From 7553bcc92345caaf405cc38dfd369cc48cfe18a8 Mon Sep 17 00:00:00 2001 From: "pierre.geeraert" Date: Tue, 13 Oct 2026 21:31:30 +0100 Subject: [PATCH] reformat --- applications/database.tf | 172 ++++++ applications/deployment.tf | 252 +++++++++ applications/module.tf | 860 ----------------------------- applications/redis.tf | 126 +++++ applications/secrets.tf | 133 +++++ applications/variables.auto.tfvars | 4 +- 6 files changed, 685 insertions(+), 862 deletions(-) create mode 100644 applications/database.tf create mode 100644 applications/deployment.tf create mode 100644 applications/secrets.tf diff --git a/applications/database.tf b/applications/database.tf new file mode 100644 index 0000000..5eb7832 --- /dev/null +++ b/applications/database.tf @@ -0,0 +1,172 @@ +resource "kubernetes_deployment_v1" "database-automatic" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) } + + + metadata { + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + name = "${coalesce(each.value.name, each.key)}-db" + labels = { + app = each.key + deployment_method = "Terraform" + database = "true" + } + } + + spec { + replicas = each.value.replicas + + selector { + match_labels = { + app = "${each.key}-db" + } + } + + template { + metadata { + labels = { + app = "${each.key}-db" + deployment_method = "Terraform" + database = "true" + } + } + + spec { + container { + image = try(each.value.database.image, "docker.io/library/postgres:latest") + name = "${coalesce(each.value.name, each.key)}-db" + port { + + container_port = 5432 + name = "database-port" + + } + + volume_mount { + mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/") + name = "${each.key}-db-pvc" + } + + dynamic "volume_mount" { + for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : [] + content { + mount_path = "/backup" + name = "${each.key}-db-backup" + } + } + + command = try([each.value.database.command], []) + args = each.value.database_args != null ? each.value.database_args : [] + + dynamic "env_from" { + for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : [] + content { + dynamic "secret_ref" { + for_each = [1] + content { + name = env_from.value + } + } + } + } + + dynamic "env" { + for_each = each.value.environment != null ? each.value.environment : {} + content { + name = env.key + value = env.value.value != null ? env.value.value : null + dynamic "value_from" { + for_each = env.value.value_from != null ? env.value.value_from : {} + content { + dynamic "secret_key_ref" { + for_each = [1] + content { + name = env.value.value_from.secret_key_ref.name + key = env.value.value_from.secret_key_ref.key + # optional = true + } + } + } + } + + } + } + + + } + + + volume { + name = "${each.key}-db-pvc" + persistent_volume_claim { + claim_name = "${each.key}-db-pvc" + } + } + + dynamic "volume" { + for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : [] + content { + name = "${each.key}-db-backup" + + persistent_volume_claim { + claim_name = "${each.key}-db-backup" + } + } + } + + } + } + } +} + + +resource "kubernetes_cron_job_v1" "database-backup" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + metadata { + name = "${coalesce(each.value.namespace, each.key)}-db-backup" + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + labels = { + app = each.key + deployment_method = "Terraform" + database = "true" + } + } + spec { + failed_jobs_history_limit = 5 + schedule = "1 0 * * *" + timezone = "Etc/UTC" + successful_jobs_history_limit = 5 + job_template { + metadata {} + spec { + backoff_limit = 4 + ttl_seconds_after_finished = 100 + template { + metadata {} + spec { + container { + name = "${coalesce(each.value.namespace, each.key)}-db-backup" + image = try(var.database_backup_info[each.value.database.engine].image, var.database_backup_info.postgres.image) + command = ["/bin/sh", "-c"] + args = [try(var.database_backup_info[each.value.database.engine].command, var.database_backup_info.postgres.command)] + env_from { + secret_ref { + name = "${each.key}-db-terraform" + } + } + volume_mount { + mount_path = "/backup" + name = "${each.key}-db-backup" + } + } + volume { + name = "${each.key}-db-backup" + persistent_volume_claim { + claim_name = "${each.key}-db-backup" + } + } + } + } + } + } + } +} diff --git a/applications/deployment.tf b/applications/deployment.tf new file mode 100644 index 0000000..c2b344f --- /dev/null +++ b/applications/deployment.tf @@ -0,0 +1,252 @@ +module "ingress" { + source = "../modules/ingress" + kubernetes_input = var.kubernetes +} + +module "services" { + source = "../modules/services" + kubernetes_input = var.kubernetes +} + + + + + +resource "kubernetes_deployment_v1" "automatic" { + for_each = { for key, value in var.kubernetes : key => value if value.enabled == true } + metadata { + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + name = coalesce(each.value.name, each.key) + + labels = { + app = each.key + deployment_method = "Terraform" + } + } + + spec { + replicas = each.value.replicas + + selector { + match_labels = { + app = each.key + } + } + + template { + metadata { + labels = { + app = each.key + deployment_method = "Terraform" + } + } + + spec { + container { + image = each.value.image + name = coalesce(each.value.name, each.key) + dynamic "port" { + for_each = each.value.service_port != null ? each.value.service_port : [] + content { + container_port = port.value + # name = "${each.key}-${port.value}" + name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1") + } + } + + + dynamic "volume_mount" { + for_each = each.value.pvc != null ? each.value.pvc : {} + content { + mount_path = volume_mount.value.mount_path + name = "${volume_mount.value.name}-pvc" + sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : "" + } + } + + dynamic "volume_mount" { + for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : [] + content { + mount_path = "/backup" + name = "${each.key}-db-backup" + } + } + + dynamic "env_from" { + for_each = each.value.secret_ref != null ? each.value.secret_ref : [] + content { + dynamic "secret_ref" { + for_each = [1] + content { + name = env_from.value + } + } + + } + } + dynamic "env_from" { + for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : [] + #for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : [] + content { + dynamic "secret_ref" { + for_each = [1] + content { + name = env_from.value + } + } + } + } + dynamic "env_from" { + for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : [] + content { + dynamic "secret_ref" { + for_each = [1] + content { + name = env_from.value + } + } + } + } + dynamic "env_from" { + for_each = each.value.config_map_ref != null ? each.value.config_map_ref : [] + content { + dynamic "config_map_ref" { + for_each = [1] + content { + name = env_from.value + } + } + } + } + + command = each.value.command != null ? each.value.command : [] + + + dynamic "env" { + for_each = each.value.environment != null ? each.value.environment : {} + content { + name = env.key + value = env.value.value != null ? env.value.value : null + dynamic "value_from" { + for_each = env.value.value_from != null ? env.value.value_from : {} + content { + dynamic "secret_key_ref" { + for_each = [1] + content { + name = env.value.value_from.secret_key_ref.name + key = env.value.value_from.secret_key_ref.key + } + } + } + } + + } + } + dynamic "resources" { + for_each = each.value.requirements != null ? [1] : [] + content { + limits = { + cpu = each.value.requirements.limits-cpu + memory = each.value.requirements.limits-memory + } + requests = { + cpu = each.value.requirements.requests-cpu + memory = each.value.requirements.requests-memory + } + + } + } + + + dynamic "security_context" { + for_each = each.value.security_context == true ? [1] : [] + content { + privileged = true + #capabilities = { + # add : ["NET_ADMIN", "NET_RAW"] + #} + } + } + dynamic "liveness_probe" { + for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : [] + content { + dynamic "tcp_socket" { + for_each = each.value.liveness_tcp_socket != null ? [""] : [] + content { + port = each.value.liveness_tcp_socket + } + } + + dynamic "http_get" { + for_each = each.value.liveness_http_get != null ? [""] : [] + content { + port = each.value.liveness_http_get + path = coalesce(each.value.liveness_http_get_path, "/") + } + } + + initial_delay_seconds = 3 + period_seconds = 3 + } + } + } + dynamic "dns_config" { + for_each = each.value.dns_nameservers != null ? [1] : [] + content { + nameservers = [each.value.dns_nameservers] + } + + } + service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null + + dynamic "volume" { + for_each = each.value.pvc != null ? each.value.pvc : {} + content { + name = "${volume.value.name}-pvc" + + dynamic "persistent_volume_claim" { + for_each = volume.value.pvc ? [1] : [] + content { + claim_name = "${volume.value.name}-pvc" + } + } + + dynamic "config_map" { + for_each = volume.value.config_map ? [1] : [] + content { + name = volume.value.name + } + } + + dynamic "host_path" { + for_each = volume.value.host_path != null ? [1] : [] + content { + path = volume.value.host_path + } + } + + dynamic "secret" { + for_each = volume.value.secret ? [1] : [] + content { + secret_name = volume.value.name + } + } + + } + } + dynamic "volume" { + for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : [] + content { + name = "${each.key}-db-backup" + + persistent_volume_claim { + claim_name = "${each.key}-db-backup" + } + } + } + + } + } + } + depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc] +} diff --git a/applications/module.tf b/applications/module.tf index 816a7c2..3fbb2bc 100644 --- a/applications/module.tf +++ b/applications/module.tf @@ -190,868 +190,8 @@ resource "kubernetes_manifest" "manifest" { -resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc" { - for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true } - metadata { - namespace = coalesce(each.value.namespace, each.key) - name = "${each.value.name}-pvc" - labels = { - deployment_method = "Terraform" - } - annotations = { - fileType = try(each.value.annotations_fileType, "file") - } - } - spec { - access_modes = ["ReadWriteMany"] - storage_class_name = each.value.storage_class_name - resources { - requests = { - storage = each.value.pvc_size - } - } - } -} -resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-database" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) } - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = "${each.key}-db-pvc" - labels = { - deployment_method = "Terraform" - } - } - spec { - access_modes = ["ReadWriteMany"] - storage_class_name = "nfs-storage-intelligent" - resources { - requests = { - storage = "1Gi" - } - } - } -} -resource "kubernetes_persistent_volume_claim_v1" "backup-pvc-database" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = "${each.key}-db-backup" - labels = { - deployment_method = "Terraform" - } - annotations = { - fileType = "Backup" } - } - spec { - access_modes = ["ReadWriteMany"] - storage_class_name = "nfs-storage-fastaccess" - resources { - requests = { - storage = "1Gi" - } - } - } -} -resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-redis" { - for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = "${each.key}-redis-pvc" - labels = { - deployment_method = "Terraform" - } - } - spec { - access_modes = ["ReadWriteMany"] - storage_class_name = "nfs-storage-intelligent" - resources { - requests = { - storage = "1Gi" - } - } - } -} - -resource "kubernetes_service_v1" "automatic_service" { - for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true } - metadata { - name = "${each.key}-svc" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - labels = { - deployment_method = "Terraform" - } - annotations = each.value.service_type == "LoadBalancer" ? { - "metallb.universe.tf/ip-allocated-from-pool" = "first-pool" - } : {} - - - - } - spec { - selector = { - app = each.key - } - dynamic "port" { - for_each = each.value.service_port != null ? each.value.service_port : [] - content { - port = port.value - target_port = port.value - name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1") - - } - } - - # port { - # port = each.value.service_port - # target_port = each.value.service_port - # } - type = each.value.service_type - - - } - - -} - -resource "kubernetes_service_v1" "automatic_service_database" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) } - metadata { - name = "${each.key}-db-svc" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - labels = { - deployment_method = "Terraform" - #username = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password[each.key].key}" - } - } - spec { - selector = { - app = "${each.key}-db" - } - port { - port = try(each.value.database.port, 5432) - target_port = try(each.value.database.port, 5432) - } - - } - - -} - - - -resource "kubernetes_service_v1" "automatic_service_redis" { - for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } - metadata { - name = "${each.key}-redis-svc" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - labels = { - deployment_method = "Terraform" - } - } - spec { - selector = { - app = "${each.key}-redis" - } - port { - port = 6379 - target_port = 6379 - } - } -} - - - -resource "kubernetes_deployment_v1" "automatic" { - for_each = { for key, value in var.kubernetes : key => value if value.enabled == true } - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = coalesce(each.value.name, each.key) - - labels = { - app = each.key - deployment_method = "Terraform" - } - } - - spec { - replicas = each.value.replicas - - selector { - match_labels = { - app = each.key - } - } - - template { - metadata { - labels = { - app = each.key - deployment_method = "Terraform" - } - } - - spec { - container { - image = each.value.image - name = coalesce(each.value.name, each.key) - dynamic "port" { - for_each = each.value.service_port != null ? each.value.service_port : [] - content { - container_port = port.value - # name = "${each.key}-${port.value}" - name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1") - } - } - - - dynamic "volume_mount" { - for_each = each.value.pvc != null ? each.value.pvc : {} - content { - mount_path = volume_mount.value.mount_path - name = "${volume_mount.value.name}-pvc" - sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : "" - } - } - - dynamic "volume_mount" { - for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : [] - content { - mount_path = "/backup" - name = "${each.key}-db-backup" - } - } - - dynamic "env_from" { - for_each = each.value.secret_ref != null ? each.value.secret_ref : [] - content { - dynamic "secret_ref" { - for_each = [1] - content { - name = env_from.value - } - } - - } - } - dynamic "env_from" { - for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : [] - #for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : [] - content { - dynamic "secret_ref" { - for_each = [1] - content { - name = env_from.value - } - } - } - } - dynamic "env_from" { - for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : [] - content { - dynamic "secret_ref" { - for_each = [1] - content { - name = env_from.value - } - } - } - } - dynamic "env_from" { - for_each = each.value.config_map_ref != null ? each.value.config_map_ref : [] - content { - dynamic "config_map_ref" { - for_each = [1] - content { - name = env_from.value - } - } - } - } - - command = each.value.command != null ? each.value.command : [] - - - dynamic "env" { - for_each = each.value.environment != null ? each.value.environment : {} - content { - name = env.key - value = env.value.value != null ? env.value.value : null - dynamic "value_from" { - for_each = env.value.value_from != null ? env.value.value_from : {} - content { - dynamic "secret_key_ref" { - for_each = [1] - content { - name = env.value.value_from.secret_key_ref.name - key = env.value.value_from.secret_key_ref.key - } - } - } - } - - } - } - dynamic "resources" { - for_each = each.value.requirements != null ? [1] : [] - content { - limits = { - cpu = each.value.requirements.limits-cpu - memory = each.value.requirements.limits-memory - } - requests = { - cpu = each.value.requirements.requests-cpu - memory = each.value.requirements.requests-memory - } - - } - } - - - dynamic "security_context" { - for_each = each.value.security_context == true ? [1] : [] - content { - privileged = true - #capabilities = { - # add : ["NET_ADMIN", "NET_RAW"] - #} - } - } - dynamic "liveness_probe" { - for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : [] - content { - dynamic "tcp_socket" { - for_each = each.value.liveness_tcp_socket != null ? [""] : [] - content { - port = each.value.liveness_tcp_socket - } - } - - dynamic "http_get" { - for_each = each.value.liveness_http_get != null ? [""] : [] - content { - port = each.value.liveness_http_get - path = coalesce(each.value.liveness_http_get_path, "/") - } - } - - initial_delay_seconds = 3 - period_seconds = 3 - } - } - } - dynamic "dns_config" { - for_each = each.value.dns_nameservers != null ? [1] : [] - content { - nameservers = [each.value.dns_nameservers] - } - - } - service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null - - dynamic "volume" { - for_each = each.value.pvc != null ? each.value.pvc : {} - content { - name = "${volume.value.name}-pvc" - - dynamic "persistent_volume_claim" { - for_each = volume.value.pvc ? [1] : [] - content { - claim_name = "${volume.value.name}-pvc" - } - } - - dynamic "config_map" { - for_each = volume.value.config_map ? [1] : [] - content { - name = volume.value.name - } - } - - dynamic "host_path" { - for_each = volume.value.host_path != null ? [1] : [] - content { - path = volume.value.host_path - } - } - - dynamic "secret" { - for_each = volume.value.secret ? [1] : [] - content { - secret_name = volume.value.name - } - } - - } - } - dynamic "volume" { - for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : [] - content { - name = "${each.key}-db-backup" - - persistent_volume_claim { - claim_name = "${each.key}-db-backup" - } - } - } - - } - } - } - depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc] -} - - - -resource "kubernetes_deployment_v1" "database-automatic" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) } - - - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = "${coalesce(each.value.name, each.key)}-db" - labels = { - app = each.key - deployment_method = "Terraform" - database = "true" - } - } - - spec { - replicas = each.value.replicas - - selector { - match_labels = { - app = "${each.key}-db" - } - } - - template { - metadata { - labels = { - app = "${each.key}-db" - deployment_method = "Terraform" - database = "true" - } - } - - spec { - container { - image = try(each.value.database.image, "docker.io/library/postgres:latest") - name = "${coalesce(each.value.name, each.key)}-db" - port { - - container_port = 5432 - name = "database-port" - - } - - volume_mount { - mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/") - name = "${each.key}-db-pvc" - } - - dynamic "volume_mount" { - for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : [] - content { - mount_path = "/backup" - name = "${each.key}-db-backup" - } - } - - command = try([each.value.database.command], []) - args = each.value.database_args != null ? each.value.database_args : [] - - dynamic "env_from" { - for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : [] - content { - dynamic "secret_ref" { - for_each = [1] - content { - name = env_from.value - } - } - } - } - - dynamic "env" { - for_each = each.value.environment != null ? each.value.environment : {} - content { - name = env.key - value = env.value.value != null ? env.value.value : null - dynamic "value_from" { - for_each = env.value.value_from != null ? env.value.value_from : {} - content { - dynamic "secret_key_ref" { - for_each = [1] - content { - name = env.value.value_from.secret_key_ref.name - key = env.value.value_from.secret_key_ref.key - # optional = true - } - } - } - } - - } - } - - - } - - - volume { - name = "${each.key}-db-pvc" - persistent_volume_claim { - claim_name = "${each.key}-db-pvc" - } - } - - dynamic "volume" { - for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : [] - content { - name = "${each.key}-db-backup" - - persistent_volume_claim { - claim_name = "${each.key}-db-backup" - } - } - } - - } - } - } -} - - -resource "kubernetes_cron_job_v1" "database-backup" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - metadata { - name = "${coalesce(each.value.namespace, each.key)}-db-backup" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - labels = { - app = each.key - deployment_method = "Terraform" - database = "true" - } - } - spec { - failed_jobs_history_limit = 5 - schedule = "1 0 * * *" - timezone = "Etc/UTC" - successful_jobs_history_limit = 5 - job_template { - metadata {} - spec { - backoff_limit = 4 - ttl_seconds_after_finished = 100 - template { - metadata {} - spec { - container { - name = "${coalesce(each.value.namespace, each.key)}-db-backup" - image = try(var.database_backup_info[each.value.database.engine].image, var.database_backup_info.postgres.image) - command = ["/bin/sh", "-c"] - args = [try(var.database_backup_info[each.value.database.engine].command, var.database_backup_info.postgres.command)] - env_from { - secret_ref { - name = "${each.key}-db-terraform" - } - } - volume_mount { - mount_path = "/backup" - name = "${each.key}-db-backup" - } - } - volume { - name = "${each.key}-db-backup" - persistent_volume_claim { - claim_name = "${each.key}-db-backup" - } - } - } - } - } - } - } -} - - -resource "kubernetes_deployment_v1" "redis-automatic" { - for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } - - - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = "${coalesce(each.value.name, each.key)}-redis" - labels = { - app = each.key - deployment_method = "Terraform" - redis = "true" - } - } - - spec { - replicas = each.value.replicas - - selector { - match_labels = { - app = "${each.key}-redis" - } - } - - template { - metadata { - labels = { - app = "${each.key}-redis" - deployment_method = "Terraform" - redis = "true" - } - } - - spec { - container { - image = try(each.value.redis.image, "docker.io/library/redis:7") - name = "${coalesce(each.value.name, each.key)}-redis" - port { - - container_port = 6379 - name = "redis-port" - - } - - volume_mount { - mount_path = "/data" - name = "${each.key}-redis-pvc" - } - - - - - - dynamic "env" { - for_each = each.value.environment != null ? each.value.environment : {} - content { - name = env.key - value = env.value.value != null ? env.value.value : null - dynamic "value_from" { - for_each = env.value.value_from != null ? env.value.value_from : {} - content { - dynamic "secret_key_ref" { - for_each = [1] - content { - name = env.value.value_from.secret_key_ref.name - key = env.value.value_from.secret_key_ref.key - # optional = true - } - } - } - } - - } - } - - - # resources { - # limits = { - # cpu = each.value.requirements.limits-cpu - # memory = each.value.requirements.limits-memory - # } - # requests = { - # cpu = each.value.requirements.requests-cpu - # memory = each.value.requirements.requests-memory - # } - # } - - # dynamic "liveness_probe" { - # for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : [] - # content { - # dynamic "tcp_socket" { - # for_each = each.value.liveness_tcp_socket != null ? [""] : [] - # content { - # port = each.value.liveness_tcp_socket - # } - # } - - - # dynamic "http_get" { - # for_each = each.value.liveness_http_get != null ? [""] : [] - # content { - # port = each.value.liveness_http_get - # path = coalesce(each.value.liveness_http_get_path, "/") - # } - # } - - # initial_delay_seconds = 3 - # period_seconds = 3 - # } - # } - } - - - volume { - name = "${each.key}-redis-pvc" - persistent_volume_claim { - claim_name = "${each.key}-redis-pvc" - } - } - - } - } - } -} - -resource "kubernetes_config_map_v1" "automatic-configmap" { - metadata { - name = "extra-sites-terraform" - namespace = "reverse-proxy" - annotations = { - "reloader.stakater.com/match" : "true", - } - } - - data = { - for key, value in var.kubernetes : - "${value.domain_name}.conf" => templatefile("nginx_config.tftpl", { - name_site = value.domain_name - name_service = "${key}-svc.