feat: [DTOSS-11997] enabled 4xx & 5xx alerts for function apps (#1806)

* feat: enabled alerting with relevant parameters, and updated setup gpg key documentation

* enabled alerting for sandbox environment

* added a separate feature flag to enable errors for function app

* Removed count check from the monitor action group

* removed alert enabled check from monitor email address retrieval from key vault.

* fixed pull request errors

* enabled existing alerts

* added dependency of monitor action group performance for app service and sql server to fix the error.

* Changed the dependency implementation.

* Reverted changes by bringing a count check for monitor action group and email from key vault.

Author: nc-shahidazim

docs/user-guides/Setup_GPG_Key.md

@@ -158,3 +158,31 @@ export GPG_TTY=$(tty)
 ```
 
 This should set the correct local variables and if you try to commit again it should prompt you for your password as it should.
+
+## Troubleshooting
+
+### Error: `gpg: signing failed: No secret key`
+
+Steps to resolve:
+
+  1. Check your secret key:
+  
+      ```shell
+      gpg --list-secret-keys --keyid-format=long
+      ```
+
+      Make sure the key exists and note the GPG key ID.
+  
+  2. Verify Git signing key configuration:
+  
+      ```shell
+      git config --global user.signingkey <your-gpg-key-id>
+      ```
+
+  3. Ensure GPG program is set correctly (especially on Windows):
+
+      ```shell
+      git config --global gpg.program "C:/Program Files (x86)/GnuPG/bin/gpg.exe"
+      ```
+  
+      Adjust the path if GPG is installed elsewhere.

infrastructure/tf-core/container_app.tf

@@ -16,9 +16,9 @@ module "container-app" {
   container_app_environment_id = module.container-app-environment["${each.value.container_app_environment_key}-${each.value.region}"].id
   user_assigned_identity_ids   = each.value.add_user_assigned_identity ? [module.user_assigned_managed_identity_sql["${each.key}"].id] : []
 
-  acr_login_server           = data.azurerm_container_registry.acr.login_server
-  acr_managed_identity_id    = each.value.container_registry_use_mi ? data.azurerm_user_assigned_identity.acr_mi.id : null
-  docker_image               = "${data.azurerm_container_registry.acr.login_server}/${each.value.docker_image}:${each.value.docker_env_tag != "" ? each.value.docker_env_tag : var.docker_image_tag}"
+  acr_login_server        = data.azurerm_container_registry.acr.login_server
+  acr_managed_identity_id = each.value.container_registry_use_mi ? data.azurerm_user_assigned_identity.acr_mi.id : null
+  docker_image            = "${data.azurerm_container_registry.acr.login_server}/${each.value.docker_image}:${each.value.docker_env_tag != "" ? each.value.docker_env_tag : var.docker_image_tag}"
 
   environment_variables = each.value.env_vars != null ? each.value.env_vars : {}
 
@@ -41,7 +41,7 @@ locals {
     for region in keys(var.regions) : [
       for container_app, config in var.container_apps.apps : merge(
         {
-          region        = region            # 1st iterator
+          region        = region        # 1st iterator
           container_app = container_app # 2nd iterator
         },
         config, # the rest of the key/value pairs for a specific container_app

infrastructure/tf-core/data.tf

@@ -78,7 +78,8 @@ data "azurerm_key_vault" "infra" {
 }
 
 data "azurerm_key_vault_secret" "monitoring_email_address" {
-  for_each = var.features.alerts_enabled && var.key_vault != {} ? var.regions : {}
+  # Iterate over regions only when alerting is enabled and a key vault is defined; otherwise use an empty map.
+  for_each = (var.features.alerts_enabled || var.features.alerts_function_errors_enabled) && var.key_vault != {} ? var.regions : {}
 
   name         = "monitoring-email-address"
   key_vault_id = data.azurerm_key_vault.infra[each.key].id

infrastructure/tf-core/environments/development.tfvars

@@ -12,6 +12,7 @@ features = {
   public_network_access_enabled        = false
   frontdoor_endpoint_enabled           = true
   alerts_enabled                       = false
+  alerts_function_errors_enabled       = false
 }
 
 # these will be merged with compliance tags in locals.tf

infrastructure/tf-core/environments/integration.tfvars

@@ -12,6 +12,7 @@ features = {
   public_network_access_enabled        = false
   frontdoor_endpoint_enabled           = true
   alerts_enabled                       = false
+  alerts_function_errors_enabled       = false
 }
 
 # these will be merged with compliance tags in locals.tf

infrastructure/tf-core/environments/nft.tfvars

@@ -12,6 +12,7 @@ features = {
   public_network_access_enabled        = false
   frontdoor_endpoint_enabled           = true
   alerts_enabled                       = false
+  alerts_function_errors_enabled       = false
 }
 
 # these will be merged with compliance tags in locals.tf

infrastructure/tf-core/environments/preprod.tfvars

@@ -12,6 +12,7 @@ features = {
   public_network_access_enabled        = false
   frontdoor_endpoint_enabled           = true
   alerts_enabled                       = false
+  alerts_function_errors_enabled       = false
 }
 
 # these will be merged with compliance tags in locals.tf

infrastructure/tf-core/environments/production.tfvars

@@ -12,6 +12,7 @@ features = {
   public_network_access_enabled        = false
   frontdoor_endpoint_enabled           = true
   alerts_enabled                       = true
+  alerts_function_errors_enabled       = true
 }
 
 # these will be merged with compliance tags in locals.tf

infrastructure/tf-core/environments/sandbox.tfvars

@@ -10,7 +10,8 @@ features = {
   private_service_connection_is_manual = false
   public_network_access_enabled        = false
   frontdoor_endpoint_enabled           = false
-  alerts_enabled                       = false
+  alerts_enabled                       = true
+  alerts_function_errors_enabled       = true
 }
 
 # these will be merged with compliance tags in locals.tf

infrastructure/tf-core/function_app.tf

@@ -9,6 +9,11 @@ module "functionapp" {
 
   app_settings = each.value.app_settings
 
+  enable_alerting                                      = var.features.alerts_function_errors_enabled
+  action_group_id                                      = var.features.alerts_function_errors_enabled ? module.monitor_action_group_performance[0].monitor_action_group.id : null
+  alert_4xx_threshold                                  = var.function_apps.alert_4xx_threshold
+  alert_5xx_threshold                                  = var.function_apps.alert_5xx_threshold
+  alert_window_size                                    = var.function_apps.alert_window_size
   log_analytics_workspace_id                           = data.terraform_remote_state.audit.outputs.log_analytics_workspace_id[local.primary_region]
   monitor_diagnostic_setting_function_app_enabled_logs = local.monitor_diagnostic_setting_function_app_enabled_logs
   monitor_diagnostic_setting_function_app_metrics      = local.monitor_diagnostic_setting_function_app_metrics
@@ -109,8 +114,8 @@ resource "azurerm_role_assignment" "function_send_to_topic" {
 
 locals {
   app_settings_common = {
-    DOCKER_ENABLE_CI                    = var.function_apps.docker_CI_enable
-    FUNCTION_WORKER_RUNTIME             = "dotnet-isolated"
+    DOCKER_ENABLE_CI        = var.function_apps.docker_CI_enable
+    FUNCTION_WORKER_RUNTIME = "dotnet-isolated"
 
     REMOTE_DEBUGGING_ENABLED            = var.function_apps.remote_debugging_enabled
     WEBSITES_ENABLE_APP_SERVICE_STORAGE = var.function_apps.enable_appsrv_storage