infra restructure and adding lifecycle to the secret
This commit is contained in:
pierre.geeraert
@@ -0,0 +1,196 @@
|
||||
resource "kubernetes_service_v1" "automatic_service_database" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
|
||||
metadata {
|
||||
name = "${each.key}-db-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
#username = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password[each.key].key}"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = "${each.key}-db"
|
||||
}
|
||||
port {
|
||||
port = try(each.value.database.port, 5432)
|
||||
target_port = try(each.value.database.port, 5432)
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_deployment_v1" "database-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
|
||||
|
||||
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${coalesce(each.value.name, each.key)}-db"
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "${each.key}-db"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "${each.key}-db"
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = try(each.value.database.image, "docker.io/library/postgres:latest")
|
||||
name = "${coalesce(each.value.name, each.key)}-db"
|
||||
port {
|
||||
|
||||
container_port = 5432
|
||||
name = "database-port"
|
||||
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
|
||||
name = "${each.key}-db-pvc"
|
||||
}
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
|
||||
content {
|
||||
mount_path = "/backup"
|
||||
name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
|
||||
command = try([each.value.database.command], [])
|
||||
args = each.value.database_args != null ? each.value.database_args : []
|
||||
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
# optional = true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
volume {
|
||||
name = "${each.key}-db-pvc"
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-db-pvc"
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
|
||||
content {
|
||||
name = "${each.key}-db-backup"
|
||||
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_cron_job_v1" "database-backup" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${coalesce(each.value.namespace, each.key)}-db-backup"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
failed_jobs_history_limit = 5
|
||||
schedule = "1 0 * * *"
|
||||
timezone = "Etc/UTC"
|
||||
successful_jobs_history_limit = 5
|
||||
job_template {
|
||||
metadata {}
|
||||
spec {
|
||||
backoff_limit = 4
|
||||
ttl_seconds_after_finished = 100
|
||||
template {
|
||||
metadata {}
|
||||
spec {
|
||||
container {
|
||||
name = "${coalesce(each.value.namespace, each.key)}-db-backup"
|
||||
image = try(var.database_backup_info[each.value.database.engine].image, var.database_backup_info.postgres.image)
|
||||
command = ["/bin/sh", "-c"]
|
||||
args = [try(var.database_backup_info[each.value.database.engine].command, var.database_backup_info.postgres.command)]
|
||||
env_from {
|
||||
secret_ref {
|
||||
name = "${each.key}-db-terraform"
|
||||
}
|
||||
}
|
||||
volume_mount {
|
||||
mount_path = "/backup"
|
||||
name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
volume {
|
||||
name = "${each.key}-db-backup"
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,280 @@
|
||||
resource "kubernetes_service_v1" "automatic_service" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
annotations = each.value.service_type == "LoadBalancer" ? {
|
||||
"metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
|
||||
} : {}
|
||||
|
||||
|
||||
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = each.key
|
||||
}
|
||||
dynamic "port" {
|
||||
for_each = each.value.service_port != null ? each.value.service_port : []
|
||||
content {
|
||||
port = port.value
|
||||
target_port = port.value
|
||||
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
# port {
|
||||
# port = each.value.service_port
|
||||
# target_port = each.value.service_port
|
||||
# }
|
||||
type = each.value.service_type
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_deployment_v1" "automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = coalesce(each.value.name, each.key)
|
||||
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = each.key
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = each.value.image
|
||||
name = coalesce(each.value.name, each.key)
|
||||
dynamic "port" {
|
||||
for_each = each.value.service_port != null ? each.value.service_port : []
|
||||
content {
|
||||
container_port = port.value
|
||||
# name = "${each.key}-${port.value}"
|
||||
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = each.value.pvc != null ? each.value.pvc : {}
|
||||
content {
|
||||
mount_path = volume_mount.value.mount_path
|
||||
name = "${volume_mount.value.name}-pvc"
|
||||
sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