${coalesce(value.namespace, value.connected_namespace, key)}.svc:${value.service_port.0}" - }) if value.domain_name != null && value.enabled == true - } - -} - -data "bitwarden-secrets_secret" "configmap_import" { - for_each = { - for pair in flatten([ - for k, v in var.kubernetes : [ - for id in v.config_map_import : { - map_key = k - secret_id = id - } - ] if v.config_map_import != null && v.enabled == true - ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id - } - id = each.value -} - -resource "kubernetes_config_map_v1" "configmap_import" { - for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value } - metadata { - name = each.value.note - namespace = split("__", each.value.key)[0] - } - data = yamldecode(each.value.value) -} - - -data "bitwarden-secrets_secret" "secret_import" { - for_each = { - for pair in flatten([ - for k, v in var.kubernetes : [ - for id in v.secret_import : { - map_key = k - secret_id = id - } - ] if v.secret_import != null && v.enabled == true - ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id - } - id = each.value -} - -resource "kubernetes_secret_v1" "secret_import" { - for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value } - metadata { - name = each.value.note - namespace = split("__", each.value.key)[0] - } - data = yamldecode(each.value.value) -} - - -resource "kubernetes_secret_v1" "automatic-database-secret" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - metadata { - name = "${each.key}-db-terraform" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - } - - data = { - DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" - PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" - POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" - DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" - POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" - MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" - PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" - DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - } - -} - -resource "kubernetes_secret_v1" "automatic-database-mapped-secret" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - metadata { - name = "${each.key}-db-mapped-terraform" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - } - - data = { - "${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - "${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" - "${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - "${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" - } -} - - -resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - key = "${each.key}__db__username" - value = try(each.value.database.username, each.key) - project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" -} - -resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - key = "${each.key}__db__password" - project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" - length = 32 - special = true - min_special = 5 - avoid_ambiguous = true -} - -resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - key = "${each.key}__db__host" - project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" - value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc") -} - -resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - key = "${each.key}__db__port" - project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" - value = try(each.value.database.port, 5432) -} - -resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - key = "${each.key}__db__name" - project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" - value = try(each.value.database.name, each.key) -} diff --git a/applications/redis.tf b/applications/redis.tf index 628b9e6..d000990 100644 --- a/applications/redis.tf +++ b/applications/redis.tf @@ -54,3 +54,129 @@ resource "kubernetes_secret_v1" "automatic-redis-secret" { } } + + + +resource "kubernetes_deployment_v1" "redis-automatic" { + for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } + + + metadata { + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + name = "${coalesce(each.value.name, each.key)}-redis" + labels = { + app = each.key + deployment_method = "Terraform" + redis = "true" + } + } + + spec { + replicas = each.value.replicas + + selector { + match_labels = { + app = "${each.key}-redis" + } + } + + template { + metadata { + labels = { + app = "${each.key}-redis" + deployment_method = "Terraform" + redis = "true" + } + } + + spec { + container { + image = try(each.value.redis.image, "docker.io/library/redis:7") + name = "${coalesce(each.value.name, each.key)}-redis" + port { + + container_port = 6379 + name = "redis-port" + + } + + volume_mount { + mount_path = "/data" + name = "${each.key}-redis-pvc" + } + + + + + + dynamic "env" { + for_each = each.value.environment != null ? each.value.environment : {} + content { + name = env.key + value = env.value.value != null ? env.value.value : null + dynamic "value_from" { + for_each = env.value.value_from != null ? env.value.value_from : {} + content { + dynamic "secret_key_ref" { + for_each = [1] + content { + name = env.value.value_from.secret_key_ref.name + key = env.value.value_from.secret_key_ref.key + # optional = true + } + } + } + } + + } + } + + + # resources { + # limits = { + # cpu = each.value.requirements.limits-cpu + # memory = each.value.requirements.limits-memory + # } + # requests = { + # cpu = each.value.requirements.requests-cpu + # memory = each.value.requirements.requests-memory + # } + # } + + # dynamic "liveness_probe" { + # for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : [] + # content { + # dynamic "tcp_socket" { + # for_each = each.value.liveness_tcp_socket != null ? [""] : [] + # content { + # port = each.value.liveness_tcp_socket + # } + # } + + + # dynamic "http_get" { + # for_each = each.value.liveness_http_get != null ? [""] : [] + # content { + # port = each.value.liveness_http_get + # path = coalesce(each.value.liveness_http_get_path, "/") + # } + # } + + # initial_delay_seconds = 3 + # period_seconds = 3 + # } + # } + } + + + volume { + name = "${each.key}-redis-pvc" + persistent_volume_claim { + claim_name = "${each.key}-redis-pvc" + } + } + + } + } + } +} diff --git a/applications/secrets.tf b/applications/secrets.tf new file mode 100644 index 0000000..96cd806 --- /dev/null +++ b/applications/secrets.tf @@ -0,0 +1,133 @@ + +data "bitwarden-secrets_secret" "configmap_import" { + for_each = { + for pair in flatten([ + for k, v in var.kubernetes : [ + for id in v.config_map_import : { + map_key = k + secret_id = id + } + ] if v.config_map_import != null && v.enabled == true + ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id + } + id = each.value +} + +resource "kubernetes_config_map_v1" "configmap_import" { + for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value } + metadata { + name = each.value.note + namespace = split("__", each.value.key)[0] + } + data = yamldecode(each.value.value) +} + + +data "bitwarden-secrets_secret" "secret_import" { + for_each = { + for pair in flatten([ + for k, v in var.kubernetes : [ + for id in v.secret_import : { + map_key = k + secret_id = id + } + ] if v.secret_import != null && v.enabled == true + ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id + } + id = each.value +} + +resource "kubernetes_secret_v1" "secret_import" { + for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value } + metadata { + name = each.value.note + namespace = split("__", each.value.key)[0] + } + data = yamldecode(each.value.value) +} + + +resource "kubernetes_secret_v1" "automatic-database-secret" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + metadata { + name = "${each.key}-db-terraform" + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + } + + data = { + DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" + PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" + POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" + DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" + POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" + MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" + PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" + DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + } + +} + +resource "kubernetes_secret_v1" "automatic-database-mapped-secret" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + metadata { + name = "${each.key}-db-mapped-terraform" + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + } + + data = { + "${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + "${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" + "${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + "${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" + } +} + + +resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + key = "${each.key}__db__username" + value = try(each.value.database.username, each.key) + project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" +} + +resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + key = "${each.key}__db__password" + project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" + length = 32 + special = true + min_special = 5 + avoid_ambiguous = true +} + +resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + key = "${each.key}__db__host" + project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" + value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc") +} + +resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + key = "${each.key}__db__port" + project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" + value = try(each.value.database.port, 5432) +} + +resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + key = "${each.key}__db__name" + project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" + value = try(each.value.database.name, each.key) +} + diff --git a/applications/variables.auto.tfvars b/applications/variables.auto.tfvars index bbfd484..4583396 100644 --- a/applications/variables.auto.tfvars +++ b/applications/variables.auto.tfvars @@ -1139,8 +1139,8 @@ kubernetes = { wikijs = { #enabled = false - image = "ghcr.io/requarks/wiki:2.5" - service_port = [3000] + image = "ghcr.io/requarks/wiki:2.5" + service_port = [3000] extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/wikijs/wikijs-db.secret.yaml"] database = { image = "postgres:17"