pi-ux-ce/Terraform_kube
1
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

using env files but overcomplicated

Browse Source
This commit is contained in:
pierre.geeraert
2026-10-08 11:31:43 +01:00
parent caac327b50
commit 5289cab76e
9 changed files with 111 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/deployment.tf
+5 -1
View File
@@ -235,7 +235,11 @@ resource "kubernetes_deployment_v1" "automatic" {
}
}
}
depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc]
depends_on = [
kubernetes_persistent_volume_claim_v1.automatic-pvc,
kubernetes_config_map_v1.env_file,
kubernetes_secret_v1.env_file,
]
}
core/env_files.tf
+49
View File
@@ -0,0 +1,49 @@
# Plain KEY=VALUE files (docker --env-file semantics, one pair per line, # comments)
# kept in external_manifests/, rendered into a ConfigMap or Secret at apply time.
# Deployments consume them through the existing config_map_ref / secret_ref fields.
variable "env_files" {
type = map(object({
namespace = string
path = string # relative to this module, e.g. ../external_manifests/bitwarden/global.env
secret = optional(bool, false)
enabled = optional(bool, true)
}))
default = {}
}
locals {
env_files = { for name, f in var.env_files : name => f if f.enabled }
# A duplicate key inside one file fails the plan on purpose.
env_data = {
for name, f in local.env_files : name => {
for line in split("\n", replace(file("${path.module}/${f.path}"), "\r", "")) :
split("=", line)[0] => substr(line, length(split("=", line)[0]) + 1, -1)
if can(regex("^[A-Za-z_][^=\\s]*=", line))
}
}
}
resource "kubernetes_config_map_v1" "env_file" {
for_each = { for name, f in local.env_files : name => f if !f.secret }
metadata {
name = each.key
namespace = each.value.namespace
labels = {
deployment_method = "Terraform"
}
}
data = local.env_data[each.key]
}
resource "kubernetes_secret_v1" "env_file" {
for_each = { for name, f in local.env_files : name => f if f.secret }
metadata {
name = each.key
namespace = each.value.namespace
labels = {
deployment_method = "Terraform"
}
}
data = local.env_data[each.key]
}
core/variables.auto.tfvars
+20 -2
View File
@@ -128,9 +128,9 @@ kubernetes = {
replicas = 1
name = "bitwarden-admin"
image = "ghcr.io/bitwarden/admin:2026.1.0"
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/config.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/uid.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/identity-svc.svc.yaml"]
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
@@ -168,6 +168,7 @@ kubernetes = {
image = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_api:2026.1.0"
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
@@ -225,6 +226,7 @@ kubernetes = {
image = "ghcr.io/bitwarden/events:2026.1.0"
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
@@ -277,9 +279,11 @@ kubernetes = {
connected_namespace = "bitwarden"
replicas = 1
name = "bitwarden-identity"
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/identity-svc.svc.yaml"]
image = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_identity:2026.1.0"
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
@@ -318,7 +322,8 @@ kubernetes = {
name = "bitwarden-mssql"
image = "ghcr.io/bitwarden/mssql:2026.1.0"
service_port = [1433, 5000]
config_map_ref = ["mssql.env", "uid.env", "mssql.override.env"]
config_map_ref = ["mssql.env", "uid.env"]
secret_ref = ["mssql.secret"]
environment = {}
database = {
shunt = "true"
@@ -392,6 +397,7 @@ kubernetes = {
image = "ghcr.io/bitwarden/notifications:2026.1.0"
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
@@ -418,6 +424,7 @@ kubernetes = {
image = "ghcr.io/bitwarden/sso:2026.1.0"
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
@@ -469,3 +476,14 @@ kubernetes = {
}
}
# Config kept as plain env files in external_manifests/, rendered into ConfigMaps/Secrets by env_files.tf.
# Reference them from a service with config_map_ref / secret_ref (names below).
env_files = {
"global.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.env" }
"global.override.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.override.env" }
"uid.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/uid.env" }
"mssql.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/mssql.env" }
"global.override.secret" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.override.secret.env", secret = true }
"mssql.secret" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/mssql.secret.env", secret = true }
}
external_manifests/bitwarden/global.env
+12
View File
@@ -0,0 +1,12 @@
ACCEPT_EULA=Y
ASPNETCORE_ENVIRONMENT=Production
globalSettings__baseServiceUri__vault=http://localhost
globalSettings__pushRelayBaseUri=https://push.bitwarden.com
globalSettings__selfHosted=true
globalSettings__baseServiceUri__internalNotifications=http://bitwarden-notifications-svc:5000
globalSettings__baseServiceUri__internalAdmin=http://bitwarden-admin-svc:5000
globalSettings__baseServiceUri__internalIdentity=http://bitwarden-identity-svc:5000
globalSettings__baseServiceUri__internalApi=http://bitwarden-api-svc:5000
globalSettings__baseServiceUri__internalVault=http://bitwarden-web-svc:5000
globalSettings__baseServiceUri__internalSso=http://bitwarden-sso-svc:5000
globalSettings__baseServiceUri__internalScim=http://bitwarden-self-host-scim:5000
external_manifests/bitwarden/global.override.env
+11
View File
@@ -0,0 +1,11 @@
ACCEPT_EULA=Y
adminSettings__admins=pierre@geeraert.eu
globalSettings__baseServiceUri__vault=http://bitwarden.tryton.geeraert.eu
globalSettings__disableUserRegistration=false
globalSettings__installation__id=c36aded0-b0f1-4252-920b-ac4c008fc920
globalSettings__mail__replyToEmail=no-reply@bitwarden.tryton.geeraert.eu
globalSettings__mail__smtp__host=smtp.gmail.com
globalSettings__mail__smtp__port=587
globalSettings__mail__smtp__ssl=false
globalSettings__mail__smtp__username=p3jh6qa2@gmail.com
globalSettings__yubico__clientId=REPLACE
external_manifests/bitwarden/global.override.secret.env.example
+9
View File
@@ -0,0 +1,9 @@
globalSettings__duo__aKey=
globalSettings__hibpApiKey=
globalSettings__identityServer__certificatePassword=
globalSettings__installation__key=
globalSettings__internalIdentityKey=
globalSettings__mail__smtp__password=
globalSettings__oidcIdentityClientKey=
globalSettings__sqlServer__connectionString=
globalSettings__yubico__key=
external_manifests/bitwarden/mssql.env
+2
View File
@@ -0,0 +1,2 @@
ACCEPT_EULA=Y
MSSQL_PID=Express
external_manifests/bitwarden/mssql.secret.env.example
+1
View File
@@ -0,0 +1 @@
SA_PASSWORD=
external_manifests/bitwarden/uid.env
+2
View File
@@ -0,0 +1,2 @@
LOCAL_GID=1001
LOCAL_UID=1001