From e53822618272878abe2e265c52b66000a346445c Mon Sep 17 00:00:00 2001 From: "pierre.geeraert" Date: Mon, 12 Oct 2026 16:48:01 +0100 Subject: [PATCH] infra restructure and adding lifecycle to the secret --- infrastructure/database.tf | 196 ++++++ infrastructure/deployment.tf | 280 +++++++++ infrastructure/module.tf | 882 ++------------------------- infrastructure/redis.tf | 142 +++++ infrastructure/secrets.tf | 158 +++++ infrastructure/storage.tf | 87 +++ infrastructure/variables.auto.tfvars | 6 +- 7 files changed, 903 insertions(+), 848 deletions(-) create mode 100644 infrastructure/database.tf create mode 100644 infrastructure/deployment.tf create mode 100644 infrastructure/redis.tf create mode 100644 infrastructure/secrets.tf create mode 100644 infrastructure/storage.tf diff --git a/infrastructure/database.tf b/infrastructure/database.tf new file mode 100644 index 0000000..b9aa20c --- /dev/null +++ b/infrastructure/database.tf @@ -0,0 +1,196 @@ +resource "kubernetes_service_v1" "automatic_service_database" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) } + metadata { + name = "${each.key}-db-svc" + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + labels = { + deployment_method = "Terraform" + #username = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password[each.key].key}" + } + } + spec { + selector = { + app = "${each.key}-db" + } + port { + port = try(each.value.database.port, 5432) + target_port = try(each.value.database.port, 5432) + } + + } + + +} + +resource "kubernetes_deployment_v1" "database-automatic" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) } + + + metadata { + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + name = "${coalesce(each.value.name, each.key)}-db" + labels = { + app = each.key + deployment_method = "Terraform" + database = "true" + } + } + + spec { + replicas = each.value.replicas + + selector { + match_labels = { + app = "${each.key}-db" + } + } + + template { + metadata { + labels = { + app = "${each.key}-db" + deployment_method = "Terraform" + database = "true" + } + } + + spec { + container { + image = try(each.value.database.image, "docker.io/library/postgres:latest") + name = "${coalesce(each.value.name, each.key)}-db" + port { + + container_port = 5432 + name = "database-port" + + } + + volume_mount { + mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/") + name = "${each.key}-db-pvc" + } + + dynamic "volume_mount" { + for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : [] + content { + mount_path = "/backup" + name = "${each.key}-db-backup" + } + } + + command = try([each.value.database.command], []) + args = each.value.database_args != null ? each.value.database_args : [] + + dynamic "env_from" { + for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : [] + content { + dynamic "secret_ref" { + for_each = [1] + content { + name = env_from.value + } + } + } + } + + dynamic "env" { + for_each = each.value.environment != null ? each.value.environment : {} + content { + name = env.key + value = env.value.value != null ? env.value.value : null + dynamic "value_from" { + for_each = env.value.value_from != null ? env.value.value_from : {} + content { + dynamic "secret_key_ref" { + for_each = [1] + content { + name = env.value.value_from.secret_key_ref.name + key = env.value.value_from.secret_key_ref.key + # optional = true + } + } + } + } + + } + } + + + } + + + volume { + name = "${each.key}-db-pvc" + persistent_volume_claim { + claim_name = "${each.key}-db-pvc" + } + } + + dynamic "volume" { + for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : [] + content { + name = "${each.key}-db-backup" + + persistent_volume_claim { + claim_name = "${each.key}-db-backup" + } + } + } + + } + } + } +} + + +resource "kubernetes_cron_job_v1" "database-backup" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + metadata { + name = "${coalesce(each.value.namespace, each.key)}-db-backup" + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + labels = { + app = each.key + deployment_method = "Terraform" + database = "true" + } + } + spec { + failed_jobs_history_limit = 5 + schedule = "1 0 * * *" + timezone = "Etc/UTC" + successful_jobs_history_limit = 5 + job_template { + metadata {} + spec { + backoff_limit = 4 + ttl_seconds_after_finished = 100 + template { + metadata {} + spec { + container { + name = "${coalesce(each.value.namespace, each.key)}-db-backup" + image = try(var.database_backup_info[each.value.database.engine].image, var.database_backup_info.postgres.image) + command = ["/bin/sh", "-c"] + args = [try(var.database_backup_info[each.value.database.engine].command, var.database_backup_info.postgres.command)] + env_from { + secret_ref { + name = "${each.key}-db-terraform" + } + } + volume_mount { + mount_path = "/backup" + name = "${each.key}-db-backup" + } + } + volume { + name = "${each.key}-db-backup" + persistent_volume_claim { + claim_name = "${each.key}-db-backup" + } + } + } + } + } + } + } +} diff --git a/infrastructure/deployment.tf b/infrastructure/deployment.tf new file mode 100644 index 0000000..5577dfe --- /dev/null +++ b/infrastructure/deployment.tf @@ -0,0 +1,280 @@ +resource "kubernetes_service_v1" "automatic_service" { + for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true } + metadata { + name = "${each.key}-svc" + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + labels = { + deployment_method = "Terraform" + } + annotations = each.value.service_type == "LoadBalancer" ? { + "metallb.universe.tf/ip-allocated-from-pool" = "first-pool" + } : {} + + + + } + spec { + selector = { + app = each.key + } + dynamic "port" { + for_each = each.value.service_port != null ? each.value.service_port : [] + content { + port = port.value + target_port = port.value + name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1") + + } + } + + # port { + # port = each.value.service_port + # target_port = each.value.service_port + # } + type = each.value.service_type + + + } + + +} + + +resource "kubernetes_deployment_v1" "automatic" { + for_each = { for key, value in var.kubernetes : key => value if value.enabled == true } + metadata { + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + name = coalesce(each.value.name, each.key) + + labels = { + app = each.key + deployment_method = "Terraform" + } + } + + spec { + replicas = each.value.replicas + + selector { + match_labels = { + app = each.key + } + } + + template { + metadata { + labels = { + app = each.key + deployment_method = "Terraform" + } + } + + spec { + container { + image = each.value.image + name = coalesce(each.value.name, each.key) + dynamic "port" { + for_each = each.value.service_port != null ? each.value.service_port : [] + content { + container_port = port.value + # name = "${each.key}-${port.value}" + name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1") + } + } + + + dynamic "volume_mount" { + for_each = each.value.pvc != null ? each.value.pvc : {} + content { + mount_path = volume_mount.value.mount_path + name = "${volume_mount.value.name}-pvc" + sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : "" + } + } + + dynamic "volume_mount" { + for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : [] + content { + mount_path = "/backup" + name = "${each.key}-db-backup" + } + } + + dynamic "env_from" { + for_each = each.value.secret_ref != null ? each.value.secret_ref : [] + content { + dynamic "secret_ref" { + for_each = [1] + content { + name = env_from.value + } + } + + } + } + dynamic "env_from" { + for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : [] + #for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : [] + content { + dynamic "secret_ref" { + for_each = [1] + content { + name = env_from.value + } + } + } + } + dynamic "env_from" { + for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : [] + content { + dynamic "secret_ref" { + for_each = [1] + content { + name = env_from.value + } + } + } + } + dynamic "env_from" { + for_each = each.value.config_map_ref != null ? each.value.config_map_ref : [] + content { + dynamic "config_map_ref" { + for_each = [1] + content { + name = env_from.value + } + } + } + } + + command = each.value.command != null ? each.value.command : [] + + + dynamic "env" { + for_each = each.value.environment != null ? each.value.environment : {} + content { + name = env.key + value = env.value.value != null ? env.value.value : null + dynamic "value_from" { + for_each = env.value.value_from != null ? env.value.value_from : {} + content { + dynamic "secret_key_ref" { + for_each = [1] + content { + name = env.value.value_from.secret_key_ref.name + key = env.value.value_from.secret_key_ref.key + } + } + } + } + + } + } + dynamic "resources" { + for_each = each.value.requirements != null ? [1] : [] + content { + limits = { + cpu = each.value.requirements.limits-cpu + memory = each.value.requirements.limits-memory + } + requests = { + cpu = each.value.requirements.requests-cpu + memory = each.value.requirements.requests-memory + } + + } + } + + + dynamic "security_context" { + for_each = each.value.security_context == true ? [1] : [] + content { + privileged = true + #capabilities = { + # add : ["NET_ADMIN", "NET_RAW"] + #} + } + } + dynamic "liveness_probe" { + for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : [] + content { + dynamic "tcp_socket" { + for_each = each.value.liveness_tcp_socket != null ? [""] : [] + content { + port = each.value.liveness_tcp_socket + } + } + + dynamic "http_get" { + for_each = each.value.liveness_http_get != null ? [""] : [] + content { + port = each.value.liveness_http_get + path = coalesce(each.value.liveness_http_get_path, "/") + } + } + + initial_delay_seconds = 3 + period_seconds = 3 + } + } + } + dynamic "dns_config" { + for_each = each.value.dns_nameservers != null ? [1] : [] + content { + nameservers = [each.value.dns_nameservers] + } + + } + service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null + + dynamic "volume" { + for_each = each.value.pvc != null ? each.value.pvc : {} + content { + name = "${volume.value.name}-pvc" + + dynamic "persistent_volume_claim" { + for_each = volume.value.pvc ? [1] : [] + content { + claim_name = "${volume.value.name}-pvc" + } + } + + dynamic "config_map" { + for_each = volume.value.config_map ? [1] : [] + content { + name = volume.value.name + } + } + + dynamic "host_path" { + for_each = volume.value.host_path != null ? [1] : [] + content { + path = volume.value.host_path + } + } + + dynamic "secret" { + for_each = volume.value.secret ? [1] : [] + content { + secret_name = volume.value.name + } + } + + } + } + dynamic "volume" { + for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : [] + content { + name = "${each.key}-db-backup" + + persistent_volume_claim { + claim_name = "${each.key}-db-backup" + } + } + } + + } + } + } + depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc] +} diff --git a/infrastructure/module.tf b/infrastructure/module.tf index 88a8be8..3e8c13b 100644 --- a/infrastructure/module.tf +++ b/infrastructure/module.tf @@ -150,7 +150,6 @@ locals { } -data "kubernetes_all_namespaces" "allns" {} resource "kubernetes_namespace_v1" "automatic" { for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" } @@ -163,7 +162,6 @@ resource "kubernetes_namespace_v1" "automatic" { } name = coalesce(each.value.namespace, each.key) } - depends_on = [data.kubernetes_all_namespaces.allns] } locals { @@ -190,868 +188,62 @@ resource "kubernetes_manifest" "manifest" { -resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc" { - for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true } - metadata { - namespace = coalesce(each.value.namespace, each.key) - name = "${each.value.name}-pvc" - labels = { - deployment_method = "Terraform" - } - annotations = { - fileType = try(each.value.annotations_fileType, "file") - } - } - spec { - access_modes = ["ReadWriteMany"] - storage_class_name = each.value.storage_class_name - resources { - requests = { - storage = each.value.pvc_size - } - } - } -} -resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-database" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) } - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = "${each.key}-db-pvc" - labels = { - deployment_method = "Terraform" - } - } - spec { - access_modes = ["ReadWriteMany"] - storage_class_name = "nfs-storage-intelligent" - resources { - requests = { - storage = "1Gi" - } - } - } -} -resource "kubernetes_persistent_volume_claim_v1" "backup-pvc-database" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = "${each.key}-db-backup" - labels = { - deployment_method = "Terraform" - } - annotations = { - fileType = "Backup" } - } - spec { - access_modes = ["ReadWriteMany"] - storage_class_name = "nfs-storage-fastaccess" - resources { - requests = { - storage = "1Gi" - } - } - } -} -resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-redis" { - for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = "${each.key}-redis-pvc" - labels = { - deployment_method = "Terraform" - } - } - spec { - access_modes = ["ReadWriteMany"] - storage_class_name = "nfs-storage-intelligent" - resources { - requests = { - storage = "1Gi" - } - } - } -} -resource "kubernetes_service_v1" "automatic_service" { - for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true } - metadata { - name = "${each.key}-svc" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - labels = { - deployment_method = "Terraform" - } - annotations = each.value.service_type == "LoadBalancer" ? { - "metallb.universe.tf/ip-allocated-from-pool" = "first-pool" - } : {} - } - spec { - selector = { - app = each.key - } - dynamic "port" { - for_each = each.value.service_port != null ? each.value.service_port : [] - content { - port = port.value - target_port = port.value - name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1") - } - } - # port { - # port = each.value.service_port - # target_port = each.value.service_port - # } - type = each.value.service_type +# resource "kubernetes_config_map_v1" "automatic-configmap" { +# metadata { +# name = "extra-sites-terraform" +# namespace = "reverse-proxy" +# annotations = { +# "reloader.stakater.com/match" : "true", +# } +# } +# +# data = { +# for key, value in var.kubernetes : +# "${value.domain_name}.conf" => templatefile("nginx_config.tftpl", { +# name_site = value.domain_name +# name_service = "${key}-svc.${coalesce(value.namespace, value.connected_namespace, key)}.svc:${value.service_port.0}" +# }) if value.domain_name != null && value.enabled == true +# } +# +# } - } - - -} - -resource "kubernetes_service_v1" "automatic_service_database" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) } - metadata { - name = "${each.key}-db-svc" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - labels = { - deployment_method = "Terraform" - #username = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password[each.key].key}" - } - } - spec { - selector = { - app = "${each.key}-db" - } - port { - port = try(each.value.database.port, 5432) - target_port = try(each.value.database.port, 5432) - } - - } - - -} - - - -resource "kubernetes_service_v1" "automatic_service_redis" { - for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } - metadata { - name = "${each.key}-redis-svc" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - labels = { - deployment_method = "Terraform" - } - } - spec { - selector = { - app = "${each.key}-redis" - } - port { - port = 6379 - target_port = 6379 - } - } -} - - - -resource "kubernetes_deployment_v1" "automatic" { - for_each = { for key, value in var.kubernetes : key => value if value.enabled == true } - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = coalesce(each.value.name, each.key) - - labels = { - app = each.key - deployment_method = "Terraform" - } - } - - spec { - replicas = each.value.replicas - - selector { - match_labels = { - app = each.key - } - } - - template { - metadata { - labels = { - app = each.key - deployment_method = "Terraform" - } - } - - spec { - container { - image = each.value.image - name = coalesce(each.value.name, each.key) - dynamic "port" { - for_each = each.value.service_port != null ? each.value.service_port : [] - content { - container_port = port.value - # name = "${each.key}-${port.value}" - name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1") - } - } - - - dynamic "volume_mount" { - for_each = each.value.pvc != null ? each.value.pvc : {} - content { - mount_path = volume_mount.value.mount_path - name = "${volume_mount.value.name}-pvc" - sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : "" - } - } - - dynamic "volume_mount" { - for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : [] - content { - mount_path = "/backup" - name = "${each.key}-db-backup" - } - } - - dynamic "env_from" { - for_each = each.value.secret_ref != null ? each.value.secret_ref : [] - content { - dynamic "secret_ref" { - for_each = [1] - content { - name = env_from.value - } - } - - } - } - dynamic "env_from" { - for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : [] - #for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : [] - content { - dynamic "secret_ref" { - for_each = [1] - content { - name = env_from.value - } - } - } - } - dynamic "env_from" { - for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : [] - content { - dynamic "secret_ref" { - for_each = [1] - content { - name = env_from.value - } - } - } - } - dynamic "env_from" { - for_each = each.value.config_map_ref != null ? each.value.config_map_ref : [] - content { - dynamic "config_map_ref" { - for_each = [1] - content { - name = env_from.value - } - } - } - } - - command = each.value.command != null ? each.value.command : [] - - - dynamic "env" { - for_each = each.value.environment != null ? each.value.environment : {} - content { - name = env.key - value = env.value.value != null ? env.value.value : null - dynamic "value_from" { - for_each = env.value.value_from != null ? env.value.value_from : {} - content { - dynamic "secret_key_ref" { - for_each = [1] - content { - name = env.value.value_from.secret_key_ref.name - key = env.value.value_from.secret_key_ref.key - } - } - } - } - - } - } - dynamic "resources" { - for_each = each.value.requirements != null ? [1] : [] - content { - limits = { - cpu = each.value.requirements.limits-cpu - memory = each.value.requirements.limits-memory - } - requests = { - cpu = each.value.requirements.requests-cpu - memory = each.value.requirements.requests-memory - } - - } - } - - - dynamic "security_context" { - for_each = each.value.security_context == true ? [1] : [] - content { - privileged = true - #capabilities = { - # add : ["NET_ADMIN", "NET_RAW"] - #} - } - } - dynamic "liveness_probe" { - for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : [] - content { - dynamic "tcp_socket" { - for_each = each.value.liveness_tcp_socket != null ? [""] : [] - content { - port = each.value.liveness_tcp_socket - } - } - - dynamic "http_get" { - for_each = each.value.liveness_http_get != null ? [""] : [] - content { - port = each.value.liveness_http_get - path = coalesce(each.value.liveness_http_get_path, "/") - } - } - - initial_delay_seconds = 3 - period_seconds = 3 - } - } - } - dynamic "dns_config" { - for_each = each.value.dns_nameservers != null ? [1] : [] - content { - nameservers = [each.value.dns_nameservers] - } - - } - service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null - - dynamic "volume" { - for_each = each.value.pvc != null ? each.value.pvc : {} - content { - name = "${volume.value.name}-pvc" - - dynamic "persistent_volume_claim" { - for_each = volume.value.pvc ? [1] : [] - content { - claim_name = "${volume.value.name}-pvc" - } - } - - dynamic "config_map" { - for_each = volume.value.config_map ? [1] : [] - content { - name = volume.value.name - } - } - - dynamic "host_path" { - for_each = volume.value.host_path != null ? [1] : [] - content { - path = volume.value.host_path - } - } - - dynamic "secret" { - for_each = volume.value.secret ? [1] : [] - content { - secret_name = volume.value.name - } - } - - } - } - dynamic "volume" { - for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : [] - content { - name = "${each.key}-db-backup" - - persistent_volume_claim { - claim_name = "${each.key}-db-backup" - } - } - } - - } - } - } - depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc] -} - - - -resource "kubernetes_deployment_v1" "database-automatic" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) } - - - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = "${coalesce(each.value.name, each.key)}-db" - labels = { - app = each.key - deployment_method = "Terraform" - database = "true" - } - } - - spec { - replicas = each.value.replicas - - selector { - match_labels = { - app = "${each.key}-db" - } - } - - template { - metadata { - labels = { - app = "${each.key}-db" - deployment_method = "Terraform" - database = "true" - } - } - - spec { - container { - image = try(each.value.database.image, "docker.io/library/postgres:latest") - name = "${coalesce(each.value.name, each.key)}-db" - port { - - container_port = 5432 - name = "database-port" - - } - - volume_mount { - mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/") - name = "${each.key}-db-pvc" - } - - dynamic "volume_mount" { - for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : [] - content { - mount_path = "/backup" - name = "${each.key}-db-backup" - } - } - - command = try([each.value.database.command], []) - args = each.value.database_args != null ? each.value.database_args : [] - - dynamic "env_from" { - for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : [] - content { - dynamic "secret_ref" { - for_each = [1] - content { - name = env_from.value - } - } - } - } - - dynamic "env" { - for_each = each.value.environment != null ? each.value.environment : {} - content { - name = env.key - value = env.value.value != null ? env.value.value : null - dynamic "value_from" { - for_each = env.value.value_from != null ? env.value.value_from : {} - content { - dynamic "secret_key_ref" { - for_each = [1] - content { - name = env.value.value_from.secret_key_ref.name - key = env.value.value_from.secret_key_ref.key - # optional = true - } - } - } - } - - } - } - - - } - - - volume { - name = "${each.key}-db-pvc" - persistent_volume_claim { - claim_name = "${each.key}-db-pvc" - } - } - - dynamic "volume" { - for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : [] - content { - name = "${each.key}-db-backup" - - persistent_volume_claim { - claim_name = "${each.key}-db-backup" - } - } - } - - } - } - } -} - - -resource "kubernetes_cron_job_v1" "database-backup" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - metadata { - name = "${coalesce(each.value.namespace, each.key)}-db-backup" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - labels = { - app = each.key - deployment_method = "Terraform" - database = "true" - } - } - spec { - failed_jobs_history_limit = 5 - schedule = "1 0 * * *" - timezone = "Etc/UTC" - successful_jobs_history_limit = 5 - job_template { - metadata {} - spec { - backoff_limit = 4 - ttl_seconds_after_finished = 100 - template { - metadata {} - spec { - container { - name = "${coalesce(each.value.namespace, each.key)}-db-backup" - image = try(var.database_backup_info[each.value.database.engine].image, var.database_backup_info.postgres.image) - command = ["/bin/sh", "-c"] - args = [try(var.database_backup_info[each.value.database.engine].command, var.database_backup_info.postgres.command)] - env_from { - secret_ref { - name = "${each.key}-db-terraform" - } - } - volume_mount { - mount_path = "/backup" - name = "${each.key}-db-backup" - } - } - volume { - name = "${each.key}-db-backup" - persistent_volume_claim { - claim_name = "${each.key}-db-backup" - } - } - } - } - } - } - } -} - - -resource "kubernetes_deployment_v1" "redis-automatic" { - for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } - - - metadata { - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - name = "${coalesce(each.value.name, each.key)}-redis" - labels = { - app = each.key - deployment_method = "Terraform" - redis = "true" - } - } - - spec { - replicas = each.value.replicas - - selector { - match_labels = { - app = "${each.key}-redis" - } - } - - template { - metadata { - labels = { - app = "${each.key}-redis" - deployment_method = "Terraform" - redis = "true" - } - } - - spec { - container { - image = try(each.value.redis.image, "docker.io/library/redis:7") - name = "${coalesce(each.value.name, each.key)}-redis" - port { - - container_port = 6379 - name = "redis-port" - - } - - volume_mount { - mount_path = "/data" - name = "${each.key}-redis-pvc" - } - - - - - - dynamic "env" { - for_each = each.value.environment != null ? each.value.environment : {} - content { - name = env.key - value = env.value.value != null ? env.value.value : null - dynamic "value_from" { - for_each = env.value.value_from != null ? env.value.value_from : {} - content { - dynamic "secret_key_ref" { - for_each = [1] - content { - name = env.value.value_from.secret_key_ref.name - key = env.value.value_from.secret_key_ref.key - # optional = true - } - } - } - } - - } - } - - - # resources { - # limits = { - # cpu = each.value.requirements.limits-cpu - # memory = each.value.requirements.limits-memory - # } - # requests = { - # cpu = each.value.requirements.requests-cpu - # memory = each.value.requirements.requests-memory - # } - # } - - # dynamic "liveness_probe" { - # for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : [] - # content { - # dynamic "tcp_socket" { - # for_each = each.value.liveness_tcp_socket != null ? [""] : [] - # content { - # port = each.value.liveness_tcp_socket - # } - # } - - - # dynamic "http_get" { - # for_each = each.value.liveness_http_get != null ? [""] : [] - # content { - # port = each.value.liveness_http_get - # path = coalesce(each.value.liveness_http_get_path, "/") - # } - # } - - # initial_delay_seconds = 3 - # period_seconds = 3 - # } - # } - } - - - volume { - name = "${each.key}-redis-pvc" - persistent_volume_claim { - claim_name = "${each.key}-redis-pvc" - } - } - - } - } - } -} - -resource "kubernetes_config_map_v1" "automatic-configmap" { - metadata { - name = "extra-sites-terraform" - namespace = "reverse-proxy" - annotations = { - "reloader.stakater.com/match" : "true", - } - } - - data = { - for key, value in var.kubernetes : - "${value.domain_name}.conf" => templatefile("nginx_config.tftpl", { - name_site = value.domain_name - name_service = "${key}-svc.${coalesce(value.namespace, value.connected_namespace, key)}.svc:${value.service_port.0}" - }) if value.domain_name != null && value.enabled == true - } - -} - -data "bitwarden-secrets_secret" "configmap_import" { - for_each = { - for pair in flatten([ - for k, v in var.kubernetes : [ - for id in v.config_map_import : { - map_key = k - secret_id = id - } - ] if v.config_map_import != null && v.enabled == true - ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id - } - id = each.value -} - -resource "kubernetes_config_map_v1" "configmap_import" { - for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value } - metadata { - name = each.value.note - namespace = split("__", each.value.key)[0] - } - data = yamldecode(each.value.value) -} - - -data "bitwarden-secrets_secret" "secret_import" { - for_each = { - for pair in flatten([ - for k, v in var.kubernetes : [ - for id in v.secret_import : { - map_key = k - secret_id = id - } - ] if v.secret_import != null && v.enabled == true - ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id - } - id = each.value -} - -resource "kubernetes_secret_v1" "secret_import" { - for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value } - metadata { - name = each.value.note - namespace = split("__", each.value.key)[0] - } - data = yamldecode(each.value.value) -} - - -resource "kubernetes_secret_v1" "automatic-database-secret" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - metadata { - name = "${each.key}-db-terraform" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - } - - data = { - DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" - PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" - POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" - DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" - POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" - MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" - PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" - DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - } - -} - -resource "kubernetes_secret_v1" "automatic-database-mapped-secret" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - metadata { - name = "${each.key}-db-mapped-terraform" - namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) - } - - data = { - "${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" - "${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" - "${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" - "${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" - } -} - - -resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - key = "${each.key}__db__username" - value = try(each.value.database.username, each.key) - project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" -} - -resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - key = "${each.key}__db__password" +/*resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db2_password" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null } + key = "${each.key}__db__passwordSHUNT" project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" length = 32 special = true min_special = 5 avoid_ambiguous = true + lifecycle { + ignore_changes = [ + value,key + ] + } + } -resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - key = "${each.key}__db__host" - project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" - value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc") -} -resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - key = "${each.key}__db__port" - project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" - value = try(each.value.database.port, 5432) -} - -resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" { - for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } - key = "${each.key}__db__name" - project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" - value = try(each.value.database.name, each.key) +output "database_password" { + description = "Auto-generated password for the RDS database instance" + #value = nonsensitive(bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password.