199 lines
8.4 KiB
Terraform
199 lines
8.4 KiB
Terraform
|
|
data "bitwarden-secrets_secret" "configmap_import" {
|
|
for_each = {
|
|
for pair in flatten([
|
|
for k, v in var.kubernetes : [
|
|
for id in v.config_map_import : {
|
|
map_key = k
|
|
secret_id = id
|
|
}
|
|
] if v.config_map_import != null && v.enabled == true
|
|
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
|
}
|
|
id = each.value
|
|
}
|
|
|
|
resource "kubernetes_config_map_v1" "configmap_import" {
|
|
for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
|
|
metadata {
|
|
name = each.value.note
|
|
namespace = split("__", each.value.key)[0]
|
|
}
|
|
data = yamldecode(each.value.value)
|
|
}
|
|
|
|
|
|
data "bitwarden-secrets_secret" "secret_import" {
|
|
for_each = {
|
|
for pair in flatten([
|
|
for k, v in var.kubernetes : [
|
|
for id in v.secret_import : {
|
|
map_key = k
|
|
secret_id = id
|
|
}
|
|
] if v.secret_import != null && v.enabled == true
|
|
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
|
}
|
|
id = each.value
|
|
}
|
|
|
|
resource "kubernetes_secret_v1" "secret_import" {
|
|
for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
|
|
metadata {
|
|
name = each.value.note
|
|
namespace = split("__", each.value.key)[0]
|
|
}
|
|
data = yamldecode(each.value.value)
|
|
}
|
|
|
|
|
|
resource "kubernetes_secret_v1" "automatic-database-secret" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
|
metadata {
|
|
name = "${each.key}-db-terraform"
|
|
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
|
}
|
|
|
|
data = {
|
|
DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
|
PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
|
POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
|
DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
|
POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
|
MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
|
PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
|
DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
}
|
|
|
|
}
|
|
|
|
resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
|
metadata {
|
|
name = "${each.key}-db-mapped-terraform"
|
|
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
|
}
|
|
|
|
data = {
|
|
"${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
"${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
|
"${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
"${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
|
}
|
|
}
|
|
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
|
key = "${each.key}__db__username"
|
|
value = try(each.value.database.username, each.key)
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
lifecycle {
|
|
ignore_changes = [
|
|
value, key
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
|
key = "${each.key}__db__password"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
length = 32
|
|
special = true
|
|
min_special = 5
|
|
avoid_ambiguous = true
|
|
lifecycle {
|
|
ignore_changes = [
|
|
value, key
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
|
key = "${each.key}__db__host"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
|
|
lifecycle {
|
|
ignore_changes = [
|
|
value, key
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
|
key = "${each.key}__db__port"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
value = try(each.value.database.port, 5432)
|
|
lifecycle {
|
|
ignore_changes = [
|
|
value, key
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
|
|
key = "${each.key}__db__name"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
value = try(each.value.database.name, each.key)
|
|
lifecycle {
|
|
ignore_changes = [
|
|
value, key
|
|
]
|
|
}
|
|
}
|
|
|
|
# 1. Move the loop logic to a local variable first
|
|
locals {
|
|
database_secrets_to_import = {
|
|
for key, value in var.kubernetes : key => value
|
|
if value.database != null && value.enabled == true && try(value.import_database_secret, "") != ""
|
|
}
|
|
}
|
|
|
|
# 2. Reference the local map in your import block using each.key and each.value
|
|
import {
|
|
for_each = local.database_secrets_to_import
|
|
|
|
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key]
|
|
id = each.value.import_database_secret.host
|
|
}
|
|
|
|
import {
|
|
for_each = local.database_secrets_to_import
|
|
|
|
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key]
|
|
id = each.value.import_database_secret.name
|
|
}
|
|
import {
|
|
for_each = local.database_secrets_to_import
|
|
|
|
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key]
|
|
id = each.value.import_database_secret.password
|
|
}
|
|
import {
|
|
for_each = local.database_secrets_to_import
|
|
|
|
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key]
|
|
id = each.value.import_database_secret.port
|
|
}
|
|
import {
|
|
for_each = local.database_secrets_to_import
|
|
|
|
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key]
|
|
id = each.value.import_database_secret.username
|
|
}
|