pi-ux-ce/Terraform_kube
1
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: pi-ux-ce/Terraform_kube:5f88c306a3f97c0f7248a9dabfd902d48fc9bd6e
Branches Tags
pi-ux-ce/Terraform_kube:main pi-ux-ce/Terraform_kube:restructure pi-ux-ce/Terraform_kube:env_file_reformat pi-ux-ce/Terraform_kube:bitwarden pi-ux-ce/Terraform_kube:multipleport
..
compare: pi-ux-ce/Terraform_kube:env_file_reformat
Branches Tags
pi-ux-ce/Terraform_kube:restructure pi-ux-ce/Terraform_kube:env_file_reformat pi-ux-ce/Terraform_kube:main pi-ux-ce/Terraform_kube:bitwarden pi-ux-ce/Terraform_kube:multipleport
1 Commits
5f88c306a3 .. env_file_reformat
Author SHA1 Message Date
pierre.geeraert 5289cab76e using env files but overcomplicated 2026-10-08 11:31:43 +01:00
24 changed files with 1295 additions and 1013 deletions
Expand all files Collapse all files
.gitignore
-3
View File
@@ -41,6 +41,3 @@ terraform.tfstate*
.terraform.lock.hcl
.bw-provider-state
.claude
core/database.tf
+19 -7
View File
@@ -43,7 +43,7 @@ resource "kubernetes_deployment_v1" "database-automatic" {
volume_mount {
mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
name = "${each.key}-db-volume"
name = "${each.key}-db-pvc"
}
dynamic "volume_mount" {
@@ -57,6 +57,17 @@ resource "kubernetes_deployment_v1" "database-automatic" {
command = try([each.value.database.command], [])
args = each.value.database_args != null ? each.value.database_args : []
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env" {
for_each = each.value.environment != null ? each.value.environment : {}
@@ -71,6 +82,7 @@ resource "kubernetes_deployment_v1" "database-automatic" {
content {
name = env.value.value_from.secret_key_ref.name
key = env.value.value_from.secret_key_ref.key
# optional = true
}
}
}
@@ -84,9 +96,9 @@ resource "kubernetes_deployment_v1" "database-automatic" {
volume {
name = "${each.key}-db-volume"
host_path {
path = try(each.value.database.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), join("-", [each.key, "db"])]))
name = "${each.key}-db-pvc"
persistent_volume_claim {
claim_name = "${each.key}-db-pvc"
}
}
@@ -95,8 +107,8 @@ resource "kubernetes_deployment_v1" "database-automatic" {
content {
name = "${each.key}-db-backup"
host_path {
path = join("/", [var.storage_path.fast_access,"Backup", coalesce(each.value.namespace, each.value.connected_namespace, each.key), "${each.key}-db-backup"])
persistent_volume_claim {
claim_name = "${each.key}-db-backup"
}
}
}
@@ -114,7 +126,7 @@ resource "docker_container" "database-automatic" {
hostname = "${coalesce(each.value.name, each.key)}-db"
networks_advanced {
name = docker_network.terraform_network[0].name
name = docker_network.terraform_network.name
}
#no ports as they should be able to speak within the same network
core/deployment.tf
+43 -9
View File
@@ -46,7 +46,7 @@ resource "kubernetes_deployment_v1" "automatic" {
for_each = each.value.pvc != null ? each.value.pvc : {}
content {
mount_path = volume_mount.value.mount_path
name = "${volume_mount.key}-volume"
name = "${volume_mount.value.name}-pvc"
sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
}
}
@@ -71,6 +71,29 @@ resource "kubernetes_deployment_v1" "automatic" {
}
}
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
#for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env_from" {
for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
content {
@@ -166,27 +189,33 @@ resource "kubernetes_deployment_v1" "automatic" {
dynamic "volume" {
for_each = each.value.pvc != null ? each.value.pvc : {}
content {
name = "${volume.key}-volume"
name = "${volume.value.name}-pvc"
dynamic "persistent_volume_claim" {
for_each = volume.value.pvc ? [1] : []
content {
claim_name = "${volume.value.name}-pvc"
}
}
dynamic "config_map" {
for_each = volume.value.config_map ? [1] : []
content {
name = volume.key
name = volume.value.name
}
}
dynamic "host_path" {
for_each = volume.value.host_path != null || (!(volume.value.config_map) && !(volume.value.secret)) ? [1] : []
for_each = volume.value.host_path != null ? [1] : []
content {
path = coalesce(volume.value.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), volume.key]))
path = volume.value.host_path
}
}
dynamic "secret" {
for_each = volume.value.secret ? [1] : []
content {
secret_name = volume.key
secret_name = volume.value.name
}
}
@@ -197,8 +226,8 @@ resource "kubernetes_deployment_v1" "automatic" {
content {
name = "${each.key}-db-backup"
host_path {
path = join("/", [var.storage_path.fast_access,"Backup", coalesce(each.value.namespace, each.value.connected_namespace, each.key), "${each.key}-db-backup"])
persistent_volume_claim {
claim_name = "${each.key}-db-backup"
}
}
}
@@ -206,6 +235,11 @@ resource "kubernetes_deployment_v1" "automatic" {
}
}
}
depends_on = [
kubernetes_persistent_volume_claim_v1.automatic-pvc,
kubernetes_config_map_v1.env_file,
kubernetes_secret_v1.env_file,
]
}
core/env_files.tf
+49
View File
@@ -0,0 +1,49 @@
# Plain KEY=VALUE files (docker --env-file semantics, one pair per line, # comments)
# kept in external_manifests/, rendered into a ConfigMap or Secret at apply time.
# Deployments consume them through the existing config_map_ref / secret_ref fields.
variable "env_files" {
type = map(object({
namespace = string
path = string # relative to this module, e.g. ../external_manifests/bitwarden/global.env
secret = optional(bool, false)
enabled = optional(bool, true)
}))
