pi-ux-ce/Terraform_kube
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

adding some import from configmap and secret from bitwarden

Browse Source
This commit is contained in:
pi-ux-ce
2026-02-11 21:36:46 +00:00
parent 8939736cdc
commit 4564ccd601
7 changed files with 39070 additions and 565 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.bitwarden/device_identifier
+1
View File
@@ -0,0 +1 @@
9fdbb94c-0fd5-4ce2-919f-1fbb596cd318
.bw-provider-state
+1
View File
@@ -0,0 +1 @@
2.pYoQjnuN9ZB+IqEypWrFPw==|/nlBG5qPy/zIFwYjjNXMuNWLU8pSt3TLR1/q4L3AEzi5Semc2261DyelXIfVpOn21JOGOV7jiIV6P3CSuASCjvCH+lCZSbjHfcj/MIOl3IBZJWF3vnTBVl3yjYD+Jmf0/zaYXbUW881oiO3Pu5Obc2jiBKNlX2bx5H11Iyi/fOmvR+EgsdequGgRm0FiSkjkbyG8d9bR55XR9NtS5x9a8EOhKWu0yXFGAKkDGV/m+j45z20mVTlAuuNDtIOX/rDKdKJpzg6SF8EuRTGC5RWAHJ+V8BACe3xxHi43YFit5RjpQ83F6rUGc+hc7TTcKyLA0Go7vUnKQ2wljSihM+HgJbGI6Sgnc9/Ys9AyDI0Bfz4EntfUqSeMBoaatvGpe3LYZdGysUMtDUoQWAvEfKbnnTKQRJb6zTD0RjhJ1ZowrrUFXyU9s1kNu3Sx29Q6h926lIiZ7kNejLcBEIJm0NjifAT9E0dwWTC6/bM2NrQpAotQBQGKGOGGRPIQW8vM7EJ6pl3ZSM/RzRnvQEdmWLNTbLd5eUd0efTviQr4BTxhwj7m3UGBUI/ZQhd3UNTU2ZVpt93nY2QPW3EpNpPBdYMnAgqbc3iz9mGZKtUwYpCwEpHj2G0CxCjgoj8il3Ys+vpPbYqpx+/FbibQLsELAbvLtK/TnDT5tq2gCYIHNUYL+iO+rdm8uGVWcFeMUBvyC/sdHEJgnQ3Rf6Up8lhgP3NQu6QgWT5gkGRrJ4RoYYET9919FOas43imUfWLEAaL/iU+NliGj3B0gCnwi1Ljm4+k5MOVHJqgcBdh0LHhNgIQcBurV0Qk8ZkoVnkTBjTMduOGogn9+Ny7B5D28nk8VW4fHL9MsgvYTZXZmI0QKgS2YzTmkle916qGLWgo5hcp5V4MG1EBpchzu0JJUUdPrb06txBr+cCCYvGi1B2epw6nJAJ7OGB4vzcJM/kVQYRVQmV/kfWXxtROCkx3CAKG5oyKMiiPcUiiqIIYuhRUEZYPC9+w67nMANPG8VcyqylcEba/FMSn4ECj7ce2iHCnyAnk9wb78P/YZdNMGbgviJq1nZm+OaGmpMxEoZHpyOe3EmuEKNpuSgqXGygR6ltAqzFRNJJlHm1PLHWxp4n4n5E1VhbaFiN2urTn/Pt2hqh0YEHyRVYYDSJv5QL8Dqq7WVYD2V3waLwi5Q5o6jc2XkaGN3hLg0fH7yO9KMa+MGUIcx5TZX+QGwiB4n/rZijV2h9d7th/tn0+/Gxtz+JcZ9J+4j4/1MR89vGe1EFOl9ZpUYxQVTVNuLoPaql5dXJZf3LeLL3fq05yNyW38NzcT5fFjevSRyRyoTHTrePCr5Tk5D0BaNQDhgDvBtC1kdo72HKR0+y1x31TxzLmc3OMBj2iqMxt0V7snwUfuVYu43LY48YML3wxRe/EVDmP6h8H89JWkw1aCJsLInN7hDSpUJtGBIn30c5r2kSw/87iVskVnQAUsQFMPOzUmDm6E07fnysbPwuAECuha93aMljzQNF4mwd6Pey24Pkfl+K7wypOL94iK1GcM4FqsCpNfD/X1M3Z+AVQahXAtUt82wmaXfQUtQ6Dvt6mfwFnknmWpyI9Pbj3r8lh4M5rffMFucJac32eoq+KY9xdhyPyep0becLQxNog2LiWliSQlfKBoB3X9FSyDalwEasWagUvNdENqkL+GWCxlCZK7g+ibvO5keA0Baqt1ohRcBoigNfmcTsZUPRhq+dy2cvaiPaGRDgX2DKlJdC8LnPDb/qTvk+uP5yZaKSItjdFkYo7c+fbOXH+I93Kd9IK+LJVM+9cWnx6yKBW/TaaEuZCBholtxME8ZQDcnXIelp67IamsfuVb5QNouZuimzb9rP9vEDVTdyE3e5rYzl2AaljMdTIjB1ut5ZqGA8=|hem/6+QHhqSdcTgKycZLP9EDBT3JA8fLIUqETgTITNk=
module.tf
+106 -19
View File
@@ -64,6 +64,8 @@ variable "kubernetes" {
enabled = optional(bool, true)
secret_ref = optional(list(string))
config_map_ref = optional(list(string))
config_map_import = optional(list(string))
secret_import = optional(list(string))
extra_manifest = optional(list(string))
requirements = optional(map(string))
# requirements = optional(map(string), {
@@ -806,6 +808,54 @@ resource "kubernetes_config_map_v1" "automatic-configmap" {
}
data "bitwarden-secrets_secret" "configmap_import" {
for_each = {
for pair in flatten([
for k, v in var.kubernetes : [
for id in v.config_map_import : {
map_key = k
secret_id = id
}
] if v.config_map_import != null && v.enabled == true
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
}
id = each.value
}
resource "kubernetes_config_map_v1" "configmap_import" {
for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
metadata {
name = each.value.note
namespace = split("__", each.value.key)[0]
}
data = yamldecode(each.value.value)
}
data "bitwarden-secrets_secret" "secret_import" {
for_each = {
for pair in flatten([
for k, v in var.kubernetes : [
for id in v.secret_import : {
map_key = k
secret_id = id
}
] if v.secret_import != null && v.enabled == true
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
}
id = each.value
}
resource "kubernetes_secret_v1" "secret_import" {
for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
metadata {
name = each.value.note
namespace = split("__", each.value.key)[0]
}
data = yamldecode(each.value.value)
}
data "bitwarden-secrets_secret" "secret" {
id = "fee7431a-9f6d-478e-8ee0-b3e800c394b5"
}
@@ -837,18 +887,38 @@ resource "kubernetes_config_map_v1_data" "tf-bw-configmap" {
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_username" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__username"
value = each.key
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
length = 32
special = true
min_special = 5
avoid_ambiguous = true
resource "kubernetes_secret_v1" "automatic-database-secret" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
metadata {
name = "${each.key}-db-terraform"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
}
data = {
DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
}
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_password" {
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__username"
value = try(each.value.database.username, each.key)
