secret module + make things equal
This commit is contained in:
pierre geeraert
@@ -0,0 +1,304 @@
|
||||
variable "kubernetes_input" {
|
||||
type = map(object({
|
||||
namespace = optional(string)
|
||||
connected_namespace = optional(string, "")
|
||||
database = optional(map(string))
|
||||
redis = optional(map(string))
|
||||
enabled = optional(bool, true)
|
||||
config_map_import = optional(list(string))
|
||||
secret_import = optional(list(string))
|
||||
requirements = optional(map(string), {
|
||||
limits-cpu = "800m"
|
||||
limits-memory = "500Mi"
|
||||
requests-cpu = "200m"
|
||||
requests-memory = "200Mi"
|
||||
})
|
||||
import_database_secret = optional(object({
|
||||
#putting them a non optional as the code doesn't allow optional value
|
||||
host = string
|
||||
name = string
|
||||
password = string
|
||||
port = string
|
||||
username = string
|
||||
}))
|
||||
}))
|
||||
|
||||
}
|
||||
|
||||
###########################################################################################################################################################################################
|
||||
#
|
||||
#
|
||||
# CONFIGMAP PART
|
||||
#
|
||||
#
|
||||
#
|
||||
###########################################################################################################################################################################################
|
||||
data "bitwarden-secrets_secret" "configmap_import" {
|
||||
for_each = {
|
||||
for pair in flatten([
|
||||
for k, v in var.kubernetes_input : [
|
||||
for id in v.config_map_import : {
|
||||
map_key = k
|
||||
secret_id = id
|
||||
}
|
||||
] if v.config_map_import != null && v.enabled == true
|
||||
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
||||
}
|
||||
id = each.value
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map_v1" "configmap_import" {
|
||||
for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
|
||||
metadata {
|
||||
name = each.value.note
|
||||
namespace = split("__", each.value.key)[0]
|
||||
}
|
||||
data = yamldecode(each.value.value)
|
||||
}
|
||||
|
||||
|
||||
data "bitwarden-secrets_secret" "secret_import" {
|
||||
for_each = {
|
||||
for pair in flatten([
|
||||
for k, v in var.kubernetes_input : [
|
||||
for id in v.secret_import : {
|
||||
map_key = k
|
||||
secret_id = id
|
||||
}
|
||||
] if v.secret_import != null && v.enabled == true
|
||||
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
||||
}
|
||||
id = each.value
|
||||
}
|
||||
|
||||
resource "kubernetes_secret_v1" "secret_import" {
|
||||
for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
|
||||
metadata {
|
||||
name = each.value.note
|
||||
namespace = split("__", each.value.key)[0]
|
||||
}
|
||||
data = yamldecode(each.value.value)
|
||||
}
|
||||
|
||||
###########################################################################################################################################################################################
|
||||
#
|
||||
#
|
||||
# DATABASE PART
|
||||
#
|
||||
#
|
||||
#
|
||||
###########################################################################################################################################################################################
|
||||
resource "kubernetes_secret_v1" "automatic-database-secret" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-db-terraform"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
}
|
||||
|
||||
data = {
|
||||
DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-db-mapped-terraform"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
}
|
||||
|
||||
data = {
|
||||
"${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
"${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
"${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
"${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__username"
|
||||
value = try(each.value.database.username, each.key)
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value, key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__password"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
length = 32
|
||||
special = true
|
||||
min_special = 5
|
||||
avoid_ambiguous = true
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value, key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__host"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value, key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__port"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.port, 5432)
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value, key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__name"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.name, each.key)
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value, key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# 1. Move the loop logic to a local variable first
|
||||
locals {
|
||||
database_secrets_to_import = {
|
||||
for key, value in var.kubernetes_input : key => value
|
||||
if value.database != null && value.enabled == true && can(value.import_database_secret.host)
|
||||
}
|
||||
}
|
||||
|
||||
# 2. Reference the local map in your import block using each.key and each.value
|
||||
import {
|
||||
for_each = local.database_secrets_to_import
|
||||
|
||||
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key]
|
||||
id = each.value.import_database_secret.host
|
||||
}
|
||||
|
||||
import {
|
||||
for_each = local.database_secrets_to_import
|
||||
|
||||
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key]
|
||||
id = each.value.import_database_secret.name
|
||||
}
|
||||
import {
|
||||
for_each = local.database_secrets_to_import
|
||||
|
||||
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key]
|
||||
id = each.value.import_database_secret.password
|
||||
}
|
||||
import {
|
||||
for_each = local.database_secrets_to_import
|
||||
|
||||
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key]
|
||||
id = each.value.import_database_secret.port
|
||||
}
|
||||
import {
|
||||
for_each = local.database_secrets_to_import
|
||||
|
||||
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key]
|
||||
id = each.value.import_database_secret.username
|
||||
}
|
||||
###########################################################################################################################################################################################
|
||||
#
|
||||
#
|
||||
# REDIS PART
|
||||
#
|
||||
#
|
||||
#
|
||||
###########################################################################################################################################################################################
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_host" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
||||
key = "${each.key}__redis__host"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.redis.host, "${each.key}-redis-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_port" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
||||
key = "${each.key}__redis__port"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.redis.port, 5432)
|
||||
}
|
||||
|
||||
##
|
||||
## Commenting until I use the redis password option
|
||||
##
|
||||
#resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_password" {
|
||||
# for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
||||
# key = "${each.key}__redis__password"
|
||||
# project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
# length = 32
|
||||
# special = true
|
||||
# min_special = 5
|
||||
# avoid_ambiguous = true
|
||||
#}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_REPLICATION_MODE" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
||||
key = "${each.key}__redis__REPLICATION_MODE"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.redis.REPLICATION_MODE, "master")
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_TLS_ENABLED" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
||||
key = "${each.key}__redis__TLS_ENABLED"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.redis.TLS_ENABLED, "no")
|
||||
}
|
||||
|
||||
resource "kubernetes_secret_v1" "automatic-redis-secret" {
|
||||
for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-redis-terraform"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
}
|
||||
|
||||
data = {
|
||||
REDIS_HOSTNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_host[each.key].value}"
|
||||
REDIS_PORT = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_port[each.key].value}"
|
||||
REDIS_REPLICATION_MODE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_REPLICATION_MODE[each.key].value}"
|
||||
REDIS_TLS_ENABLED = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_TLS_ENABLED[each.key].value}"
|
||||
}
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user