default = {}
}
locals {
env_files = { for name, f in var.env_files : name => f if f.enabled }
# A duplicate key inside one file fails the plan on purpose.
env_data = {
for name, f in local.env_files : name => {
for line in split("\n", replace(file("${path.module}/${f.path}"), "\r", "")) :
split("=", line)[0] => substr(line, length(split("=", line)[0]) + 1, -1)
if can(regex("^[A-Za-z_][^=\\s]*=", line))
}
}
}
resource "kubernetes_config_map_v1" "env_file" {
for_each = { for name, f in local.env_files : name => f if !f.secret }
metadata {
name = each.key
namespace = each.value.namespace
labels = {
deployment_method = "Terraform"
}
}
data = local.env_data[each.key]
}
resource "kubernetes_secret_v1" "env_file" {
for_each = { for name, f in local.env_files : name => f if f.secret }
metadata {
name = each.key
namespace = each.value.namespace
labels = {
deployment_method = "Terraform"
}
}
data = local.env_data[each.key]
}
core/module.tf
+33 -23
View File
@@ -22,13 +22,15 @@ variable "kubernetes" {
docker = optional(bool)
image = string
pvc = optional(map(object({
name = optional(string)
name = string
pvc = optional(bool, false)
config_map = optional(bool, false)
secret = optional(bool, false)
local_path = optional(bool, false)
host_path = optional(string)
pvc_size = optional(string)
storage_class_name = optional(string, "nfs-storage-intelligent")
annotations_fileType = optional(string)
existing_pvc = optional(bool, false)
mount_path = string
sub_path = optional(string)
})))
@@ -73,19 +75,39 @@ variable "kubernetes" {
}
variable "shunt_docker" {
type = bool
default = true
locals {
pvc_list = flatten([
for key, value in var.kubernetes : [
for index, pvc in value.pvc : {
key = "${coalesce(value.namespace, value.connected_namespace, key)}/${pvc.name}"
index = index
pvc = pvc.pvc
name = pvc.name
pvc_size = pvc.pvc_size
mount_path = pvc.mount_path
storage_class_name = pvc.storage_class_name
annotations_fileType = pvc.annotations_fileType
existing_pvc = pvc.existing_pvc
sub_path = pvc.sub_path
namespace = coalesce(value.namespace, value.connected_namespace, key)
}] if value.enabled == true && value.pvc != null && value.docker != true
])
# group duplicates instead of throwing an error
pvc_map_grouped = {
for p in local.pvc_list :
p.key => p...
}
variable "storage_path" {
type = map(string)
default = {
main_storage = "/data/kubernetes",
fast_access = "/ssd"
}
# keep only one PVC per key (take the first)
pvc_map = {
for k, list in local.pvc_map_grouped :
k => list[0]
}
pvc_details = values(local.pvc_map)
}
locals {
env_details = flatten([
@@ -122,15 +144,3 @@ resource "kubernetes_manifest" "manifest" {
provider = kubernetes
}
resource "kubernetes_namespace_v1" "automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" }
metadata {
annotations = {
name = coalesce(each.value.namespace, each.key)
}
labels = {
deployment_method = "Terraform"
}
name = coalesce(each.value.namespace, each.key)
}
}
core/services.tf
+5 -3
View File
@@ -23,10 +23,14 @@ resource "kubernetes_service_v1" "automatic_service" {
port = port.value
target_port = port.value
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
node_port = each.value.service_type == "NodePort" ? port.value : 0
}
}
# port {
# port = each.value.service_port
# target_port = each.value.service_port
# }
type = each.value.service_type
@@ -84,8 +88,6 @@ resource "kubernetes_service_v1" "automatic_service_redis" {
resource "docker_network" "terraform_network" {
#avoiding this to create if the shunt_docker is on
count = var.shunt_docker ? 0 : 1
name = "deployment_network"
}
core/storage.tf
+86
View File
@@ -0,0 +1,86 @@
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc" {
for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true && value.docker != true }
metadata {
namespace = coalesce(each.value.namespace, each.key)
name = "${each.value.name}-pvc"
labels = {
deployment_method = "Terraform"
}
annotations = {
fileType = try(each.value.annotations_fileType, "file")
}
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = each.value.storage_class_name
resources {
requests = {
storage = each.value.pvc_size
}
}
}
}
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-database" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) && value.docker != true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${each.key}-db-pvc"
labels = {
deployment_method = "Terraform"
}
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = "nfs-storage-intelligent"
resources {
requests = {
storage = "1Gi"
}
}
}
}
resource "kubernetes_persistent_volume_claim_v1" "backup-pvc-database" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && value.docker != true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${each.key}-db-backup"
labels = {
deployment_method = "Terraform"
}
annotations = {
fileType = "Backup" }
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = "nfs-storage-fastaccess"
resources {
requests = {
storage = "1Gi"
}
}
}
}
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-redis" {
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true && value.docker != true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${each.key}-redis-pvc"
labels = {
deployment_method = "Terraform"
}
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = "nfs-storage-intelligent"
resources {
requests = {
storage = "1Gi"
}
}
}
}
core/testing_new_storage.yaml
-33
View File
@@ -1,33 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: nginx-deployment
labels:
app: nginx
spec:
replicas: 3
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: nginx:1.14.2
ports:
- containerPort: 80
volumeMounts:
- name: data
mountPath: /hello
volumes:
- name: data
hostPath:
path: /data/kubernetes/degoog/degoog-data-pvc
type: DirectoryOrCreate
core/variables.auto.tfvars
+151 -59
View File
@@ -1,10 +1,9 @@
kubernetes = {
reverse-proxy = {
#enabled = false
#docker = true
docker = true
image = "nginx:latest"
service_port = [80, 443]
service_type = "NodePort"
external_port = true
pvc = {
nginx-sites-terraform = {
@@ -38,9 +37,8 @@ kubernetes = {
gitea = {
#enabled = false
#docker = true
docker = true
image = "gitea/gitea:1.27.0"
service_port = [3000]
# no service_port: nginx reaches http://gitea:3000 over deployment_network
database = {
image = "postgres:17"
@@ -54,8 +52,7 @@ kubernetes = {
POSTGRES_DB = { value = "gitea-database" }
GITEA__database__DB_TYPE = { value = "postgres" }
#GITEA__database__HOST = { value = "gitea-db:5432" } # for docker
GITEA__database__HOST = { value = "gitea-db-svc:5432" } # for k8s
GITEA__database__HOST = { value = "gitea-db:5432" }
GITEA__database__USER = { value = "gitea-KY56Q" }
GITEA__database__PASSWD = { value = "Modulator-Yearning-Gills3" }
GITEA__database__NAME = { value = "gitea-database" }
@@ -76,9 +73,8 @@ kubernetes = {
gitea-runner = {
#enabled = false
#docker = true
docker = true
image = "gitea/act_runner:latest"
connected_namespace = "gitea"
environment = {
GITEA_INSTANCE_URL = { value = "https://gitea.geeraert.eu/" }
GITEA_RUNNER_REGISTRATION_TOKEN = { value = "rqi4mFW8LXoc5MhIrUD1rjzdmKVY8n9X14BP6sWd" }
@@ -102,24 +98,19 @@ kubernetes = {
echo = {
#enabled = false
#docker = true
docker = true
image = "ealen/echo-server:latest"
service_port = [4580]
external_port = true
service_type = "NodePort"
#command = ["-text=Hello authenticated world!"]
command = ["-text=Hello authenticated world!"]