|
||||
content {
|
||||
mount_path = "/backup"
|
||||
name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.secret_ref != null ? each.value.secret_ref : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
|
||||
#for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
|
||||
content {
|
||||
dynamic "config_map_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
command = each.value.command != null ? each.value.command : []
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "resources" {
|
||||
for_each = each.value.requirements != null ? [1] : []
|
||||
content {
|
||||
limits = {
|
||||
cpu = each.value.requirements.limits-cpu
|
||||
memory = each.value.requirements.limits-memory
|
||||
}
|
||||
requests = {
|
||||
cpu = each.value.requirements.requests-cpu
|
||||
memory = each.value.requirements.requests-memory
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dynamic "security_context" {
|
||||
for_each = each.value.security_context == true ? [1] : []
|
||||
content {
|
||||
privileged = true
|
||||
#capabilities = {
|
||||
# add : ["NET_ADMIN", "NET_RAW"]
|
||||
#}
|
||||
}
|
||||
}
|
||||
dynamic "liveness_probe" {
|
||||
for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
||||
content {
|
||||
dynamic "tcp_socket" {
|
||||
for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
||||
content {
|
||||
port = each.value.liveness_tcp_socket
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "http_get" {
|
||||
for_each = each.value.liveness_http_get != null ? [""] : []
|
||||
content {
|
||||
port = each.value.liveness_http_get
|
||||
path = coalesce(each.value.liveness_http_get_path, "/")
|
||||
}
|
||||
}
|
||||
|
||||
initial_delay_seconds = 3
|
||||
period_seconds = 3
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "dns_config" {
|
||||
for_each = each.value.dns_nameservers != null ? [1] : []
|
||||
content {
|
||||
nameservers = [each.value.dns_nameservers]
|
||||
}
|
||||
|
||||
}
|
||||
service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = each.value.pvc != null ? each.value.pvc : {}
|
||||
content {
|
||||
name = "${volume.value.name}-pvc"
|
||||
|
||||
dynamic "persistent_volume_claim" {
|
||||
for_each = volume.value.pvc ? [1] : []
|
||||
content {
|
||||
claim_name = "${volume.value.name}-pvc"
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "config_map" {
|
||||
for_each = volume.value.config_map ? [1] : []
|
||||
content {
|
||||
name = volume.value.name
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "host_path" {
|
||||
for_each = volume.value.host_path != null ? [1] : []
|
||||
content {
|
||||
path = volume.value.host_path
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "secret" {
|
||||
for_each = volume.value.secret ? [1] : []
|
||||
content {
|
||||
secret_name = volume.value.name
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "volume" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
|
||||
content {
|
||||
name = "${each.key}-db-backup"
|
||||
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc]
|
||||
}
|
||||
+37
-845
@@ -150,7 +150,6 @@ locals {
|
||||
}
|
||||
|
||||
|
||||
data "kubernetes_all_namespaces" "allns" {}
|
||||
|
||||
resource "kubernetes_namespace_v1" "automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" }
|
||||
@@ -163,7 +162,6 @@ resource "kubernetes_namespace_v1" "automatic" {
|
||||
}
|
||||
name = coalesce(each.value.namespace, each.key)
|
||||
}
|
||||
depends_on = [data.kubernetes_all_namespaces.allns]
|
||||
}
|
||||
|
||||
locals {
|
||||
@@ -190,868 +188,62 @@ resource "kubernetes_manifest" "manifest" {
|
||||
|
||||
|
||||
|
||||
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc" {
|
||||
for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.key)
|
||||
name = "${each.value.name}-pvc"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
annotations = {
|
||||
fileType = try(each.value.annotations_fileType, "file")
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = each.value.storage_class_name
|
||||
resources {
|
||||
requests = {
|
||||
storage = each.value.pvc_size
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-database" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${each.key}-db-pvc"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = "nfs-storage-intelligent"
|
||||
resources {
|
||||
requests = {
|
||||
storage = "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_persistent_volume_claim_v1" "backup-pvc-database" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${each.key}-db-backup"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
annotations = {
|
||||
fileType = "Backup" }
|
||||
}
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = "nfs-storage-fastaccess"
|
||||
resources {
|
||||
requests = {
|
||||
