265 lines
8.1 KiB
Terraform
265 lines
8.1 KiB
Terraform
terraform {
|
|
required_version = "> 0.8.0"
|
|
required_providers {
|
|
bitwarden-secrets = {
|
|
source = "bitwarden/bitwarden-secrets"
|
|
version = "0.5.4-pre"
|
|
}
|
|
}
|
|
|
|
}
|
|
|
|
provider "kubernetes" {
|
|
config_path = "~/.kube/config"
|
|
}
|
|
|
|
|
|
provider "bitwarden-secrets" {
|
|
api_url = "https://bitwarden.tryton.geeraert.eu/api"
|
|
identity_url = "https://bitwarden.tryton.geeraert.eu/identity"
|
|
access_token = "0.9f4b7c5f-e6e7-4eff-929e-b474016a2b9c.bMRELajGGb7qMuXXvzgCCJdDfxfTCS:mFDT7tHSi43KJSnkwvTSYg=="
|
|
organization_id = "a6361589-badd-4bde-9cb4-af8901161c0d"
|
|
}
|
|
|
|
variable "kubernetes" {
|
|
type = map(object({
|
|
name = optional(string)
|
|
image = string
|
|
pvc = optional(map(object({
|
|
name = string
|
|
pvc = optional(bool, false)
|
|
config_map = optional(bool, false)
|
|
secret = optional(bool, false)
|
|
host_path = optional(string)
|
|
pvc_size = optional(string)
|
|
storage_class_name = optional(string, "nfs-storage-intelligent")
|
|
annotations_fileType = optional(string)
|
|
existing_pvc = optional(bool, false)
|
|
mount_path = string
|
|
sub_path = optional(string)
|
|
})))
|
|
environment = optional(map(object({
|
|
name = optional(string)
|
|
value = optional(string)
|
|
value_from = optional(object({
|
|
secret_key_ref = object({
|
|
name = string
|
|
key = optional(string, null)
|
|
})
|
|
}))
|
|
})))
|
|
replicas = optional(number, 1)
|
|
namespace = optional(string)
|
|
connected_namespace = optional(string, "")
|
|
command = optional(list(string))
|
|
service_port = optional(list(number))
|
|
service_type = optional(string, "ClusterIP")
|
|
service_name = optional(string)
|
|
domain_name = optional(string)
|
|
liveness_tcp_socket = optional(number)
|
|
liveness_http_get = optional(string)
|
|
liveness_http_get_path = optional(string)
|
|
database = optional(map(string))
|
|
database_command = optional(list(string))
|
|
database_args = optional(list(string))
|
|
redis = optional(map(string))
|
|
enabled = optional(bool, true)
|
|
secret_ref = optional(list(string))
|
|
config_map_ref = optional(list(string))
|
|
config_map_import = optional(list(string))
|
|
secret_import = optional(list(string))
|
|
extra_manifest = optional(list(string))
|
|
requirements = optional(map(string))
|
|
# requirements = optional(map(string), {
|
|
# limits-cpu = "800m"
|
|
# limits-memory = "500Mi"
|
|
# requests-cpu = "200m"
|
|
# requests-memory = "200Mi"
|
|
# })
|
|
dns_nameservers = optional(string)
|
|
service_account_name = optional(string)
|
|
environment_variables = optional(map(string), { name = "value" })
|
|
security_context = optional(bool, false)
|
|
import_database_secret = optional(object({
|
|
#putting them a non optional as the code doesn't allow optional value
|
|
host = string
|
|
name = string
|
|
password = string
|
|
port = string
|
|
username = string
|
|
}))
|
|
}))
|
|
|
|
}
|
|
|
|
variable "database_backup_info" {
|
|
type = map(object({
|
|
image = optional(string)
|
|
command = optional(string)
|
|
}))
|
|
description = "based on DB engine, give the docker image and the command used to backup"
|
|
default = {
|
|
postgres = {
|
|
image = "alpine/psql"
|
|
command = "pg_dump |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz"
|
|
}
|
|
mysql = {
|
|
image = "mysql"
|
|
command = "mysqldump -h $DB_HOST -u $MYSQL_USER -p$MYSQL_ROOT_PASSWORD $MYSQL_DATABASE |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz"
|
|
}
|
|
sqlserver = {
|
|
image = "mcr.microsoft.com/mssql-tools"
|
|
command = "/opt/mssql-tools/bin/sqlcmd -S $DB_HOST -U $DB_USERNAME -P $DB_PASSWORD -Q \"BACKUP DATABASE $DB_DATABASE_NAME TO DISK = '/backup/$DB_DATABASE_NAME-$(date +%Y%m%d).bak' WITH COPY_ONLY, CHECKSUM,FORMAT, MEDIANAME = 'SQLServerBackups',NAME = 'Full Backup of SQLTestDB'\";exit"
|
|
}
|
|
}
|
|
}
|
|
|
|
variable "storage_path" {
|
|
type = map(string)
|
|
default = {
|
|
main_storage = "/data/kubernetes",
|
|
fast_access = "/ssd"
|
|
}
|
|
}
|
|
|
|
locals {
|
|
pvc_list = flatten([
|
|
for key, value in var.kubernetes : [
|
|
for index, pvc in value.pvc : {
|
|
key = "${coalesce(value.namespace, value.connected_namespace, key)}/${pvc.name}"
|
|
index = index
|
|
pvc = pvc.pvc
|
|
name = pvc.name
|
|
pvc_size = pvc.pvc_size
|
|
mount_path = pvc.mount_path
|
|
storage_class_name = pvc.storage_class_name
|
|
annotations_fileType = pvc.annotations_fileType
|
|
existing_pvc = pvc.existing_pvc
|
|
sub_path = pvc.sub_path
|
|
namespace = coalesce(value.namespace, value.connected_namespace, key)
|
|
}] if value.enabled == true && value.pvc != null
|
|
])
|
|
|
|
# group duplicates instead of throwing an error
|
|
pvc_map_grouped = {
|
|
for p in local.pvc_list :
|
|
p.key => p...
