📦Adding acm-member-portal deployment

.github/workflows/k8s_terraform_apply.yml

@@ -0,0 +1,74 @@
+---
+name: 'Terraform Apply on Kubernetes'
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/k8s_terraform_apply.yml'
+      - 'kubernetes/terraform/stacks/acm-member-portal/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+jobs:
+  terraform:
+    name: 'Terraform Apply'
+    env:
+      ARM_CLIENT_ID: ${{ secrets.AZURE_AD_CLIENT_ID }}
+      ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      ARM_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }}
+      ARM_USE_OIDC: true
+      TF_WORKSPACE: prod
+      TF_IN_AUTOMATION: true
+      TF_INPUT: 0
+    runs-on: maid-cafe
+    environment: prod
+
+    strategy:
+      matrix:
+        stack:
+          - acm-member-portal
+
+    defaults:
+      run:
+        shell: bash
+        working-directory: kubernetes/terraform/stacks/${{ matrix.stack }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Azure CLI setup
+        uses: azure/login@v1
+        with:
+          client-id: ${{ env.ARM_CLIENT_ID }}
+          tenant-id: ${{ env.ARM_TENANT_ID }}
+          subscription-id: ${{ env.ARM_SUBSCRIPTION_ID }}
+
+      - name: 'Terraform Format'
+        id: fmt
+        uses: dflook/terraform-fmt-check@v1
+        with:
+          path: "kubernetes/terraform/stacks/${{ matrix.stack }}"
+          workspace: ${{ env.TF_WORKSPACE }}
+
+      - name: 'Terraform Validate'
+        id: validate
+        uses: dflook/terraform-validate@v1
+        with:
+          path: "kubernetes/terraform/stacks/${{ matrix.stack }}"
+          workspace: ${{ env.TF_WORKSPACE }}
+
+      - name: 'Terraform Apply'
+        id: apply
+        uses: dflook/terraform-apply@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          path: "kubernetes/terraform/stacks/${{ matrix.stack }}"
+          workspace: ${{ env.TF_WORKSPACE }}
+          var_file: "kubernetes/terraform/stacks/${{ matrix.stack }}/configuration/${{ env.TF_WORKSPACE }}.tfvars"

.github/workflows/k8s_terraform_plan.yml

@@ -0,0 +1,70 @@
+---
+name: 'Terraform PRs for Kubernetes'
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/k8s_terraform_plan.yml'
+      - 'kubernetes/terraform/stacks/acm-member-portal/**'
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+jobs:
+  terraform:
+    name: 'Terraform PR Plan'
+    env:
+      ARM_CLIENT_ID: ${{ secrets.AZURE_AD_CLIENT_ID }}
+      ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      ARM_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }}
+      ARM_USE_OIDC: true
+      TF_WORKSPACE: prod
+      TF_IN_AUTOMATION: true
+      TF_INPUT: 0
+    runs-on: maid-cafe
+
+    strategy:
+      matrix:
+        stack:
+          - acm-member-portal
+
+    defaults:
+      run:
+        shell: bash
+        working-directory: kubernetes/terraform/stacks/${{ matrix.stack }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Azure CLI setup
+        uses: azure/login@v1
+        with:
+          client-id: ${{ env.ARM_CLIENT_ID }}
+          tenant-id: ${{ env.ARM_TENANT_ID }}
+          subscription-id: ${{ env.ARM_SUBSCRIPTION_ID }}
+
+      - name: 'Terraform Format'
+        id: fmt
+        uses: dflook/terraform-fmt-check@v1
+        with:
+          path: "kubernetes/terraform/stacks/${{ matrix.stack }}"
+          workspace: ${{ env.TF_WORKSPACE }}
+
+      - name: 'Terraform Validate'
+        id: validate
+        uses: dflook/terraform-validate@v1
+        with:
+          path: "kubernetes/terraform/stacks/${{ matrix.stack }}"
+          workspace: ${{ env.TF_WORKSPACE }}
+
+      - name: 'Terraform Plan'
+        id: plan
+        uses: dflook/terraform-plan@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          path: "kubernetes/terraform/stacks/${{ matrix.stack }}"
+          workspace: ${{ env.TF_WORKSPACE }}
+          var_file: "kubernetes/terraform/stacks/${{ matrix.stack }}/configuration/${{ env.TF_WORKSPACE }}.tfvars"