storage = "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-redis" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${each.key}-redis-pvc"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = "nfs-storage-intelligent"
|
||||
resources {
|
||||
requests = {
|
||||
storage = "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_service_v1" "automatic_service" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
annotations = each.value.service_type == "LoadBalancer" ? {
|
||||
"metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
|
||||
} : {}
|
||||
|
||||
|
||||
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = each.key
|
||||
}
|
||||
dynamic "port" {
|
||||
for_each = each.value.service_port != null ? each.value.service_port : []
|
||||
content {
|
||||
port = port.value
|
||||
target_port = port.value
|
||||
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
# port {
|
||||
# port = each.value.service_port
|
||||
# target_port = each.value.service_port
|
||||
# }
|
||||
type = each.value.service_type
|
||||
# resource "kubernetes_config_map_v1" "automatic-configmap" {
|
||||
# metadata {
|
||||
# name = "extra-sites-terraform"
|
||||
# namespace = "reverse-proxy"
|
||||
# annotations = {
|
||||
# "reloader.stakater.com/match" : "true",
|
||||
# }
|
||||
# }
|
||||
#
|
||||
# data = {
|
||||
# for key, value in var.kubernetes :
|
||||
# "${value.domain_name}.conf" => templatefile("nginx_config.tftpl", {
|
||||
# name_site = value.domain_name
|
||||
# name_service = "${key}-svc.${coalesce(value.namespace, value.connected_namespace, key)}.svc:${value.service_port.0}"
|
||||
# }) if value.domain_name != null && value.enabled == true
|
||||
# }
|
||||
#
|
||||
# }
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_service_v1" "automatic_service_database" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
|
||||
metadata {
|
||||
name = "${each.key}-db-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
#username = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password[each.key].key}"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = "${each.key}-db"
|
||||
}
|
||||
port {
|
||||
port = try(each.value.database.port, 5432)
|
||||
target_port = try(each.value.database.port, 5432)
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "kubernetes_service_v1" "automatic_service_redis" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-redis-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = "${each.key}-redis"
|
||||
}
|
||||
port {
|
||||
port = 6379
|
||||
target_port = 6379
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "kubernetes_deployment_v1" "automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = coalesce(each.value.name, each.key)
|
||||
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = each.key
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = each.value.image
|
||||
name = coalesce(each.value.name, each.key)
|
||||
dynamic "port" {
|
||||
for_each = each.value.service_port != null ? each.value.service_port : []
|
||||
content {
|
||||
container_port = port.value
|
||||
# name = "${each.key}-${port.value}"
|
||||
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = each.value.pvc != null ? each.value.pvc : {}
|
||||
content {
|
||||
mount_path = volume_mount.value.mount_path
|
||||
name = "${volume_mount.value.name}-pvc"
|
||||
sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
|
||||
content {
|
||||
mount_path = "/backup"
|
||||
name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.secret_ref != null ? each.value.secret_ref : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
|
||||
#for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
|
||||
content {
|
||||
dynamic "config_map_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
command = each.value.command != null ? each.value.command : []
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "resources" {
|
||||
for_each = each.value.requirements != null ? [1] : []
|
||||
content {
|
||||
limits = {
|
||||
cpu = each.value.requirements.limits-cpu
|
||||
memory = each.value.requirements.limits-memory
|
||||
}
|
||||
requests = {
|
||||
cpu = each.value.requirements.requests-cpu
|
||||
memory = each.value.requirements.requests-memory
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
dynamic "security_context" {
|
||||
for_each = each.value.security_context == true ? [1] : []
|
||||
content {
|
||||
privileged = true
|
||||
#capabilities = {
|
||||
# add : ["NET_ADMIN", "NET_RAW"]
|
||||
#}
|
||||
}
|
||||
}
|
||||
dynamic "liveness_probe" {
|
||||
for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
||||
content {
|
||||
dynamic "tcp_socket" {
|
||||
for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
||||
content {
|
||||
port = each.value.liveness_tcp_socket
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "http_get" {
|
||||
for_each = each.value.liveness_http_get != null ? [""] : []