pvc = {
echo-config = {
name = "echo-config"
host_path = "/tmp/data/kubernetes/echo/"
mount_path = "/app/configs"
}
echo-testing = {
mount_path = "/app/test"
}
}
environment = {
PORT = {
value = 4580
}
PAPERLESS_REDIS = {
value = "redis://paperless-redis-svc:6379"
}
@@ -132,26 +123,35 @@ kubernetes = {
bitwarden-admin = {
#enabled = false
enabled = false
namespace = "bitwarden"
replicas = 1
name = "bitwarden-admin"
image = "ghcr.io/bitwarden/admin:2026.1.0"
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/config.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/uid.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml"]
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
bitwarden-ca-certificates-pvc = {
bitwarden-ca-certificates = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/ca-certificates"
name = "bitwarden-ca-certificates"
}
bitwarden-core-pvc = {
bitwarden-core = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/core"
name = "bitwarden-core"
}
bitwarden-logs-pvc = {
bitwarden-logs = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/logs"
name = "bitwarden-logs"
sub_path = "admin"
}
@@ -161,25 +161,35 @@ kubernetes = {
}
bitwarden-api = {
#enabled = false
enabled = false
connected_namespace = "bitwarden"
replicas = 1
name = "bitwarden-api"
image = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_api:2026.1.0"
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
bitwarden-ca-certificates-pvc = {
bitwarden-ca-certificates = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/ca-certificates"
name = "bitwarden-ca-certificates"
}
bitwarden-core-pvc = {
bitwarden-core = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/core"
name = "bitwarden-core"
}
bitwarden-logs-pvc = {
bitwarden-logs = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/logs"
name = "bitwarden-logs"
sub_path = "api"
}
@@ -188,7 +198,7 @@ kubernetes = {
}
bitwarden-attachments = {
#enabled = false
enabled = false
connected_namespace = "bitwarden"
replicas = 1
name = "bitwarden-attachments"
@@ -198,29 +208,39 @@ kubernetes = {
environment = {}
pvc = {
bitwarden-core-pvc = {
bitwarden-core = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/core/attachments"
name = "bitwarden-core"
sub_path = "attachments"
}
}
}
bitwarden-events = {
#enabled = false
enabled = false
connected_namespace = "bitwarden"
replicas = 1
name = "bitwarden-events"
image = "ghcr.io/bitwarden/events:2026.1.0"
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
bitwarden-ca-certificates-pvc = {
bitwarden-ca-certificates = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/ca-certificates"
name = "bitwarden-ca-certificates"
}
bitwarden-logs-pvc = {
bitwarden-logs = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/logs"
name = "bitwarden-logs"
sub_path = "events"
}
@@ -228,7 +248,7 @@ kubernetes = {
}
bitwarden-icons = {
#enabled = false
enabled = false
connected_namespace = "bitwarden"
replicas = 1
name = "bitwarden-icons"
@@ -238,51 +258,72 @@ kubernetes = {
environment = {}
pvc = {
bitwarden-ca-certificates-pvc = {
bitwarden-ca-certificates = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/ca-certificates"
name = "bitwarden-ca-certificates"
}
bitwarden-logs-pvc = {
bitwarden-logs = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/logs"
name = "bitwarden-logs"
sub_path = "icons"
}
}
}
bitwarden-identity = {
#enabled = false
enabled = false
connected_namespace = "bitwarden"
replicas = 1
name = "bitwarden-identity"
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/identity-svc.svc.yaml"]
image = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_identity:2026.1.0"
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
bitwarden-identity-pvc = {
bitwarden-identity = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/identity"
name = "bitwarden-identity"
}
bitwarden-ca-certificates-pvc = {
bitwarden-ca-certificates = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/ca-certificates"
name = "bitwarden-ca-certificates"
}
bitwarden-core-pvc = {
bitwarden-core = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/core"
name = "bitwarden-core"
}
bitwarden-logs-pvc = {
bitwarden-logs = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/logs"
name = "bitwarden-logs"
sub_path = "identity"
}
}
}
bitwarden-mssql = {
#enabled = false
enabled = false
connected_namespace = "bitwarden"
replicas = 1
name = "bitwarden-mssql"
image = "ghcr.io/bitwarden/mssql:2026.1.0"
service_port = [1433, 5000]
config_map_ref = ["mssql.env", "uid.env", "mssql.override.env"]
config_map_ref = ["mssql.env", "uid.env"]
secret_ref = ["mssql.secret"]
environment = {}
database = {
shunt = "true"
@@ -293,18 +334,24 @@ kubernetes = {
}
pvc = {
bitwarden-mssql-pvc = {
bitwarden-mssql = {
pvc = true
pvc_size = "2Mi"
mount_path = "/var/opt/mssql/data"
name = "bitwarden-mssql"
sub_path = "data"
}
bitwarden-logs-pvc = {
bitwarden-logs = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/logs"
name = "bitwarden-logs"
sub_path = "mssql"
}
}
}
bitwarden-nginx = {
#enabled = false
enabled = false
connected_namespace = "bitwarden"
replicas = 1
name = "bitwarden-nginx"
@@ -314,71 +361,102 @@ kubernetes = {
environment = {}
pvc = {
bitwarden-nginx-pvc = {
bitwarden-nginx = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/nginx"
name = "bitwarden-nginx"
}
bitwarden-letsencrypt-pvc = {
bitwarden-letsencrypt = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/letsencrypt"
name = "bitwarden-letsencrypt"
}
bitwarden-ssl-pvc = {
bitwarden-ssl = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/ssl"
name = "bitwarden-ssl"
}
bitwarden-logs-pvc = {
bitwarden-logs = {
pvc = true
pvc_size = "2Mi"
mount_path = "/var/log/nginx"
name = "bitwarden-logs"
sub_path = "nginx"
}
}
}
bitwarden-notifications = {
#enabled = false
enabled = false
connected_namespace = "bitwarden"
replicas = 1
name = "bitwarden-notifications"
image = "ghcr.io/bitwarden/notifications:2026.1.0"
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
bitwarden-ca-certificates-pvc = {
bitwarden-ca-certificates = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/ca-certificates"
name = "bitwarden-ca-certificates-pvc"
name = "bitwarden-ca-certificates"
}
bitwarden-logs-pvc = {
bitwarden-logs = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/logs"
name = "bitwarden-logs"
sub_path = "notifications"
}
}
}
bitwarden-sso = {
#enabled = false
enabled = false
connected_namespace = "bitwarden"
replicas = 1
name = "bitwarden-sso"
image = "ghcr.io/bitwarden/sso:2026.1.0"
service_port = [5000]
config_map_ref = ["global.env", "uid.env", "global.override.env"]
secret_ref = ["global.override.secret"]
environment = {}
pvc = {
bitwarden-identity-pvc = {
bitwarden-identity = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/identity"
name = "bitwarden-identity"
}
bitwarden-core-pvc = {
bitwarden-core = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/core"
name = "bitwarden-core"
}
bitwarden-ca-certificates-pvc = {
bitwarden-ca-certificates = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/ca-certificates"
name = "bitwarden-ca-certificates"
}
bitwarden-logs-pvc = {
bitwarden-logs = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/logs"
name = "bitwarden-logs"
sub_path = "sso"
}
}
}
bitwarden-web = {
#enabled = false
enabled = false
connected_namespace = "bitwarden"
replicas = 1
name = "bitwarden-web"
@@ -388,10 +466,24 @@ kubernetes = {
environment = {}
pvc = {
bitwarden-web-pvc = {
bitwarden-web = {
pvc = true
pvc_size = "2Mi"
mount_path = "/etc/bitwarden/web"
name = "bitwarden-web"
