fix(azure): security hardening for Azure modules (#385)

* fix(azure): critical security vulnerabilities in Azure SQL modules

- Restrict Azure PostgreSQL firewall from 0.0.0.0-255.255.255.255 to Azure services only (0.0.0.0-0.0.0.0)
- Restrict Azure MySQL firewall from 0.0.0.0-255.255.255.255 to Azure services only (0.0.0.0-0.0.0.0)
- Change enable_ssl default to true for Azure PostgreSQL
- Add enable_ssl variable to Azure MySQL with default true
- Make MySQL require_secure_transport conditional on enable_ssl variable instead of always OFF

* fix(azure): cert-manager race condition and overly permissive RBAC

- Add depends_on to kubectl_manifest resources to prevent cert-manager
  webhook race condition during cluster provisioning
- Downgrade zop-system ClusterRoleBinding from cluster-admin to edit
  for principle of least privilege

* Enable SSL for Grafana PostgreSQL connection on Azure

Author: gizmo-rt

k8s/azure/aks/cert-manager.tf

@@ -70,11 +70,13 @@ resource "helm_release" "cert_manager" {
 }
 
 resource "kubectl_manifest" "cluster_wildcard_issuer" {
-  yaml_body = local.cluster_wildcard_issuer
+  yaml_body  = local.cluster_wildcard_issuer
+  depends_on = [helm_release.cert_manager]
 }
 
 resource "kubectl_manifest" "cluster_wildcard_certificate" {
-  yaml_body = local.cluster_wildcard_certificate
+  yaml_body  = local.cluster_wildcard_certificate
+  depends_on = [kubectl_manifest.cluster_wildcard_issuer]
 }
 
 resource "kubernetes_secret_v1" "certificate_replicator" {

k8s/azure/aks/grafana.tf

@@ -22,6 +22,7 @@ locals {
       GRAFANA_DB_HOST                   = try(local.grafana_enable && var.observability_config.grafana.persistence.type == "db" ? module.grafana_db[0].db_url : "", "")
       GRAFANA_DB_PASSWORD               = try(local.grafana_enable && var.observability_config.grafana.persistence.type == "db" ? module.grafana_db[0].db_password : "", "")
       GRAFANA_DB_USER                   = try(local.grafana_enable && var.observability_config.grafana.persistence.type == "db" ? module.grafana_db[0].db_admin_user : "", "")
+      GRAFANA_DB_SSL_MODE               = try(local.grafana_enable && var.observability_config.grafana.persistence.type == "db" ? "require" : "disable", "disable")
       GRAFANA_MIN_REPLICA               = try(var.observability_config.grafana.min_replica != null ? var.observability_config.grafana.min_replica : 1, 1)
       GRAFANA_MAX_REPLICA               = try(var.observability_config.grafana.max_replica != null ? var.observability_config.grafana.max_replica : 10, 10)
       GRAFANA_REQUEST_MEMORY            = try(var.observability_config.grafana.request_memory != null ? var.observability_config.grafana.request_memory : "100Mi", "100Mi")

k8s/azure/aks/templates/grafana-values.yaml

@@ -19,6 +19,7 @@ grafana.ini:
     host: ${GRAFANA_DB_HOST}
     user: ${GRAFANA_DB_USER}
     password: ${GRAFANA_DB_PASSWORD}
+    ssl_mode: ${GRAFANA_DB_SSL_MODE}
   %{~ endif ~}
   server:
     root_url: https://${GRAFANA_HOST}

sql/azure-mysql/main.tf

@@ -65,6 +65,7 @@ resource "azurerm_mysql_flexible_database" "mysql_db" {
 }
 
 resource "azurerm_mysql_flexible_server_configuration" "mysql_parameter_group" {
+  count                   = var.enable_ssl == false ? 1 : 0
   name                    = "require_secure_transport"
   resource_group_name     = var.resource_group_name
   server_name             = azurerm_mysql_flexible_server.mysql_server.name
@@ -77,7 +78,7 @@ resource "azurerm_mysql_flexible_server_firewall_rule" "mysql_firewall" {
   resource_group_name     = var.resource_group_name
   server_name             = azurerm_mysql_flexible_server.mysql_server.name
   start_ip_address        = "0.0.0.0"
-  end_ip_address          = "255.255.255.255"
+  end_ip_address          = "0.0.0.0"
 }
 
 resource "azurerm_mysql_flexible_server" "mysql_read_replica" {

sql/azure-mysql/vars.tf

@@ -133,6 +133,12 @@ variable "io_scaling_enabled" {
   default     = false
 }
 
+variable "enable_ssl" {
+  description = "Whether SSL should be enabled or not based on user requirement"
+  type        = bool
+  default     = true
+}
+
 variable "multi_ds" {
   description = "Whether to create multiple databases in the same instance"
   type        = bool

sql/azure-postgres/main.tf

@@ -71,11 +71,11 @@ resource "azurerm_postgresql_flexible_server_configuration" "ssl_parameter_group
 }
 
 resource "azurerm_postgresql_flexible_server_firewall_rule" "postgres_firewall" {
-  count             = local.vnet_enabled ? 0 : 1
-  name              = "${var.cluster_name}-${var.namespace}-postgres-firewall"
-  server_id         = azurerm_postgresql_flexible_server.postgres_server.id
-  start_ip_address  = "0.0.0.0"
-  end_ip_address    = "255.255.255.255"
+  count               = local.vnet_enabled ? 0 : 1
+  name                = "${var.cluster_name}-${var.namespace}-postgres-firewall"
+  server_id           = azurerm_postgresql_flexible_server.postgres_server.id
+  start_ip_address    = "0.0.0.0"
+  end_ip_address      = "0.0.0.0"
 }
 
 resource "azurerm_postgresql_flexible_server" "postgresql_replica_server" {

sql/azure-postgres/vars.tf

@@ -101,7 +101,7 @@ variable "zone" {
 variable "enable_ssl" {
   description = "Whether SSL should be enabled or not based on user requirement"
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "storage_mb" {

zop-system/azure/permissions.tf

@@ -150,7 +150,7 @@ resource "kubernetes_cluster_role_binding" "zop_cluster_role_binding_cluster_adm
   role_ref {
     api_group = "rbac.authorization.k8s.io"
     kind      = "ClusterRole"
-    name      = "cluster-admin"
+    name      = "edit"
   }
   subject {
     kind      = "ServiceAccount"