|
||||
content {
|
||||
port = each.value.liveness_http_get
|
||||
path = coalesce(each.value.liveness_http_get_path, "/")
|
||||
}
|
||||
}
|
||||
|
||||
initial_delay_seconds = 3
|
||||
period_seconds = 3
|
||||
}
|
||||
}
|
||||
}
|
||||
dynamic "dns_config" {
|
||||
for_each = each.value.dns_nameservers != null ? [1] : []
|
||||
content {
|
||||
nameservers = [each.value.dns_nameservers]
|
||||
}
|
||||
|
||||
}
|
||||
service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = each.value.pvc != null ? each.value.pvc : {}
|
||||
content {
|
||||
name = "${volume.value.name}-pvc"
|
||||
|
||||
dynamic "persistent_volume_claim" {
|
||||
for_each = volume.value.pvc ? [1] : []
|
||||
content {
|
||||
claim_name = "${volume.value.name}-pvc"
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "config_map" {
|
||||
for_each = volume.value.config_map ? [1] : []
|
||||
content {
|
||||
name = volume.value.name
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "host_path" {
|
||||
for_each = volume.value.host_path != null ? [1] : []
|
||||
content {
|
||||
path = volume.value.host_path
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "secret" {
|
||||
for_each = volume.value.secret ? [1] : []
|
||||
content {
|
||||
secret_name = volume.value.name
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
dynamic "volume" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
|
||||
content {
|
||||
name = "${each.key}-db-backup"
|
||||
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc]
|
||||
}
|
||||
|
||||
|
||||
|
||||
resource "kubernetes_deployment_v1" "database-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
|
||||
|
||||
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${coalesce(each.value.name, each.key)}-db"
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "${each.key}-db"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "${each.key}-db"
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = try(each.value.database.image, "docker.io/library/postgres:latest")
|
||||
name = "${coalesce(each.value.name, each.key)}-db"
|
||||
port {
|
||||
|
||||
container_port = 5432
|
||||
name = "database-port"
|
||||
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
|
||||
name = "${each.key}-db-pvc"
|
||||
}
|
||||
|
||||
dynamic "volume_mount" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
|
||||
content {
|
||||
mount_path = "/backup"
|
||||
name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
|
||||
command = try([each.value.database.command], [])
|
||||
args = each.value.database_args != null ? each.value.database_args : []
|
||||
|
||||
dynamic "env_from" {
|
||||
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
|
||||
content {
|
||||
dynamic "secret_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env_from.value
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
# optional = true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
||||
|
||||
volume {
|
||||
name = "${each.key}-db-pvc"
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-db-pvc"
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "volume" {
|
||||
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
|
||||
content {
|
||||
name = "${each.key}-db-backup"
|
||||
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_cron_job_v1" "database-backup" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${coalesce(each.value.namespace, each.key)}-db-backup"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
database = "true"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
failed_jobs_history_limit = 5
|
||||
schedule = "1 0 * * *"
|
||||
timezone = "Etc/UTC"
|
||||
successful_jobs_history_limit = 5
|
||||
job_template {
|
||||
metadata {}
|
||||
spec {
|
||||
backoff_limit = 4
|
||||
ttl_seconds_after_finished = 100
|
||||
template {
|
||||
metadata {}
|
||||
spec {
|
||||
container {
|
||||
name = "${coalesce(each.value.namespace, each.key)}-db-backup"
|
||||
image = try(var.database_backup_info[each.value.database.engine].image, var.database_backup_info.postgres.image)
|
||||
command = ["/bin/sh", "-c"]
|
||||
args = [try(var.database_backup_info[each.value.database.engine].command, var.database_backup_info.postgres.command)]
|
||||
env_from {
|
||||
secret_ref {
|
||||
name = "${each.key}-db-terraform"
|
||||
}
|
||||
}
|
||||
volume_mount {
|
||||
mount_path = "/backup"
|
||||
name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
volume {
|
||||
name = "${each.key}-db-backup"
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-db-backup"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_deployment_v1" "redis-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
|
||||
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${coalesce(each.value.name, each.key)}-redis"
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