}
}
}
}
# Config kept as plain env files in external_manifests/, rendered into ConfigMaps/Secrets by env_files.tf.
# Reference them from a service with config_map_ref / secret_ref (names below).
env_files = {
"global.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.env" }
"global.override.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.override.env" }
"uid.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/uid.env" }
"mssql.env" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/mssql.env" }
"global.override.secret" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/global.override.secret.env", secret = true }
"mssql.secret" = { namespace = "bitwarden", path = "../external_manifests/bitwarden/mssql.secret.env", secret = true }
}
external_manifests/bitwarden/global.env
+12
View File
@@ -0,0 +1,12 @@
ACCEPT_EULA=Y
ASPNETCORE_ENVIRONMENT=Production
globalSettings__baseServiceUri__vault=http://localhost
globalSettings__pushRelayBaseUri=https://push.bitwarden.com
globalSettings__selfHosted=true
globalSettings__baseServiceUri__internalNotifications=http://bitwarden-notifications-svc:5000
globalSettings__baseServiceUri__internalAdmin=http://bitwarden-admin-svc:5000
globalSettings__baseServiceUri__internalIdentity=http://bitwarden-identity-svc:5000
globalSettings__baseServiceUri__internalApi=http://bitwarden-api-svc:5000
globalSettings__baseServiceUri__internalVault=http://bitwarden-web-svc:5000
globalSettings__baseServiceUri__internalSso=http://bitwarden-sso-svc:5000
globalSettings__baseServiceUri__internalScim=http://bitwarden-self-host-scim:5000
external_manifests/bitwarden/global.override.env
+11
View File
@@ -0,0 +1,11 @@
ACCEPT_EULA=Y
adminSettings__admins=pierre@geeraert.eu
globalSettings__baseServiceUri__vault=http://bitwarden.tryton.geeraert.eu
globalSettings__disableUserRegistration=false
globalSettings__installation__id=c36aded0-b0f1-4252-920b-ac4c008fc920
globalSettings__mail__replyToEmail=no-reply@bitwarden.tryton.geeraert.eu
globalSettings__mail__smtp__host=smtp.gmail.com
globalSettings__mail__smtp__port=587
globalSettings__mail__smtp__ssl=false
globalSettings__mail__smtp__username=p3jh6qa2@gmail.com
globalSettings__yubico__clientId=REPLACE
external_manifests/bitwarden/global.override.secret.env
-9
View File
@@ -1,9 +0,0 @@
globalSettings__duo__aKey=p9jCHtnG4NZNZu4SThpVlCuOF1oePGhu53Wa4RJwuyeqRAWQ0aJN7GsKYrGbYIYO
globalSettings__hibpApiKey=REPLACE
globalSettings__identityServer__certificatePassword=test
globalSettings__installation__key=CtQE5U1tMJE4Dzk7N9DU
globalSettings__internalIdentityKey=I5TMbqmEjhw9uBNmFZ9rU6s1KN5xqAKXh7RSPfgyj2XQ4sjlP22SCupFn4IVhYX7
globalSettings__mail__smtp__password=vmxkiidikqwirpuh
globalSettings__oidcIdentityClientKey=w47pWOkPa6mrTkiPuKizitsiRTR6NH8ufI01u77zbZt3LUcKWJ4wchMn6ouiwN7V
globalSettings__sqlServer__connectionString=Data Source=tcp:bitwarden-mssql-svc,1433;Initial Catalog=bitwarden_vault;Persist Security Info=False;User ID=sa;Password=ChQKWDIW73eSHzX1UyvGDAv4pFw6DVKM;MultipleActiveResultSets=False;Connect Timeout=30;Encrypt=True;TrustServerCertificate=True
globalSettings__yubico__key=REPLACE
external_manifests/bitwarden/global.override.secret.env.example
+9
View File
@@ -0,0 +1,9 @@
globalSettings__duo__aKey=
globalSettings__hibpApiKey=
globalSettings__identityServer__certificatePassword=
globalSettings__installation__key=
globalSettings__internalIdentityKey=
globalSettings__mail__smtp__password=
globalSettings__oidcIdentityClientKey=
globalSettings__sqlServer__connectionString=
globalSettings__yubico__key=
external_manifests/bitwarden/mssql.env
+2
View File
@@ -0,0 +1,2 @@
ACCEPT_EULA=Y
MSSQL_PID=Express
external_manifests/bitwarden/mssql.secret.env
-1
View File
@@ -1 +0,0 @@
SA_PASSWORD=ChQKWDIW73eSHzX1UyvGDAv4pFw6DVKM
external_manifests/bitwarden/mssql.secret.env.example
+1
View File
@@ -0,0 +1 @@
SA_PASSWORD=
external_manifests/bitwarden/uid.env
+2
View File
@@ -0,0 +1,2 @@
LOCAL_GID=1001
LOCAL_UID=1001
infrastructure/database.tf
-195
View File
@@ -1,195 +0,0 @@
resource "kubernetes_service_v1" "automatic_service_database" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
metadata {
name = "${each.key}-db-svc"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = {
deployment_method = "Terraform"
#username = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password[each.key].key}"
}
}
spec {
selector = {
app = "${each.key}-db"
}
port {
port = try(each.value.database.port, 5432)
target_port = try(each.value.database.port, 5432)
}
}
}
resource "kubernetes_deployment_v1" "database-automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${coalesce(each.value.name, each.key)}-db"
labels = {
app = each.key
deployment_method = "Terraform"
database = "true"
}
}
spec {
replicas = each.value.replicas
selector {
match_labels = {
app = "${each.key}-db"
}
}
template {
metadata {
labels = {
app = "${each.key}-db"
deployment_method = "Terraform"
database = "true"
}
}
spec {
container {
image = try(each.value.database.image, "docker.io/library/postgres:latest")
name = "${coalesce(each.value.name, each.key)}-db"
port {
container_port = 5432
name = "database-port"
}
volume_mount {
mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
name = "${each.key}-db-volume"
}
dynamic "volume_mount" {
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
content {
mount_path = "/backup"
name = "${each.key}-db-backup"
}
}
command = try([each.value.database.command], [])
args = each.value.database_args != null ? each.value.database_args : []
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env" {
for_each = each.value.environment != null ? each.value.environment : {}
content {
name = env.key
value = env.value.value != null ? env.value.value : null
dynamic "value_from" {
for_each = env.value.value_from != null ? env.value.value_from : {}
content {
dynamic "secret_key_ref" {
for_each = [1]
content {
name = env.value.value_from.secret_key_ref.name
key = env.value.value_from.secret_key_ref.key
}
}
}
}
}
}
}
volume {
name = "${each.key}-db-volume"
host_path {
path = try(each.value.database.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), join("-", [each.key, "db"])]))
}
}
dynamic "volume" {
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
content {
name = "${each.key}-db-backup"
host_path {
path = join("/", [var.storage_path.fast_access,"Backup", coalesce(each.value.namespace, each.value.connected_namespace, each.key), "${each.key}-db-backup"])
}
}
}
}
}
}
}
resource "kubernetes_cron_job_v1" "database-backup" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
metadata {
name = "${coalesce(each.value.namespace, each.key)}-db-backup"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = {
app = each.key
deployment_method = "Terraform"
database = "true"
}
}
spec {
failed_jobs_history_limit = 5
schedule = "1 0 * * *"
timezone = "Etc/UTC"
successful_jobs_history_limit = 5
job_template {
metadata {}
spec {
backoff_limit = 4
ttl_seconds_after_finished = 100
template {
metadata {}
spec {
container {
name = "${coalesce(each.value.namespace, each.key)}-db-backup"
image = try(var.database_backup_info[each.value.database.engine].image, var.database_backup_info.postgres.image)
command = ["/bin/sh", "-c"]
args = [try(var.database_backup_info[each.value.database.engine].command, var.database_backup_info.postgres.command)]