|
|
}
|
|
|
|
# keep only one PVC per key (take the first)
|
|
pvc_map = {
|
|
for k, list in local.pvc_map_grouped :
|
|
k => list[0]
|
|
}
|
|
|
|
pvc_details = values(local.pvc_map)
|
|
}
|
|
|
|
locals {
|
|
env_details = flatten([
|
|
for key, value in var.kubernetes : [
|
|
for index, env in value.environment_variables : {
|
|
index = index
|
|
name = env
|
|
}] if value.enabled == true && value.environment_variables != null
|
|
])
|
|
}
|
|
|
|
|
|
|
|
resource "kubernetes_namespace_v1" "automatic" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" }
|
|
metadata {
|
|
annotations = {
|
|
name = coalesce(each.value.namespace, each.key)
|
|
}
|
|
labels = {
|
|
deployment_method = "Terraform"
|
|
}
|
|
name = coalesce(each.value.namespace, each.key)
|
|
}
|
|
}
|
|
|
|
locals {
|
|
kubernetes_manifests = flatten([
|
|
for k, obj in var.kubernetes : [
|
|
for index, manifest in(obj.extra_manifest != null ? obj.extra_manifest : []) :
|
|
{
|
|
key = "${k}_${index}"
|
|
name = obj.name
|
|
manifest = manifest
|
|
enabled = obj.enabled
|
|
}
|
|
if obj.enabled == true
|
|
]
|
|
])
|
|
}
|
|
|
|
resource "kubernetes_manifest" "manifest" {
|
|
for_each = { for item in local.kubernetes_manifests : item.key => item }
|
|
|
|
manifest = yamldecode(file(each.value.manifest))
|
|
provider = kubernetes
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# resource "kubernetes_config_map_v1" "automatic-configmap" {
|
|
# metadata {
|
|
# name = "extra-sites-terraform"
|
|
# namespace = "reverse-proxy"
|
|
# annotations = {
|
|
# "reloader.stakater.com/match" : "true",
|
|
# }
|
|
# }
|
|
#
|
|
# data = {
|
|
# for key, value in var.kubernetes :
|
|
# "${value.domain_name}.conf" => templatefile("nginx_config.tftpl", {
|
|
# name_site = value.domain_name
|
|
# name_service = "${key}-svc.${coalesce(value.namespace, value.connected_namespace, key)}.svc:${value.service_port.0}"
|
|
# }) if value.domain_name != null && value.enabled == true
|
|
# }
|
|
#
|
|
# }
|
|
|
|
|
|
/*resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db2_password" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.database != null }
|
|
key = "${each.key}__db__passwordSHUNT"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
length = 32
|
|
special = true
|
|
min_special = 5
|
|
avoid_ambiguous = true
|
|
lifecycle {
|
|
ignore_changes = [
|
|
value,key
|
|
]
|
|
}
|
|
|
|
}
|
|
|
|
|
|
output "database_password" {
|
|
description = "Auto-generated password for the RDS database instance"
|
|
#value = nonsensitive(bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password.*)
|
|
#value = nonsensitive(values(bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password).*.value)
|
|
value = [
|
|
for secret in bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password : nonsensitive(secret.value)
|
|
]
|
|
sensitive = false
|
|
}
|
|
*/
|
|
|
|
#terraform import 'bitwarden-secrets_secret.automatic_bitwarden_secret_db2_password["django-testing"]' "a3385f49-ba92-4478-b6f1-b4e100ff01fb" |