redis = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "${each.key}-redis"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "${each.key}-redis"
|
||||
deployment_method = "Terraform"
|
||||
redis = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = try(each.value.redis.image, "docker.io/library/redis:7")
|
||||
name = "${coalesce(each.value.name, each.key)}-redis"
|
||||
port {
|
||||
|
||||
container_port = 6379
|
||||
name = "redis-port"
|
||||
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
mount_path = "/data"
|
||||
name = "${each.key}-redis-pvc"
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
# optional = true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
# resources {
|
||||
# limits = {
|
||||
# cpu = each.value.requirements.limits-cpu
|
||||
# memory = each.value.requirements.limits-memory
|
||||
# }
|
||||
# requests = {
|
||||
# cpu = each.value.requirements.requests-cpu
|
||||
# memory = each.value.requirements.requests-memory
|
||||
# }
|
||||
# }
|
||||
|
||||
# dynamic "liveness_probe" {
|
||||
# for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# dynamic "tcp_socket" {
|
||||
# for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_tcp_socket
|
||||
# }
|
||||
# }
|
||||
|
||||
|
||||
# dynamic "http_get" {
|
||||
# for_each = each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_http_get
|
||||
# path = coalesce(each.value.liveness_http_get_path, "/")
|
||||
# }
|
||||
# }
|
||||
|
||||
# initial_delay_seconds = 3
|
||||
# period_seconds = 3
|
||||
# }
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
volume {
|
||||
name = "${each.key}-redis-pvc"
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-redis-pvc"
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map_v1" "automatic-configmap" {
|
||||
metadata {
|
||||
name = "extra-sites-terraform"
|
||||
namespace = "reverse-proxy"
|
||||
annotations = {
|
||||
"reloader.stakater.com/match" : "true",
|
||||
}
|
||||
}
|
||||
|
||||
data = {
|
||||
for key, value in var.kubernetes :
|
||||
"${value.domain_name}.conf" => templatefile("nginx_config.tftpl", {
|
||||
name_site = value.domain_name
|
||||
name_service = "${key}-svc.${coalesce(value.namespace, value.connected_namespace, key)}.svc:${value.service_port.0}"
|
||||
}) if value.domain_name != null && value.enabled == true
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
data "bitwarden-secrets_secret" "configmap_import" {
|
||||
for_each = {
|
||||
for pair in flatten([
|
||||
for k, v in var.kubernetes : [
|
||||
for id in v.config_map_import : {
|
||||
map_key = k
|
||||
secret_id = id
|
||||
}
|
||||
] if v.config_map_import != null && v.enabled == true
|
||||
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
||||
}
|
||||
id = each.value
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map_v1" "configmap_import" {
|
||||
for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
|
||||
metadata {
|
||||
name = each.value.note
|
||||
namespace = split("__", each.value.key)[0]
|
||||
}
|
||||
data = yamldecode(each.value.value)
|
||||
}
|
||||
|
||||
|
||||
data "bitwarden-secrets_secret" "secret_import" {
|
||||
for_each = {
|
||||
for pair in flatten([
|
||||
for k, v in var.kubernetes : [
|
||||
for id in v.secret_import : {
|
||||
map_key = k
|
||||
secret_id = id
|
||||
}
|
||||
] if v.secret_import != null && v.enabled == true
|
||||
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
||||
}
|
||||
id = each.value
|
||||
}
|
||||
|
||||
resource "kubernetes_secret_v1" "secret_import" {
|
||||
for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
|
||||
metadata {
|
||||
name = each.value.note
|
||||
namespace = split("__", each.value.key)[0]
|
||||
}
|
||||
data = yamldecode(each.value.value)
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_secret_v1" "automatic-database-secret" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-db-terraform"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
}
|
||||
|
||||
data = {
|
||||
DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-db-mapped-terraform"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
}
|
||||
|
||||
data = {
|
||||
"${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
"${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
"${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
"${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__username"
|
||||
value = try(each.value.database.username, each.key)
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__password"
|
||||
/*resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db2_password" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null }
|
||||
key = "${each.key}__db__passwordSHUNT"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
length = 32
|
||||
special = true
|
||||
min_special = 5
|
||||