env_from {
secret_ref {
name = "${each.key}-db-terraform"
}
}
volume_mount {
mount_path = "/backup"
name = "${each.key}-db-backup"
}
}
volume {
name = "${each.key}-db-backup"
persistent_volume_claim {
claim_name = "${each.key}-db-backup"
}
}
}
}
}
}
}
}
infrastructure/deployment.tf
-274
View File
@@ -1,274 +0,0 @@
resource "kubernetes_service_v1" "automatic_service" {
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
metadata {
name = "${each.key}-svc"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = {
deployment_method = "Terraform"
}
annotations = each.value.service_type == "LoadBalancer" ? {
"metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
} : {}
}
spec {
selector = {
app = each.key
}
dynamic "port" {
for_each = each.value.service_port != null ? each.value.service_port : []
content {
port = port.value
target_port = port.value
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
}
}
# port {
# port = each.value.service_port
# target_port = each.value.service_port
# }
type = each.value.service_type
}
depends_on = [resource.kubernetes_namespace_v1.automatic]
}
resource "kubernetes_deployment_v1" "automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = coalesce(each.value.name, each.key)
labels = {
app = each.key
deployment_method = "Terraform"
}
}
spec {
replicas = each.value.replicas
selector {
match_labels = {
app = each.key
}
}
template {
metadata {
labels = {
app = each.key
deployment_method = "Terraform"
}
}
spec {
container {
image = each.value.image
name = coalesce(each.value.name, each.key)
dynamic "port" {
for_each = each.value.service_port != null ? each.value.service_port : []
content {
container_port = port.value
# name = "${each.key}-${port.value}"
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
}
}
dynamic "volume_mount" {
for_each = each.value.pvc != null ? each.value.pvc : {}
content {
mount_path = volume_mount.value.mount_path
name = "${volume_mount.key}-volume"
sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
}
}
dynamic "volume_mount" {
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
content {
mount_path = "/backup"
name = "${each.key}-db-backup"
}
}
dynamic "env_from" {
for_each = each.value.secret_ref != null ? each.value.secret_ref : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
#for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env_from" {
for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
content {
dynamic "config_map_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
command = each.value.command != null ? each.value.command : []
dynamic "env" {
for_each = each.value.environment != null ? each.value.environment : {}
content {
name = env.key
value = env.value.value != null ? env.value.value : null
dynamic "value_from" {
for_each = env.value.value_from != null ? env.value.value_from : {}
content {
dynamic "secret_key_ref" {
for_each = [1]
content {
name = env.value.value_from.secret_key_ref.name
key = env.value.value_from.secret_key_ref.key
}
}
}
}
}
}
dynamic "resources" {
for_each = each.value.requirements != null ? [1] : []
content {
limits = {
cpu = each.value.requirements.limits-cpu
memory = each.value.requirements.limits-memory
}
requests = {
cpu = each.value.requirements.requests-cpu
memory = each.value.requirements.requests-memory
}
}
}
dynamic "security_context" {
for_each = each.value.security_context == true ? [1] : []
content {
privileged = true
#capabilities = {
# add : ["NET_ADMIN", "NET_RAW"]
#}
}
}
dynamic "liveness_probe" {
for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
content {
dynamic "tcp_socket" {
for_each = each.value.liveness_tcp_socket != null ? [""] : []
content {
port = each.value.liveness_tcp_socket
}
}
dynamic "http_get" {
for_each = each.value.liveness_http_get != null ? [""] : []
content {
port = each.value.liveness_http_get
path = coalesce(each.value.liveness_http_get_path, "/")
}
}
initial_delay_seconds = 3
period_seconds = 3
}
}
}
dynamic "dns_config" {
for_each = each.value.dns_nameservers != null ? [1] : []
content {
nameservers = [each.value.dns_nameservers]
}
}
service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null
dynamic "volume" {
for_each = each.value.pvc != null ? each.value.pvc : {}
content {
name = "${volume.key}-volume"
dynamic "config_map" {
for_each = volume.value.config_map ? [1] : []
content {
name = volume.key
}
}
dynamic "host_path" {
for_each = volume.value.host_path != null || (!(volume.value.config_map) && !(volume.value.secret)) ? [1] : []
content {
path = coalesce(volume.value.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), volume.key]))
}
}
dynamic "secret" {
for_each = volume.value.secret ? [1] : []
content {
secret_name = volume.key
}
}
}
}
dynamic "volume" {
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
content {
name = "${each.key}-db-backup"
host_path {
path = join("/", [var.storage_path.fast_access, "Backup", coalesce(each.value.namespace, each.value.connected_namespace, each.key), "${each.key}-db-backup"])
}
}
}
}
}
}
}
infrastructure/module.tf
+856 -33
View File
@@ -80,14 +80,6 @@ variable "kubernetes" {
service_account_name = optional(string)
environment_variables = optional(map(string), { name = "value" })
security_context = optional(bool, false)
import_database_secret = optional(object({
#putting them a non optional as the code doesn't allow optional value
host = string
name = string
password = string
port = string
username = string
}))
}))
}
@@ -114,14 +106,6 @@ variable "database_backup_info" {
}
}
variable "storage_path" {
type = map(string)
default = {
main_storage = "/data/kubernetes",
fast_access = "/ssd"
}
}
locals {
pvc_list = flatten([
for key, value in var.kubernetes : [
@@ -166,6 +150,7 @@ locals {
}
data "kubernetes_all_namespaces" "allns" {}
resource "kubernetes_namespace_v1" "automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" }
@@ -178,6 +163,7 @@ resource "kubernetes_namespace_v1" "automatic" {
}
name = coalesce(each.value.namespace, each.key)
}
depends_on = [data.kubernetes_all_namespaces.allns]
}
locals {
@@ -204,31 +190,868 @@ resource "kubernetes_manifest" "manifest" {
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc" {
for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true }
metadata {
namespace = coalesce(each.value.namespace, each.key)
name = "${each.value.name}-pvc"
labels = {
deployment_method = "Terraform"
}
annotations = {
fileType = try(each.value.annotations_fileType, "file")
}
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = each.value.storage_class_name
resources {
requests = {
storage = each.value.pvc_size
}
}
}
}
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-database" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${each.key}-db-pvc"
labels = {
deployment_method = "Terraform"
}
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = "nfs-storage-intelligent"
resources {
requests = {
storage = "1Gi"
}
}
}
}
resource "kubernetes_persistent_volume_claim_v1" "backup-pvc-database" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${each.key}-db-backup"
labels = {
deployment_method = "Terraform"
}
annotations = {
fileType = "Backup" }
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = "nfs-storage-fastaccess"
resources {
requests = {
storage = "1Gi"
}
}
}
}
resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-redis" {
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${each.key}-redis-pvc"
labels = {
deployment_method = "Terraform"
}
}
spec {
access_modes = ["ReadWriteMany"]
storage_class_name = "nfs-storage-intelligent"
resources {
requests = {
storage = "1Gi"
}
}
}
}
resource "kubernetes_service_v1" "automatic_service" {
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
metadata {
name = "${each.key}-svc"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = {
deployment_method = "Terraform"
}
annotations = each.value.service_type == "LoadBalancer" ? {
"metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
} : {}
}
spec {
selector = {
app = each.key
}
dynamic "port" {
for_each = each.value.service_port != null ? each.value.service_port : []
content {
port = port.value
target_port = port.value
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
}
}
# port {
# port = each.value.service_port
# target_port = each.value.service_port
# }
type = each.value.service_type
}
}
resource "kubernetes_service_v1" "automatic_service_database" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
metadata {
name = "${each.key}-db-svc"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = {
deployment_method = "Terraform"
#username = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password[each.key].key}"
}
}
spec {
selector = {
app = "${each.key}-db"
}
port {
port = try(each.value.database.port, 5432)
target_port = try(each.value.database.port, 5432)
}
}
}
resource "kubernetes_service_v1" "automatic_service_redis" {
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
metadata {
name = "${each.key}-redis-svc"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = {
deployment_method = "Terraform"
}
}
spec {
selector = {
app = "${each.key}-redis"
}
port {
port = 6379
target_port = 6379
}
}
}
resource "kubernetes_deployment_v1" "automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = coalesce(each.value.name, each.key)
labels = {
app = each.key
deployment_method = "Terraform"
}
}
spec {
replicas = each.value.replicas
selector {
match_labels = {
app = each.key
}
}
template {
metadata {
labels = {
app = each.key
deployment_method = "Terraform"
}
}
spec {
container {
image = each.value.image
name = coalesce(each.value.name, each.key)
dynamic "port" {
for_each = each.value.service_port != null ? each.value.service_port : []
content {
container_port = port.value
# name = "${each.key}-${port.value}"
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
}
}
dynamic "volume_mount" {
for_each = each.value.pvc != null ? each.value.pvc : {}
content {
mount_path = volume_mount.value.mount_path
name = "${volume_mount.value.name}-pvc"
sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
}
}
dynamic "volume_mount" {
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
content {
mount_path = "/backup"
name = "${each.key}-db-backup"
}
}
dynamic "env_from" {
for_each = each.value.secret_ref != null ? each.value.secret_ref : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
#for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env_from" {
for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
content {
dynamic "config_map_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
command = each.value.command != null ? each.value.command : []
dynamic "env" {
for_each = each.value.environment != null ? each.value.environment : {}
content {
name = env.key
value = env.value.value != null ? env.value.value : null
dynamic "value_from" {
for_each = env.value.value_from != null ? env.value.value_from : {}
content {
dynamic "secret_key_ref" {
for_each = [1]
content {
name = env.value.value_from.secret_key_ref.name
key = env.value.value_from.secret_key_ref.key
}
}
}
}
}
}
dynamic "resources" {
for_each = each.value.requirements != null ? [1] : []
content {
limits = {
cpu = each.value.requirements.limits-cpu
memory = each.value.requirements.limits-memory
}
requests = {
cpu = each.value.requirements.requests-cpu
memory = each.value.requirements.requests-memory
}
}
}
dynamic "security_context" {
for_each = each.value.security_context == true ? [1] : []
content {
privileged = true
#capabilities = {
# add : ["NET_ADMIN", "NET_RAW"]
#}
}
}
dynamic "liveness_probe" {
for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
content {
dynamic "tcp_socket" {
for_each = each.value.liveness_tcp_socket != null ? [""] : []
content {
port = each.value.liveness_tcp_socket
}
}
dynamic "http_get" {
for_each = each.value.liveness_http_get != null ? [""] : []
content {
port = each.value.liveness_http_get
path = coalesce(each.value.liveness_http_get_path, "/")
}
}
initial_delay_seconds = 3
period_seconds = 3
}
}
}
dynamic "dns_config" {
for_each = each.value.dns_nameservers != null ? [1] : []
content {
nameservers = [each.value.dns_nameservers]
}
}
service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null
dynamic "volume" {
for_each = each.value.pvc != null ? each.value.pvc : {}
content {
name = "${volume.value.name}-pvc"
dynamic "persistent_volume_claim" {
for_each = volume.value.pvc ? [1] : []
content {
claim_name = "${volume.value.name}-pvc"
}
}
dynamic "config_map" {
for_each = volume.value.config_map ? [1] : []
content {
name = volume.value.name
}
}
dynamic "host_path" {
for_each = volume.value.host_path != null ? [1] : []
content {
path = volume.value.host_path
}
}
dynamic "secret" {
for_each = volume.value.secret ? [1] : []
content {
secret_name = volume.value.name
}
}
}
}
dynamic "volume" {
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
content {
name = "${each.key}-db-backup"
persistent_volume_claim {
claim_name = "${each.key}-db-backup"
}
}
}
}
}
}
depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc]
}
resource "kubernetes_deployment_v1" "database-automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${coalesce(each.value.name, each.key)}-db"
labels = {
app = each.key
deployment_method = "Terraform"
database = "true"
}
}
spec {
replicas = each.value.replicas
selector {
match_labels = {
app = "${each.key}-db"
}
}
template {
metadata {
labels = {
app = "${each.key}-db"
deployment_method = "Terraform"
database = "true"
}
}
spec {
container {
image = try(each.value.database.image, "docker.io/library/postgres:latest")
name = "${coalesce(each.value.name, each.key)}-db"
port {
container_port = 5432
name = "database-port"
}
volume_mount {
mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
name = "${each.key}-db-pvc"
}
dynamic "volume_mount" {
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
content {
mount_path = "/backup"
name = "${each.key}-db-backup"
}
}
command = try([each.value.database.command], [])
args = each.value.database_args != null ? each.value.database_args : []
dynamic "env_from" {
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
content {
dynamic "secret_ref" {
for_each = [1]
content {
name = env_from.value
}
}
}
}
dynamic "env" {
for_each = each.value.environment != null ? each.value.environment : {}
content {
name = env.key
value = env.value.value != null ? env.value.value : null
dynamic "value_from" {
for_each = env.value.value_from != null ? env.value.value_from : {}
content {
dynamic "secret_key_ref" {
for_each = [1]
content {
name = env.value.value_from.secret_key_ref.name
key = env.value.value_from.secret_key_ref.key