*) + #value = nonsensitive(values(bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password).*.value) + value = [ + for secret in bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password : nonsensitive(secret.value) + ] + sensitive = false } +*/ +#terraform import 'bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password["django-testing"]' "a3385f49-ba92-4478-b6f1-b4e100ff01fb" \ No newline at end of file diff --git a/infrastructure/redis.tf b/infrastructure/redis.tf new file mode 100644 index 0000000..9719ba1 --- /dev/null +++ b/infrastructure/redis.tf @@ -0,0 +1,142 @@ +resource "kubernetes_service_v1" "automatic_service_redis" { + for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } + metadata { + name = "${each.key}-redis-svc" + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + labels = { + deployment_method = "Terraform" + } + } + spec { + selector = { + app = "${each.key}-redis" + } + port { + port = 6379 + target_port = 6379 + } + } +} +resource "kubernetes_deployment_v1" "redis-automatic" { + for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } + + + metadata { + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + name = "${coalesce(each.value.name, each.key)}-redis" + labels = { + app = each.key + deployment_method = "Terraform" + redis = "true" + } + } + + spec { + replicas = each.value.replicas + + selector { + match_labels = { + app = "${each.key}-redis" + } + } + + template { + metadata { + labels = { + app = "${each.key}-redis" + deployment_method = "Terraform" + redis = "true" + } + } + + spec { + container { + image = try(each.value.redis.image, "docker.io/library/redis:7") + name = "${coalesce(each.value.name, each.key)}-redis" + port { + + container_port = 6379 + name = "redis-port" + + } + + volume_mount { + mount_path = "/data" + name = "${each.key}-redis-pvc" + } + + + + + + dynamic "env" { + for_each = each.value.environment != null ? each.value.environment : {} + content { + name = env.key + value = env.value.value != null ? env.value.value : null + dynamic "value_from" { + for_each = env.value.value_from != null ? env.value.value_from : {} + content { + dynamic "secret_key_ref" { + for_each = [1] + content { + name = env.value.value_from.secret_key_ref.name + key = env.value.value_from.secret_key_ref.key + # optional = true + } + } + } + } + + } + } + + + # resources { + # limits = { + # cpu = each.value.requirements.limits-cpu + # memory = each.value.requirements.limits-memory + # } + # requests = { + # cpu = each.value.requirements.requests-cpu + # memory = each.value.requirements.requests-memory + # } + # } + + # dynamic "liveness_probe" { + # for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : [] + # content { + # dynamic "tcp_socket" { + # for_each = each.value.liveness_tcp_socket != null ? [""] : [] + # content { + # port = each.value.liveness_tcp_socket + # } + # } + + + # dynamic "http_get" { + # for_each = each.value.liveness_http_get != null ? [""] : [] + # content { + # port = each.value.liveness_http_get + # path = coalesce(each.value.liveness_http_get_path, "/") + # } + # } + + # initial_delay_seconds = 3 + # period_seconds = 3 + # } + # } + } + + + volume { + name = "${each.key}-redis-pvc" + persistent_volume_claim { + claim_name = "${each.key}-redis-pvc" + } + } + + } + } + } +} diff --git a/infrastructure/secrets.tf b/infrastructure/secrets.tf new file mode 100644 index 0000000..00a1d08 --- /dev/null +++ b/infrastructure/secrets.tf @@ -0,0 +1,158 @@ + +data "bitwarden-secrets_secret" "configmap_import" { + for_each = { + for pair in flatten([ + for k, v in var.kubernetes : [ + for id in v.config_map_import : { + map_key = k + secret_id = id + } + ] if v.config_map_import != null && v.enabled == true + ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id + } + id = each.value +} + +resource "kubernetes_config_map_v1" "configmap_import" { + for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value } + metadata { + name = each.value.note + namespace = split("__", each.value.key)[0] + } + data = yamldecode(each.value.value) +} + + +data "bitwarden-secrets_secret" "secret_import" { + for_each = { + for pair in flatten([ + for k, v in var.kubernetes : [ + for id in v.secret_import : { + map_key = k + secret_id = id + } + ] if v.secret_import != null && v.enabled == true + ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id + } + id = each.value +} + +resource "kubernetes_secret_v1" "secret_import" { + for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value } + metadata { + name = each.value.note + namespace = split("__", each.value.key)[0] + } + data = yamldecode(each.value.value) +} + + +resource "kubernetes_secret_v1" "automatic-database-secret" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + metadata { + name = "${each.key}-db-terraform" + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + } + + data = { + DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" + PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" + POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" + DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" + POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" + MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" + PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" + DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + } + +} + +resource "kubernetes_secret_v1" "automatic-database-mapped-secret" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + metadata { + name = "${each.key}-db-mapped-terraform" + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + } + + data = { + "${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}" + "${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}" + "${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}" + "${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}" + } +} + + +resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + key = "${each.key}__db__username" + value = try(each.value.database.username, each.key) + project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" + lifecycle { + ignore_changes = [ + value,key + ] + } +} + +resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + key = "${each.key}__db__password" + project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" + length = 32 + special = true + min_special = 5 + avoid_ambiguous = true + lifecycle { + ignore_changes = [ + value,key + ] + } +} + +resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + key = "${each.key}__db__host" + project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" + value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc") + lifecycle { + ignore_changes = [ + value,key + ] + } +} + +resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + key = "${each.key}__db__port" + project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" + value = try(each.value.database.port, 5432) + lifecycle { + ignore_changes = [ + value,key + ] + } +} + +resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + key = "${each.key}__db__name" + project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd" + value = try(each.value.database.name, each.key) + lifecycle { + ignore_changes = [ + value,key + ] + } +} + diff --git a/infrastructure/storage.tf b/infrastructure/storage.tf new file mode 100644 index 0000000..174194b --- /dev/null +++ b/infrastructure/storage.tf @@ -0,0 +1,87 @@ + + +resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc" { + for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true } + metadata { + namespace = coalesce(each.value.namespace, each.key) + name = "${each.value.name}-pvc" + labels = { + deployment_method = "Terraform" + } + annotations = { + fileType = try(each.value.annotations_fileType, "file") + } + + } + + spec { + access_modes = ["ReadWriteMany"] + storage_class_name = each.value.storage_class_name + resources { + requests = { + storage = each.value.pvc_size + } + } + } +} +resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-database" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) } + metadata { + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + name = "${each.key}-db-pvc" + labels = { + deployment_method = "Terraform" + } + } + spec { + access_modes = ["ReadWriteMany"] + storage_class_name = "nfs-storage-intelligent" + resources { + requests = { + storage = "1Gi" + } + } + } +} + +resource "kubernetes_persistent_volume_claim_v1" "backup-pvc-database" { + for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } + metadata { + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + name = "${each.key}-db-backup" + labels = { + deployment_method = "Terraform" + } + annotations = { + fileType = "Backup" } + } + spec { + access_modes = ["ReadWriteMany"] + storage_class_name = "nfs-storage-fastaccess" + resources { + requests = { + storage = "1Gi" + } + } + } +} + +resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-redis" { + for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true } + metadata { + namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key) + name = "${each.key}-redis-pvc" + labels = { + deployment_method = "Terraform" + } + } + spec { + access_modes = ["ReadWriteMany"] + storage_class_name = "nfs-storage-intelligent" + resources { + requests = { + storage = "1Gi" + } + } + } +} diff --git a/infrastructure/variables.auto.tfvars b/infrastructure/variables.auto.tfvars index d3b1520..0a1c596 100644 --- a/infrastructure/variables.auto.tfvars +++ b/infrastructure/variables.auto.tfvars @@ -1,7 +1,7 @@ kubernetes = { gluetun = { - enabled = false + enabled = false dns_nameservers = "1.1.1.1" replicas = 01 image = "qmcgaw/gluetun:latest" @@ -75,7 +75,7 @@ kubernetes = { django = { - enabled =false + enabled = false namespace = "django" image = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest" service_port = [8000] @@ -173,7 +173,7 @@ kubernetes = { } django-testing = { - enabled =false + enabled = false image = "gitea.tryton.geeraert.eu/pi-ux-ce/django-testing:latest" service_port = [8000] database = {}