can create new entries with random password not erased after new excution

external_manifests/django/django-db.secret.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-data:
-  DB_DATABASE_NAME: ZGphbmdv
-  DB_HOST: ZGphbmdvLWRiLXN2Yw==
-  DB_PASSWORD: U3VmZnJhZ2UtTW9uZXliYWdzLUlsbHVzaW9uNw==
-  DB_USERNAME: ZGphbmdvX3VzZXJuYW1l
-kind: Secret
-metadata:
-  creationTimestamp: null
-  name: django-db-credentials
-  namespace: django

external_manifests/immich/immich-db.secret.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-data:
-  DB_DATABASE_NAME: aW1taWNo
-  DB_HOST: aW1taWNodC1kYi1zdmM=
-  DB_PASSWORD: U3Bvb24tQm9yb3VnaC1CYXNpczg=
-  DB_USERNAME: aW1taWNoX3VzZXJuYW1l
-kind: Secret
-metadata:
-  creationTimestamp: null
-  name: immich-db-credentials
-  namespace: immicht

module.tf

@@ -1,11 +1,59 @@
 terraform {
   required_version = "> 0.8.0"
+  required_providers {
+    bitwarden = {
+      source  = "maxlaverse/bitwarden"
+      version = ">= 0.13.6"
+    }
+  }
 }
 
 provider "kubernetes" {
   config_path = "~/.kube/config"
 }
 
+provider "bitwarden" {
+  email           = "pierre@geeraert.eu"
+  master_password = ""
+  server          = "https://bitwarden.tryton.geeraert.eu"
+  experimental {
+    embedded_client = true
+  }
+}
+#https://stackoverflow.com/questions/66670949/how-to-tell-terraform-to-skip-the-secret-manager-resource-if-it-exists
+#for the secret not overwritten (not tested)
+data "bitwarden_item_login" "example" {
+  search = "bookstack.zeus.geeraert.eu"
+}
+
+data "bitwarden_item_secure_note" "vpn_preshared_key" {
+  search = "terraform testing"
+}
+output "pgpin" {
+  value     = nonsensitive(coalesce(data.bitwarden_item_secure_note.vpn_preshared_key.field.1.hidden,1234))
+  sensitive = true
+}
+
+resource "random_password" "password" {
+  length           = 16
+  special          = true
+  override_special = "!#$%&*()-_=+[]{}<>:?"
+}
+
+resource "bitwarden_item_secure_note" "terraform_upload_testing" {
+  name            = "terraform upload testing"
+#  notes           = <<EOT
+#[global]
+#secret = "<something sensitive>"
+#EOT
+  organization_id = "a6361589-badd-4bde-9cb4-af8901161c0d"
+  collection_ids  = ["3fa902cd-8244-46bc-a4ea-af8901262d94"]
+
+  field {
+    name = "category"
+    hidden = random_password.password.result
+  }
+}
 
 variable "kubernetes" {
   type = map(object({
@@ -15,7 +63,6 @@ variable "kubernetes" {
       name               = string
       pvc                = optional(bool, false)
       config_map         = optional(bool, false)
-      secret             = optional(bool, false)
       host_path          = optional(string)
       pvc_size           = optional(string)
       storage_class_name = optional(string, "nfs-storage-intelligent")
@@ -31,10 +78,11 @@ variable "kubernetes" {
         })
       }))
     })))
-    replicas               = optional(number, 1)
-    namespace              = optional(string)
-    connected_namespace    = optional(string, "")
-    command                = optional(list(string))
+    replicas            = optional(number, 1)
+    namespace           = optional(string)
+    connected_namespace = optional(string, "")
+    #    namespace           = optional(string,coalesce(connected_namespace,""))
+    #block_namespace_creation = optional(bool, false)
     service_port           = optional(list(number))
     service_type           = optional(string, "ClusterIP")
     service_name           = optional(string)
@@ -349,20 +397,6 @@ resource "kubernetes_deployment_v1" "automatic" {
             }
           }
 