# optional = true
}
}
}
}
}
}
}
volume {
name = "${each.key}-db-pvc"
persistent_volume_claim {
claim_name = "${each.key}-db-pvc"
}
}
dynamic "volume" {
for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
content {
name = "${each.key}-db-backup"
persistent_volume_claim {
claim_name = "${each.key}-db-backup"
}
}
}
}
}
}
}
resource "kubernetes_cron_job_v1" "database-backup" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
metadata {
name = "${coalesce(each.value.namespace, each.key)}-db-backup"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = {
app = each.key
deployment_method = "Terraform"
database = "true"
}
}
spec {
failed_jobs_history_limit = 5
schedule = "1 0 * * *"
timezone = "Etc/UTC"
successful_jobs_history_limit = 5
job_template {
metadata {}
spec {
backoff_limit = 4
ttl_seconds_after_finished = 100
template {
metadata {}
spec {
container {
name = "${coalesce(each.value.namespace, each.key)}-db-backup"
image = try(var.database_backup_info[each.value.database.engine].image, var.database_backup_info.postgres.image)
command = ["/bin/sh", "-c"]
args = [try(var.database_backup_info[each.value.database.engine].command, var.database_backup_info.postgres.command)]
env_from {
secret_ref {
name = "${each.key}-db-terraform"
}
}
volume_mount {
mount_path = "/backup"
name = "${each.key}-db-backup"
}
}
volume {
name = "${each.key}-db-backup"
persistent_volume_claim {
claim_name = "${each.key}-db-backup"
}
}
}
}
}
}
}
}
resource "kubernetes_deployment_v1" "redis-automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${coalesce(each.value.name, each.key)}-redis"
labels = {
app = each.key
deployment_method = "Terraform"
redis = "true"
}
}
spec {
replicas = each.value.replicas
selector {
match_labels = {
app = "${each.key}-redis"
}
}
template {
metadata {
labels = {
app = "${each.key}-redis"
deployment_method = "Terraform"
redis = "true"
}
}
spec {
container {
image = try(each.value.redis.image, "docker.io/library/redis:7")
name = "${coalesce(each.value.name, each.key)}-redis"
port {
container_port = 6379
name = "redis-port"
}
volume_mount {
mount_path = "/data"
name = "${each.key}-redis-pvc"
}
dynamic "env" {
for_each = each.value.environment != null ? each.value.environment : {}
content {
name = env.key
value = env.value.value != null ? env.value.value : null
dynamic "value_from" {
for_each = env.value.value_from != null ? env.value.value_from : {}
content {
dynamic "secret_key_ref" {
for_each = [1]
content {
name = env.value.value_from.secret_key_ref.name
key = env.value.value_from.secret_key_ref.key
# optional = true
}
}
}
}
}
}
# resource "kubernetes_config_map_v1" "automatic-configmap" {
# metadata {
# name = "extra-sites-terraform"
# namespace = "reverse-proxy"
# annotations = {
# "reloader.stakater.com/match" : "true",
# resources {
# limits = {
# cpu = each.value.requirements.limits-cpu
# memory = each.value.requirements.limits-memory
# }
# requests = {
# cpu = each.value.requirements.requests-cpu
# memory = each.value.requirements.requests-memory
# }
# }
#
# data = {
# for key, value in var.kubernetes :
# "${value.domain_name}.conf" => templatefile("nginx_config.tftpl", {
# name_site = value.domain_name
# name_service = "${key}-svc.${coalesce(value.namespace, value.connected_namespace, key)}.svc:${value.service_port.0}"
# }) if value.domain_name != null && value.enabled == true
# dynamic "liveness_probe" {
# for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
# content {
# dynamic "tcp_socket" {
# for_each = each.value.liveness_tcp_socket != null ? [""] : []
# content {
# port = each.value.liveness_tcp_socket
# }
#
# }
# dynamic "http_get" {
# for_each = each.value.liveness_http_get != null ? [""] : []
# content {
# port = each.value.liveness_http_get
# path = coalesce(each.value.liveness_http_get_path, "/")
# }
# }
# initial_delay_seconds = 3
# period_seconds = 3
# }
# }
}
volume {
name = "${each.key}-redis-pvc"
persistent_volume_claim {
claim_name = "${each.key}-redis-pvc"
}
}
}
}
}
}
resource "kubernetes_config_map_v1" "automatic-configmap" {
metadata {
name = "extra-sites-terraform"
namespace = "reverse-proxy"
annotations = {
"reloader.stakater.com/match" : "true",
}
}
data = {
for key, value in var.kubernetes :
"${value.domain_name}.conf" => templatefile("nginx_config.tftpl", {
name_site = value.domain_name
name_service = "${key}-svc.${coalesce(value.namespace, value.connected_namespace, key)}.svc:${value.service_port.0}"
}) if value.domain_name != null && value.enabled == true
}
}
data "bitwarden-secrets_secret" "configmap_import" {
for_each = {
for pair in flatten([
for k, v in var.kubernetes : [
for id in v.config_map_import : {
map_key = k
secret_id = id
}
] if v.config_map_import != null && v.enabled == true
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
}
id = each.value
}
resource "kubernetes_config_map_v1" "configmap_import" {
for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
metadata {
name = each.value.note
namespace = split("__", each.value.key)[0]
}
data = yamldecode(each.value.value)
}
data "bitwarden-secrets_secret" "secret_import" {
for_each = {
for pair in flatten([
for k, v in var.kubernetes : [
for id in v.secret_import : {
map_key = k
secret_id = id
}
] if v.secret_import != null && v.enabled == true
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
}
id = each.value
}
resource "kubernetes_secret_v1" "secret_import" {
for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
metadata {
name = each.value.note
namespace = split("__", each.value.key)[0]
}
data = yamldecode(each.value.value)
}
resource "kubernetes_secret_v1" "automatic-database-secret" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
metadata {
name = "${each.key}-db-terraform"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
}
data = {
DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
}
}
resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
metadata {
name = "${each.key}-db-mapped-terraform"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
}
data = {
"${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
"${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
"${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
"${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
}
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__username"
value = try(each.value.database.username, each.key)
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__password"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
length = 32
special = true
min_special = 5
avoid_ambiguous = true
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__host"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__port"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
value = try(each.value.database.port, 5432)
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__name"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
value = try(each.value.database.name, each.key)
}
infrastructure/redis.tf
-142
View File
@@ -1,142 +0,0 @@
resource "kubernetes_service_v1" "automatic_service_redis" {
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
metadata {
name = "${each.key}-redis-svc"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
labels = {
deployment_method = "Terraform"
}
}
spec {
selector = {