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__password"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
@@ -858,16 +928,33 @@ resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_password" {
avoid_ambiguous = true
}
#output "fromressource" {
# #for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
# value = {
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__host"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
value = "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc"
}
# #id = resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password.{each.key}.id
# key = resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password."[each.key]".id
# #value = resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password.{each.key}.value #The actual secret value is marked sensitive and will not be printed to stdout
# }
# sensitive = true
#}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__port"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
value = try(each.value.database.port, 5432)
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__name"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
value = try(each.value.database.name, each.key)
}
output "fromressource" {
value = {
key = resource.kubernetes_service_v1.automatic_service_database
}
sensitive = true
}
terraform.tfstate
+18670 -253
View File
File diff suppressed because one or more lines are too long
terraform.tfstate.backup
+18694 -276
View File
File diff suppressed because one or more lines are too long
variables.auto.tfvars
+24 -17
View File
@@ -11,6 +11,8 @@ kubernetes = {
"image" = "lscr.io/linuxserver/mariadb"
"port" = 3306
"mountPath" = "/config"
username = "bookstack_username"
name = "bookstackapp"
}
# requirements = {
# limits-cpu = "18m"
@@ -200,12 +202,13 @@ kubernetes = {
gluetun = {
# enabled = false
dns_nameservers = "10.2.0.1"
replicas = 01
image = "qmcgaw/gluetun:latest"
service_port = [8888]
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/gluetun/gluetun-secret-netherland.yaml"]
security_context = true
dns_nameservers = "10.2.0.1"
replicas = 01
image = "qmcgaw/gluetun:latest"
service_port = [8888]
#extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/gluetun/gluetun-secret-netherland.yaml"]
secret_import = ["5527ba11-07e3-415b-8d1f-b3ee0154eb56"]
security_context = true
# requirements = {
# limits-cpu = "800Mi"
# limits-memory = "800Mi"
@@ -997,7 +1000,9 @@ kubernetes = {
service_port = [9696]
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/servarr/servarr-db.secret.yaml"]
database = {
"image" = "docker.io/library/postgres:17.5"
"image" = "docker.io/library/postgres:17.5"
name = "prowlarr-main"
username = "servarr_username"
}
environment = {
@@ -1563,7 +1568,8 @@ kubernetes = {
image = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest"
service_port = [8000]
database = {
image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
username = "django_username"
}
redis = {}
@@ -2128,14 +2134,14 @@ kubernetes = {
bitwarden-admin = {
#enabled = false
namespace = "bitwarden"
replicas = 1
name = "bitwarden-admin"
image = "ghcr.io/bitwarden/admin:2026.1.0"
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/config.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/uid.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/identity-svc.svc.yaml"]
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
environment = {}
namespace = "bitwarden"
replicas = 1
name = "bitwarden-admin"
image = "ghcr.io/bitwarden/admin:2026.1.0"
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/config.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/uid.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/identity-svc.svc.yaml"]
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
environment = {}
pvc = {
bitwarden-ca-certificates = {
@@ -2483,8 +2489,9 @@ kubernetes = {
# enabled = false
#image = "lscr.io/linuxserver/fail2ban:latest"
image = "gitea.tryton.geeraert.eu/pi-ux-ce/fail2ban:latest"
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.RoleBinding.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.Role.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.ServiceAccount.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban-nginx-http-auth-jail.configmap.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban-nginx-unauthorized-filter.configmap.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/nginx-block-map-action.configmap.yaml"]
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.RoleBinding.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.Role.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.ServiceAccount.yaml"]
service_account_name = "kubectl-service-account"
config_map_import = ["9d8ef71a-de74-478b-aa86-b3ee0160dc43","50814edb-d190-41cb-8950-b3ee01622dcf","fb11452e-fec1-489f-9144-b3ee0162ccda"]
environment = {
PUID = {
value = "1000"
variables.auto.tfvars.save
+1574
View File
File diff suppressed because it is too large Load Diff