-          #        dynamic "command" {
-          #          for_each = each.value.command != null ? [1] : []
-          #          content {
-          #            [each.value.command]
-          #          }
-
-          #        }
-          #    command = each.value.command != null ? {
-          #      [each.value.command]
-          #    } : {}
-
-
-          command = each.value.command != null ? each.value.command : []
-
 
           dynamic "env" {
             for_each = each.value.environment != null ? each.value.environment : {}
@@ -477,12 +511,6 @@ resource "kubernetes_deployment_v1" "automatic" {
               }
             }
 
-            dynamic "secret" {
-              for_each = volume.value.secret ? [1] : []
-              content {
-                secret_name = volume.value.name
-              }
-            }
 
           }
         }

variables.auto.tfvars

@@ -1,7 +1,7 @@
 kubernetes = {
   bookstack = {
-    #namespace = "bookstack"
-    #enabled        = false
+    namespace = "bookstack"
+    #    enabled        = false
     replicas       = 01
     extra_manifest = ["/opt/kubernetes/Bookstack_kube/Bookstack.configmap.yaml", "/opt/kubernetes/Bookstack_kube/Bookstack.secret.yaml"]
     #image          = "linuxserver/bookstack:24.10.3"
@@ -194,7 +194,7 @@ kubernetes = {
   }
 
   gluetun = {
-    #    enabled             = false
+    #enabled             = false
     dns_nameservers  = "10.2.0.1"
     replicas         = 01
     image            = "qmcgaw/gluetun:latest"
@@ -898,9 +898,7 @@ kubernetes = {
     #    dns_nameservers     = "10.2.0.1"
     service_port   = [9696]
     extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/servarr/servarr-db.secret.yaml"]
-    database = {
-      "image" = "docker.io/library/postgres:17.5"
-    }
+    database       = {}
 
     environment = {
       PUID = {
@@ -1044,40 +1042,7 @@ kubernetes = {
     }
 
   }
-  recommendarr = {
-    enabled             = false
-    image               = "tannermiddleton/recommendarr:latest"
-    connected_namespace = "servarr"
-    #replicas       = 0
-    service_port = [3000]
 
-    environment = {
-      PUID = {
-        value = "1000"
-      }
-      PGID = {
-        value = "1000"
-      }
-      TZ = {
-        value = "Etc/UTC"
-      }
-    }
-    #    requirements = {
-    #      limits-cpu      = "1000m"
-    #      limits-memory   = "1Gi"
-    #      requests-cpu    = "500m"
-    #      requests-memory = "400Mi"
-    #    }
-    pvc = {
-      recommendarr-config = {
-        name       = "recommendarr-config"
-        pvc_size   = "10Mi"
-        pvc        = true
-        mount_path = "/app/server/data"
-      }
-    }
-
-  }
   qbittorrent = {
     #enabled             = false
     image               = "lscr.io/linuxserver/qbittorrent:latest"
@@ -1129,9 +1094,10 @@ kubernetes = {
     image = "alexfozor/flaresolverr:pr-1300-experimental"
 
     connected_namespace = "servarr"
-    #enabled             = false
-    image        = "ghcr.io/flaresolverr/flaresolverr:latest"
-    service_port = [8191]
+    enabled             = false
+    image               = "ghcr.io/flaresolverr/flaresolverr:latest"
+    connected_namespace = "tservarr"
+    service_port        = [8191]
 
     environment = {
       PUID = {
@@ -1159,7 +1125,7 @@ kubernetes = {
   poste = {
     enabled      = false
     image        = "analogic/poste.io:latest"
-    service_port = [25, 80, 110, 143, 443, 465, 587, 993, 995, 4190]
+    service_port = [25,80,110,143,443,465,587,993,995,4190]
 