kubernetes/terraform/stacks/acm-member-portal/README.md

@@ -0,0 +1,22 @@
+# ACM member portal Terraform stack
+
+Entra app registration for the member portal, plus the `portal-secrets` Kubernetes Secret (`BETTER_AUTH_SECRET` and `MICROSOFT_*`).
+
+Helm / Argo CD deploy the app from `kubernetes/argocd/stacks/acm-member-portal`. SMTP, Discord, and Windows API keys are not managed here. Add them to the same Secret after apply. `kubernetes_secret_v1` replaces the whole object, so those extra keys are wiped on the next apply or client-secret rotation. Re-add them, or move them to a second Secret.
+
+## Requirements
+
+- Azure login with permission to create app registrations (`az login`, or the CI OIDC service principal)
+- `KUBE_CONFIG_PATH` or `KUBECONFIG` pointing at the cluster that hosts `acm-portal`
+- Namespace `acm-portal` already present (Argo CD creates it)
+
+## Manual run
+
+```bash
+terraform init
+terraform workspace select prod || terraform workspace new prod
+terraform plan -var-file configuration/prod.tfvars
+terraform apply -var-file configuration/prod.tfvars
+```
+
+After apply, in Entra: App registrations → `acm-member-portal-prod` → API permissions → Grant admin consent.

kubernetes/terraform/stacks/acm-member-portal/app-registration.tf

@@ -0,0 +1,79 @@
+data "azuread_client_config" "current" {}
+
+locals {
+  owners = distinct(concat([data.azuread_client_config.current.object_id], var.additional_owner_ids))
+}
+
+resource "azuread_application" "portal" {
+  display_name     = "acm-member-portal-${var.deployment_env}"
+  sign_in_audience = "AzureADMyOrg"
+  owners           = local.owners
+
+  web {
+    redirect_uris = var.redirect_uris
+    logout_url    = length(var.logout_uris) > 0 ? var.logout_uris[0] : null
+  }
+
+  # Graph delegated scopes. openid / profile / email are requested at runtime by
+  # better-auth; grant admin consent in Entra after the first apply.
+  required_resource_access {
+    resource_app_id = "00000003-0000-0000-c000-000000000000" # Microsoft Graph
+
+    resource_access {
+      id   = "37f7f235-527c-4136-accd-4f02faf2b745"
+      type = "Scope" # openid
+    }
+    resource_access {
+      id   = "64a6cdd6-4a97-4e60-a3e8-d57ef873a778"
+      type = "Scope" # email
+    }
+  }
+
+  optional_claims {
+    id_token { name = "email" }
+    id_token { name = "upn" }
+    id_token {
+      name                  = "groups"
+      additional_properties = ["sam_account_name"]
+    }
+  }
+}
+
+resource "azuread_service_principal" "portal" {
+  client_id    = azuread_application.portal.client_id
+  use_existing = true
+  owners       = local.owners
+}
+
+resource "azuread_application_password" "portal" {
+  application_id = azuread_application.portal.id
+  display_name   = "portal-${var.deployment_env}"
+  rotate_when_changed = {
+    rotation = time_rotating.rotation.id
+  }
+}
+
+resource "time_rotating" "rotation" {
+  rotation_days = 180
+}
+
+resource "random_password" "auth" {
+  length  = 48
+  special = false
+}
+
+resource "kubernetes_secret_v1" "portal" {
+  metadata {
+    name      = "portal-secrets"
+    namespace = var.kubernetes_namespace
+  }
+
+  type = "Opaque"
+
+  data = {
+    BETTER_AUTH_SECRET      = random_password.auth.result
+    MICROSOFT_CLIENT_ID     = azuread_application.portal.client_id
+    MICROSOFT_CLIENT_SECRET = azuread_application_password.portal.value
+    MICROSOFT_TENANT_ID     = data.azuread_client_config.current.tenant_id
+  }
+}

kubernetes/terraform/stacks/acm-member-portal/backend.tf

@@ -0,0 +1,8 @@
+terraform {
+  backend "azurerm" {
+    resource_group_name  = "acm-hybridcloud"
+    storage_account_name = "acmhybridstore"
+    container_name       = "acm-terraform-state"
+    key                  = "acm-member-portal.tfstate"
+  }
+}

kubernetes/terraform/stacks/acm-member-portal/configuration/prod.tfvars

@@ -0,0 +1,16 @@
+deployment_env = "prod"
+
+redirect_uris = [
+  "https://portal.acmuic.org/api/auth/callback/microsoft",
+]
+
+logout_uris = [
+  "https://portal.acmuic.org",
+]
+
+kubernetes_namespace = "acm-portal"
+
+additional_owner_ids = [
+  "21ec2c63-534d-4cfb-bc43-83773ce40e54", # terraform-svc
+  "920bf583-cb9b-4365-a61e-bb33988c5484"  # clee231
+]

kubernetes/terraform/stacks/acm-member-portal/outputs.tf

@@ -0,0 +1,15 @@
+output "application_id" {
+  value = azuread_application.portal.id
+}
+
+output "client_id" {
+  value = azuread_application.portal.client_id
+}
+
+output "service_principal_object_id" {
+  value = azuread_service_principal.portal.object_id
+}
+
+output "secret_name" {
+  value = kubernetes_secret_v1.portal.metadata[0].name
+}