using env files but overcomplicated

core/env_files.tf

@@ -0,0 +1,49 @@
+# Plain KEY=VALUE files (docker --env-file semantics, one pair per line, # comments)
+# kept in external_manifests/, rendered into a ConfigMap or Secret at apply time.
+# Deployments consume them through the existing config_map_ref / secret_ref fields.
+variable "env_files" {
+  type = map(object({
+    namespace = string
+    path      = string # relative to this module, e.g. ../external_manifests/bitwarden/global.env
+    secret    = optional(bool, false)
+    enabled   = optional(bool, true)
+  }))
+  default = {}
+}
+
+locals {
+  env_files = { for name, f in var.env_files : name => f if f.enabled }
+
+  # A duplicate key inside one file fails the plan on purpose.
+  env_data = {
+    for name, f in local.env_files : name => {
+      for line in split("\n", replace(file("${path.module}/${f.path}"), "\r", "")) :
+      split("=", line)[0] => substr(line, length(split("=", line)[0]) + 1, -1)
+      if can(regex("^[A-Za-z_][^=\\s]*=", line))
+    }
+  }
+}
+
+resource "kubernetes_config_map_v1" "env_file" {
+  for_each = { for name, f in local.env_files : name => f if !f.secret }
+  metadata {
+    name      = each.key
+    namespace = each.value.namespace
+    labels = {
+      deployment_method = "Terraform"
+    }
+  }
+  data = local.env_data[each.key]
+}
+
+resource "kubernetes_secret_v1" "env_file" {
+  for_each = { for name, f in local.env_files : name => f if f.secret }
+  metadata {
+    name      = each.key
+    namespace = each.value.namespace
+    labels = {
+      deployment_method = "Terraform"
+    }
+  }
+  data = local.env_data[each.key]
+}