avoid_ambiguous = true
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value,key
|
||||
]
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__host"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__port"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.port, 5432)
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__name"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.name, each.key)
|
||||
output "database_password" {
|
||||
description = "Auto-generated password for the RDS database instance"
|
||||
#value = nonsensitive(bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password.*)
|
||||
#value = nonsensitive(values(bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password).*.value)
|
||||
value = [
|
||||
for secret in bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password : nonsensitive(secret.value)
|
||||
]
|
||||
sensitive = false
|
||||
}
|
||||
*/
|
||||
|
||||
#terraform import 'bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password["django-testing"]' "a3385f49-ba92-4478-b6f1-b4e100ff01fb"
|
||||
@@ -0,0 +1,142 @@
|
||||
resource "kubernetes_service_v1" "automatic_service_redis" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-redis-svc"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
selector = {
|
||||
app = "${each.key}-redis"
|
||||
}
|
||||
port {
|
||||
port = 6379
|
||||
target_port = 6379
|
||||
}
|
||||
}
|
||||
}
|
||||
resource "kubernetes_deployment_v1" "redis-automatic" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
|
||||
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${coalesce(each.value.name, each.key)}-redis"
|
||||
labels = {
|
||||
app = each.key
|
||||
deployment_method = "Terraform"
|
||||
redis = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
replicas = each.value.replicas
|
||||
|
||||
selector {
|
||||
match_labels = {
|
||||
app = "${each.key}-redis"
|
||||
}
|
||||
}
|
||||
|
||||
template {
|
||||
metadata {
|
||||
labels = {
|
||||
app = "${each.key}-redis"
|
||||
deployment_method = "Terraform"
|
||||
redis = "true"
|
||||
}
|
||||
}
|
||||
|
||||
spec {
|
||||
container {
|
||||
image = try(each.value.redis.image, "docker.io/library/redis:7")
|
||||
name = "${coalesce(each.value.name, each.key)}-redis"
|
||||
port {
|
||||
|
||||
container_port = 6379
|
||||
name = "redis-port"
|
||||
|
||||
}
|
||||
|
||||
volume_mount {
|
||||
mount_path = "/data"
|
||||
name = "${each.key}-redis-pvc"
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
dynamic "env" {
|
||||
for_each = each.value.environment != null ? each.value.environment : {}
|
||||
content {
|
||||
name = env.key
|
||||
value = env.value.value != null ? env.value.value : null
|
||||
dynamic "value_from" {
|
||||
for_each = env.value.value_from != null ? env.value.value_from : {}
|
||||
content {
|
||||
dynamic "secret_key_ref" {
|
||||
for_each = [1]
|
||||
content {
|
||||
name = env.value.value_from.secret_key_ref.name
|
||||
key = env.value.value_from.secret_key_ref.key
|
||||
# optional = true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
# resources {
|
||||
# limits = {
|
||||
# cpu = each.value.requirements.limits-cpu
|
||||
# memory = each.value.requirements.limits-memory
|
||||
# }
|
||||
# requests = {
|
||||
# cpu = each.value.requirements.requests-cpu
|
||||
# memory = each.value.requirements.requests-memory
|
||||
# }
|
||||
# }
|
||||
|
||||
# dynamic "liveness_probe" {
|
||||
# for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# dynamic "tcp_socket" {
|
||||
# for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_tcp_socket
|
||||
# }
|
||||
# }
|
||||
|
||||
|
||||
# dynamic "http_get" {
|
||||
# for_each = each.value.liveness_http_get != null ? [""] : []
|
||||
# content {
|
||||
# port = each.value.liveness_http_get
|
||||
# path = coalesce(each.value.liveness_http_get_path, "/")
|
||||
# }
|
||||
# }
|
||||
|
||||
# initial_delay_seconds = 3
|
||||
# period_seconds = 3
|
||||
# }
|
||||
# }
|
||||
}
|
||||
|
||||
|
||||
volume {
|
||||
name = "${each.key}-redis-pvc"
|
||||
persistent_volume_claim {
|
||||
claim_name = "${each.key}-redis-pvc"
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,158 @@
|
||||
|
||||
data "bitwarden-secrets_secret" "configmap_import" {
|
||||
for_each = {
|
||||
for pair in flatten([
|
||||
for k, v in var.kubernetes : [
|
||||
for id in v.config_map_import : {
|
||||
map_key = k
|
||||
secret_id = id
|
||||
}
|
||||
] if v.config_map_import != null && v.enabled == true
|
||||
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
||||
}
|
||||
id = each.value
|
||||
}
|
||||
|
||||
resource "kubernetes_config_map_v1" "configmap_import" {
|
||||
for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
|
||||
metadata {
|
||||
name = each.value.note
|
||||
namespace = split("__", each.value.key)[0]
|
||||
}
|
||||