     environment = {
       PUID = {
@@ -1273,343 +1239,4 @@ kubernetes = {
 
   }
 
-  immicht = {
-    enabled = false
-    #replicas     = 0
-    namespace    = "immicht"
-    image        = "ghcr.io/immich-app/immich-server:v1.134.0"
-    service_port = [2283]
-    database = {
-      #image = "ghcr.io/immich-app/postgres:14-vectorchord0.3.0-pgvectors0.2.0@sha256:fa4f6e0971f454cd95fec5a9aaed2ed93d8f46725cc6bc61e0698e97dba96da1" 
-      image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
-    }
-
-    redis = {
-    image = "docker.io/bitnami/redis:7.2.5-debian-12-r0" }
-    requirements = {
-      limits-cpu      = "800m"
-      limits-memory   = "800Mi"
-      requests-cpu    = "10m"
-      requests-memory = "300Mi"
-    }
-    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/immich/immich-db.secret.yaml"]
-
-    environment = {
-      DB_DATABASE_NAME = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_DATABASE_NAME"
-          }
-        }
-      }
-      DB_USERNAME = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_USERNAME"
-          }
-        }
-      }
-      DB_PASSWORD = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_PASSWORD"
-          }
-        }
-      }
-      POSTGRES_DATABASE = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_DATABASE_NAME"
-          }
-        }
-      }
-      POSTGRES_USER = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_USERNAME"
-          }
-        }
-      }
-      POSTGRES_PASSWORD = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_PASSWORD"
-          }
-        }
-      }
-
-      POSTGRES_POSTGRES_PASSWORD = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_PASSWORD"
-          }
-        }
-      }
-
-
-      DB_HOSTNAME = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_HOST"
-          }
-        }
-      }
-
-      IMMICH_MACHINE_LEARNING_URL         = { value = "http://machinelearning-svc:3003" }
-      REDIS_HOSTNAME                      = { value = "immicht-redis-svc" }
-      UPLOAD_LOCATION                     = { value = "/tmp" }
-      POSTGRESQL_ENABLE_LDAP              = { value = "no" }
-      POSTGRESQL_ENABLE_TLS               = { value = "no" }
-      POSTGRESQL_LOG_HOSTNAME             = { value = "false" }
-      POSTGRESQL_LOG_CONNECTIONS          = { value = "false" }
-      POSTGRESQL_LOG_DISCONNECTIONS       = { value = "false" }
-      POSTGRESQL_PGAUDIT_LOG_CATALOG      = { value = "off" }
-      POSTGRESQL_CLIENT_MIN_MESSAGES      = { value = "error" }
-      POSTGRESQL_SHARED_PRELOAD_LIBRARIES = { value = "pgaudit" }
-      POSTGRES_INITDB_ARGS                = { value = "--data-checksums" }
-
-      BITNAMI_DEBUG          = { value = "false" }
-      REDIS_REPLICATION_MODE = { value = "master" }
-      ALLOW_EMPTY_PASSWORD   = { value = "yes" }
-      REDIS_TLS_ENABLED      = { value = "no" }
-      REDIS_PORT             = { value = "6379" }
-
-    }
-    pvc = {
-      immich-data = {
-        pvc        = true
-        name       = "immich-data"
-        pvc_size   = "2Mi"
-        mount_path = "/usr/src/app/upload"
-      }
-
-    }
-  }
-  machinelearning = {
-    enabled = false
-    #replicas = 0
-    connected_namespace = "immicht"
-    image               = "ghcr.io/immich-app/immich-machine-learning:v1.134.0"
-    service_port        = [3003]
-    environment = {
-      DB_DATABASE_NAME = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_DATABASE_NAME"
-          }
-        }
-      }
-      DB_USERNAME = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_USERNAME"
-          }
-        }
-      }
-      DB_PASSWORD = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_PASSWORD"
-          }
-        }
-      }
-      DB_HOSTNAME = {
-        value_from = {
-          secret_key_ref = {
-            name = "immich-db-credentials"
-            key  = "DB_HOST"
-          }
-        }
-      }
-
-      IMMICH_MACHINE_LEARNING_URL = {
-        value = "http://machinelearning-svc:3003"
-      }
-
-      REDIS_HOSTNAME = {