app = "${each.key}-redis"
}
port {
port = 6379
target_port = 6379
}
}
}
resource "kubernetes_deployment_v1" "redis-automatic" {
for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
metadata {
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
name = "${coalesce(each.value.name, each.key)}-redis"
labels = {
app = each.key
deployment_method = "Terraform"
redis = "true"
}
}
spec {
replicas = each.value.replicas
selector {
match_labels = {
app = "${each.key}-redis"
}
}
template {
metadata {
labels = {
app = "${each.key}-redis"
deployment_method = "Terraform"
redis = "true"
}
}
spec {
container {
image = try(each.value.redis.image, "docker.io/library/redis:7")
name = "${coalesce(each.value.name, each.key)}-redis"
port {
container_port = 6379
name = "redis-port"
}
volume_mount {
mount_path = "/data"
name = "${each.key}-redis-volume"
}
dynamic "env" {
for_each = each.value.environment != null ? each.value.environment : {}
content {
name = env.key
value = env.value.value != null ? env.value.value : null
dynamic "value_from" {
for_each = env.value.value_from != null ? env.value.value_from : {}
content {
dynamic "secret_key_ref" {
for_each = [1]
content {
name = env.value.value_from.secret_key_ref.name
key = env.value.value_from.secret_key_ref.key
# optional = true
}
}
}
}
}
}
# resources {
# limits = {
# cpu = each.value.requirements.limits-cpu
# memory = each.value.requirements.limits-memory
# }
# requests = {
# cpu = each.value.requirements.requests-cpu
# memory = each.value.requirements.requests-memory
# }
# }
# dynamic "liveness_probe" {
# for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
# content {
# dynamic "tcp_socket" {
# for_each = each.value.liveness_tcp_socket != null ? [""] : []
# content {
# port = each.value.liveness_tcp_socket
# }
# }
# dynamic "http_get" {
# for_each = each.value.liveness_http_get != null ? [""] : []
# content {
# port = each.value.liveness_http_get
# path = coalesce(each.value.liveness_http_get_path, "/")
# }
# }
# initial_delay_seconds = 3
# period_seconds = 3
# }
# }
}
volume {
name = "${each.key}-redis-volume"
host_path {
path = try(each.value.redis.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), join("-", [each.key, "redis"])]))
}
}
}
}
}
}
infrastructure/secrets.tf
-198
View File
@@ -1,198 +0,0 @@
data "bitwarden-secrets_secret" "configmap_import" {
for_each = {
for pair in flatten([
for k, v in var.kubernetes : [
for id in v.config_map_import : {
map_key = k
secret_id = id
}
] if v.config_map_import != null && v.enabled == true
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
}
id = each.value
}
resource "kubernetes_config_map_v1" "configmap_import" {
for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
metadata {
name = each.value.note
namespace = split("__", each.value.key)[0]
}
data = yamldecode(each.value.value)
}
data "bitwarden-secrets_secret" "secret_import" {
for_each = {
for pair in flatten([
for k, v in var.kubernetes : [
for id in v.secret_import : {
map_key = k
secret_id = id
}
] if v.secret_import != null && v.enabled == true
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
}
id = each.value
}
resource "kubernetes_secret_v1" "secret_import" {
for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
metadata {
name = each.value.note
namespace = split("__", each.value.key)[0]
}
data = yamldecode(each.value.value)
}
resource "kubernetes_secret_v1" "automatic-database-secret" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
metadata {
name = "${each.key}-db-terraform"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
}
data = {
DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
}
}
resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
metadata {
name = "${each.key}-db-mapped-terraform"
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
}
data = {
"${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
"${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
"${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
"${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
}
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__username"
value = try(each.value.database.username, each.key)
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
lifecycle {
ignore_changes = [
value, key
]
}
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__password"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
length = 32
special = true
min_special = 5
avoid_ambiguous = true
lifecycle {
ignore_changes = [
value, key
]
}
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__host"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
lifecycle {
ignore_changes = [
value, key
]
}
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__port"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
value = try(each.value.database.port, 5432)
lifecycle {
ignore_changes = [
value, key
]
}
}
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
key = "${each.key}__db__name"
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
value = try(each.value.database.name, each.key)
lifecycle {
ignore_changes = [
value, key
]
}
}
# 1. Move the loop logic to a local variable first
locals {
database_secrets_to_import = {
for key, value in var.kubernetes : key => value
if value.database != null && value.enabled == true && try(value.import_database_secret, "") != ""
}
}
# 2. Reference the local map in your import block using each.key and each.value
import {
for_each = local.database_secrets_to_import
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key]
id = each.value.import_database_secret.host
}
import {
for_each = local.database_secrets_to_import
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key]
id = each.value.import_database_secret.name
}
import {
for_each = local.database_secrets_to_import
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key]
id = each.value.import_database_secret.password
}
import {
for_each = local.database_secrets_to_import
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key]
id = each.value.import_database_secret.port
}
import {
for_each = local.database_secrets_to_import
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key]
id = each.value.import_database_secret.username
}
infrastructure/storage.tf
View File
infrastructure/variables.auto.tfvars
+4 -12
View File
@@ -75,7 +75,7 @@ kubernetes = {
django = {
enabled = false
#enabled =false
namespace = "django"
image = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest"
service_port = [8000]
@@ -184,7 +184,7 @@ kubernetes = {
requests-cpu = "10m"
requests-memory = "300Mi"
}
extra_manifest = ["../external_manifests/django/kubeconfig-testing.secret.yaml"]
extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/django/kubeconfig-testing.secret.yaml"]
secret_ref = ["django-bitwarden-credentials"]
secret_import = ["68dce7aa-8e5f-4483-9083-b474016e34fc"]
environment = {
@@ -205,21 +205,13 @@ kubernetes = {
value = "cloudmanager" }
}
pvc = {
kubeconfig = {
kubeconfig-secret = {
secret = true
name = "kubeconfig"
mount_path = "/kubeconfig"
}
}
import_database_secret = {
host = "097f10de-63ee-405c-b46a-b41001781e07"
name = "20530a85-e446-4d79-8985-b41001781e07"
password = "a3385f49-ba92-4478-b6f1-b4e100ff01fb"
port = "e15e00eb-db1e-47ea-ab0e-b41001781e09"
username = "3c67d310-7113-45b7-8f3f-b41001781e08"
}
}