data = yamldecode(each.value.value)
|
||||
}
|
||||
|
||||
|
||||
data "bitwarden-secrets_secret" "secret_import" {
|
||||
for_each = {
|
||||
for pair in flatten([
|
||||
for k, v in var.kubernetes : [
|
||||
for id in v.secret_import : {
|
||||
map_key = k
|
||||
secret_id = id
|
||||
}
|
||||
] if v.secret_import != null && v.enabled == true
|
||||
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
||||
}
|
||||
id = each.value
|
||||
}
|
||||
|
||||
resource "kubernetes_secret_v1" "secret_import" {
|
||||
for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
|
||||
metadata {
|
||||
name = each.value.note
|
||||
namespace = split("__", each.value.key)[0]
|
||||
}
|
||||
data = yamldecode(each.value.value)
|
||||
}
|
||||
|
||||
|
||||
resource "kubernetes_secret_v1" "automatic-database-secret" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-db-terraform"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
}
|
||||
|
||||
data = {
|
||||
DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
name = "${each.key}-db-mapped-terraform"
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
}
|
||||
|
||||
data = {
|
||||
"${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
||||
"${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
||||
"${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
||||
"${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__username"
|
||||
value = try(each.value.database.username, each.key)
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value,key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__password"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
length = 32
|
||||
special = true
|
||||
min_special = 5
|
||||
avoid_ambiguous = true
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value,key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__host"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value,key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__port"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.port, 5432)
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value,key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
key = "${each.key}__db__name"
|
||||
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
||||
value = try(each.value.database.name, each.key)
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
value,key
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,87 @@
|
||||
|
||||
|
||||
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc" {
|
||||
for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.key)
|
||||
name = "${each.value.name}-pvc"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
annotations = {
|
||||
fileType = try(each.value.annotations_fileType, "file")
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = each.value.storage_class_name
|
||||
resources {
|
||||
requests = {
|
||||
storage = each.value.pvc_size
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-database" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${each.key}-db-pvc"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = "nfs-storage-intelligent"
|
||||
resources {
|
||||
requests = {
|
||||
storage = "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_persistent_volume_claim_v1" "backup-pvc-database" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${each.key}-db-backup"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
annotations = {
|
||||
fileType = "Backup" }
|
||||
}
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = "nfs-storage-fastaccess"
|
||||
resources {
|
||||
requests = {
|
||||
storage = "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-redis" {
|
||||
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
|
||||
metadata {
|
||||
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
||||
name = "${each.key}-redis-pvc"
|
||||
labels = {
|
||||
deployment_method = "Terraform"
|
||||
}
|
||||
}
|
||||
spec {
|
||||
access_modes = ["ReadWriteMany"]
|
||||
storage_class_name = "nfs-storage-intelligent"
|
||||
resources {
|
||||
requests = {
|
||||
storage = "1Gi"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
kubernetes = {
|
||||
|
||||
gluetun = {
|
||||
enabled = false
|
||||
enabled = false
|
||||
dns_nameservers = "1.1.1.1"
|
||||
replicas = 01
|
||||
image = "qmcgaw/gluetun:latest"
|
||||
@@ -75,7 +75,7 @@ kubernetes = {
|
||||
|
||||
|
||||
django = {
|
||||
enabled =false
|
||||
enabled = false
|
||||
namespace = "django"
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest"
|
||||
service_port = [8000]
|
||||
@@ -173,7 +173,7 @@ kubernetes = {
|
||||
}
|
||||
|
||||
django-testing = {
|
||||
enabled =false
|
||||
enabled = false
|
||||
image = "gitea.tryton.geeraert.eu/pi-ux-ce/django-testing:latest"
|
||||
service_port = [8000]
|
||||
database = {}
|
||||
|
||||
Reference in New Issue
Block a user