-        value = "immicht-redis-svc"
-      }
-
-      TRANSFORMERS_CACHE = {
-        value = "/cache"
-      }
-
-    }
-
-  }
-
-  django = {
-    #enabled      =false
-    namespace    = "django"
-    image        = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest"
-    service_port = [8000]
-    database = {
-      image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
-    }
-
-    requirements = {
-      limits-cpu      = "800m"
-      limits-memory   = "800Mi"
-      requests-cpu    = "10m"
-      requests-memory = "300Mi"
-    }
-    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/django/kubeconfig.secret.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/django/django-db.secret.yaml"]
-
-    environment = {
-
-      DB_PASSWORD = {
-        value_from = {
-          secret_key_ref = {
-            name = "django-db-credentials"
-            key  = "DB_PASSWORD"
-          }
-        }
-      }
-      POSTGRES_DB = {
-        value_from = {
-          secret_key_ref = {
-            name = "django-db-credentials"
-            key  = "DB_DATABASE_NAME"
-          }
-        }
-      }
-      POSTGRES_USER = {
-        value_from = {
-          secret_key_ref = {
-            name = "django-db-credentials"
-            key  = "DB_USERNAME"
-          }
-        }
-      }
-      POSTGRES_PASSWORD = {
-        value_from = {
-          secret_key_ref = {
-            name = "django-db-credentials"
-            key  = "DB_PASSWORD"
-          }
-        }
-      }
-
-
-      DB_HOSTNAME = {
-        value_from = {
-          secret_key_ref = {
-            name = "django-db-credentials"
-            key  = "DB_HOST"
-          }
-        }
-      }
-
-
-    }
-    pvc = {
-      kubeconfig-secret = {
-        secret     = true
-        name       = "kubeconfig"
-        mount_path = "/kubeconfig"
-      }
-
-    }
-  }
-
-  keycloak = {
-    #enabled      = false
-    name         = "keycloak"
-    image        = "quay.io/keycloak/keycloak:25.0.1"
-    service_port = [8080]
-    command      = ["/opt/keycloak/bin/kc.sh", "start-dev"]
-    environment = {
-      KEYCLOAK_ADMIN = {
-        value = "admin"
-      }
-      KEYCLOAK_ADMIN_PASSWORD = {
-        value = "admin"
-      }
-      #KC_DB = {
-      #  value = "dev-mem"
-      #}
-      KC_HTTP_ENABLED = {
-        value = "true"
-      }
-      KC_PROXY_HEADERS = {
-        value = "xforwarded"
-      }
-      KC_HOSTNAME_STRICT = {
-        value = "false"
-      }
-
-      KC_HOSTNAME = {
-        value = "https://keycloak.tryton.geeraert.eu"
-      }
-      KC_HOSTNAME_ADMIN = {
-        value = "https://keycloak.tryton.geeraert.eu"
-      }
-    }
-    requirements = {
-      limits-cpu      = "1000m"
-      limits-memory   = "1Gi"
-      requests-cpu    = "500m"
-      requests-memory = "400Mi"
-    }
-
-  }
-
-
-  echo = {
-    enabled      = true
-    image        = "ealen/echo-server:latest"
-    service_port = [80]
-    #    command      = ["-text=Hello authenticated world!"]
-
-  }
-  oauth2-proxy = {
-    #enabled      = false
-    image        = "quay.io/oauth2-proxy/oauth2-proxy:latest"
-    service_port = [4180]
-
-    environment = {
-      OAUTH2_PROXY_PROVIDER = {
-        value = "oidc"
-      }
-      OAUTH2_PROXY_CLIENT_ID = {
-        value = "my-client"
-      }
-      OAUTH2_PROXY_CLIENT_SECRET = {
-        value = "el7RU2DKXhjxhF1wasyz1KhTppvw2lF4"
-      }
-      OAUTH2_PROXY_COOKIE_SECRET = {
-        value = "K70xBsslOnUFh9ehCggywlfb0c8OTzRRiOzdIuDz168="
-      }
-      OAUTH2_PROXY_COOKIE_DOMAIN = {
-        value = "oauthn.tryton.geeraert.eu"
-      }
-
-      OAUTH2_PROXY_OIDC_ISSUER_URL = {
-        value = "https://keycloak.tryton.geeraert.eu/realms/customer"
-      }
-      OAUTH2_PROXY_REDIRECT_URL = {
-        value = "https://echo.tryton.geeraert.eu/oauth2/callback"
-      }
-      OAUTH2_PROXY_EMAIL_DOMAINS = {
-        value = "*"
-      }
-      OAUTH2_PROXY_HTTP_ADDRESS = {
-        value = "0.0.0.0:4180"
-      }
-    }
-
-
-  }
-
 }