+  critical {
+    duration      = 4
+    value         = 75
+    time_function = "all"
+  }
+}
+
+# Any pods with High Memory Usage
+resource "newrelic_infra_alert_condition" "pods_memory_usage" {
+
+  policy_id   = newrelic_alert_policy.render_app_policy.id
+  name        = "${var.prefix} - Pod High Memory"
+  type        = "infra_metric"
+  event       = "K8sContainerSample"
+  select      = "memoryUtilization"
+  where       = "namespace = '${var.namespace}'"
+  comparison  = "above"
+  description = "Any pods with High Memory Usage"
+
+  warning {
+    duration      = 2
+    value         = 80
+    time_function = "all"
+  }
+
+  critical {
+    duration      = 3
+    value         = 95
+    time_function = "all"
+  }
+}
+
+# Any pods with status Failed/Unknown
+resource "newrelic_nrql_alert_condition" "pod_failed_unknown" {
+  account_id                   = var.newrelic_account_id
+  policy_id                    = newrelic_alert_policy.render_app_policy.id
+  name                         = "${var.prefix} - Pod Status Failed/Unknown"
+  enabled                      = "true"
+  violation_time_limit_seconds = 86400
+  description                  = "Any pods with status Failed/Unknown"
+  aggregation_window             = 60
+  aggregation_method             = "event_flow"
+  aggregation_delay              = 120
+
+  nrql {
+    query             = "SELECT uniqueCount(podName) FROM K8sPodSample WHERE namespace = '${var.namespace}' AND (status = 'Failed' OR status = 'Unknown')"
+  }
+
+  warning {
+    operator              = "above"
+    threshold             = 0.001
+    threshold_duration    = 300
+    threshold_occurrences = "ALL"
+  }
+
+  critical {
+    operator              = "above"
+    threshold             = 0.001
+    threshold_duration    = 300
+    threshold_occurrences = "ALL"
+  }
+}
+
+resource "newrelic_nrql_alert_condition" "pod_pending" {
+  account_id                     = var.newrelic_account_id
+  policy_id                      = newrelic_alert_policy.render_app_policy.id
+  name                           = "${var.prefix} - Pod Status Pending"
+  enabled                        = "true"
+  violation_time_limit_seconds   = 86400
+  description                    = "Warn if any containers are pending after 3 minutes, critical if any containers are pending after 5 minutes"
+  expiration_duration            = 120
+  close_violations_on_expiration = true
+  aggregation_window             = 60
+  aggregation_method             = "event_flow"
+  aggregation_delay              = 120
+
+  nrql {
+    query             = "SELECT uniqueCount(podName) FROM K8sPodSample WHERE namespace = '${var.namespace}' AND status = 'Pending'"
+  }
+
+  # warn if any containers are pending after 3 minutes
+  warning {
+    operator              = "above"
+    threshold             = 0.001
+    threshold_duration    = 180
+    threshold_occurrences = "ALL"
+  }
+
+  # critical if any containers are pending after 5 minutes
+  critical {
+    operator              = "above"
+    threshold             = 0.001
+    threshold_duration    = 300
+    threshold_occurrences = "ALL"
+  }
+}
+
+# Any services with restarts > 5 over all pods for 1 minute -> warning
+resource "newrelic_nrql_alert_condition" "restart_count" {
+  account_id                   = var.newrelic_account_id
+  policy_id                    = newrelic_alert_policy.render_app_policy.id
+  name                         = "${var.prefix} - Container Restarts"
+  enabled                      = "true"
+  violation_time_limit_seconds = 86400
+  description                  = "Any services with restarts > 5 over all pods for 1 minute -> warning"
+  aggregation_window             = 60
+  aggregation_method             = "event_flow"
+  aggregation_delay              = 120
+
+  nrql {
+    query             = "SELECT uniqueCount(containerID) from K8sContainerSample WHERE namespace = '${var.namespace}' AND restartCount > 5"
+  }
+
+  # critical if any containers exceed 5 restarts
+  critical {
+    operator              = "above"
+    threshold             = 0.001
+    threshold_duration    = 60
+    threshold_occurrences = "ALL"
+  }
+}
+