304 lines
14 KiB
Terraform
304 lines
14 KiB
Terraform
variable "kubernetes_input" {
|
|
type = map(object({
|
|
namespace = optional(string)
|
|
connected_namespace = optional(string, "")
|
|
database = optional(map(string))
|
|
redis = optional(map(string))
|
|
enabled = optional(bool, true)
|
|
config_map_import = optional(list(string))
|
|
secret_import = optional(list(string))
|
|
requirements = optional(map(string), {
|
|
limits-cpu = "800m"
|
|
limits-memory = "500Mi"
|
|
requests-cpu = "200m"
|
|
requests-memory = "200Mi"
|
|
})
|
|
import_database_secret = optional(object({
|
|
#putting them a non optional as the code doesn't allow optional value
|
|
host = string
|
|
name = string
|
|
password = string
|
|
port = string
|
|
username = string
|
|
}))
|
|
}))
|
|
|
|
}
|
|
|
|
###########################################################################################################################################################################################
|
|
#
|
|
#
|
|
# CONFIGMAP PART
|
|
#
|
|
#
|
|
#
|
|
###########################################################################################################################################################################################
|
|
data "bitwarden-secrets_secret" "configmap_import" {
|
|
for_each = {
|
|
for pair in flatten([
|
|
for k, v in var.kubernetes_input : [
|
|
for id in v.config_map_import : {
|
|
map_key = k
|
|
secret_id = id
|
|
}
|
|
] if v.config_map_import != null && v.enabled == true
|
|
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
|
}
|
|
id = each.value
|
|
}
|
|
|
|
resource "kubernetes_config_map_v1" "configmap_import" {
|
|
for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
|
|
metadata {
|
|
name = each.value.note
|
|
namespace = split("__", each.value.key)[0]
|
|
}
|
|
data = yamldecode(each.value.value)
|
|
}
|
|
|
|
|
|
data "bitwarden-secrets_secret" "secret_import" {
|
|
for_each = {
|
|
for pair in flatten([
|
|
for k, v in var.kubernetes_input : [
|
|
for id in v.secret_import : {
|
|
map_key = k
|
|
secret_id = id
|
|
}
|
|
] if v.secret_import != null && v.enabled == true
|
|
]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
|
|
}
|
|
id = each.value
|
|
}
|
|
|
|
resource "kubernetes_secret_v1" "secret_import" {
|
|
for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
|
|
metadata {
|
|
name = each.value.note
|
|
namespace = split("__", each.value.key)[0]
|
|
}
|
|
data = yamldecode(each.value.value)
|
|
}
|
|
|
|
###########################################################################################################################################################################################
|
|
#
|
|
#
|
|
# DATABASE PART
|
|
#
|
|
#
|
|
#
|
|
###########################################################################################################################################################################################
|
|
resource "kubernetes_secret_v1" "automatic-database-secret" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
|
metadata {
|
|
name = "${each.key}-db-terraform"
|
|
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
|
}
|
|
|
|
data = {
|
|
DB_DATABASE_NAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
DB_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
POSTGRES_DB = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
MYSQL_DATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
PGDATABASE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
DB_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
|
PGHOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
|
POSTGRES_HOST = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
|
DB_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
MYSQL_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
POSTGRES_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
PGPASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
DB_USERNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
|
POSTGRES_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
|
MYSQL_USER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
|
PGUSER = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
|
DATABASE_URL = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
}
|
|
|
|
}
|
|
|
|
resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
|
metadata {
|
|
name = "${each.key}-db-mapped-terraform"
|
|
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
|
}
|
|
|
|
data = {
|
|
"${try(each.value.database.map_name, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
|
|
"${try(each.value.database.map_host, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
|
|
"${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
|
|
"${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
|
|
}
|
|
}
|
|
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
|
key = "${each.key}__db__username"
|
|
value = try(each.value.database.username, each.key)
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
lifecycle {
|
|
ignore_changes = [
|
|
value, key
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
|
key = "${each.key}__db__password"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
length = 32
|
|
special = true
|
|
min_special = 5
|
|
avoid_ambiguous = true
|
|
lifecycle {
|
|
ignore_changes = [
|
|
value, key
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
|
key = "${each.key}__db__host"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
value = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
|
|
lifecycle {
|
|
ignore_changes = [
|
|
value, key
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
|
key = "${each.key}__db__port"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
value = try(each.value.database.port, 5432)
|
|
lifecycle {
|
|
ignore_changes = [
|
|
value, key
|
|
]
|
|
}
|
|
}
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.database != null && value.enabled == true }
|
|
key = "${each.key}__db__name"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
value = try(each.value.database.name, each.key)
|
|
lifecycle {
|
|
ignore_changes = [
|
|
value, key
|
|
]
|
|
}
|
|
}
|
|
|
|
# 1. Move the loop logic to a local variable first
|
|
locals {
|
|
database_secrets_to_import = {
|
|
for key, value in var.kubernetes_input : key => value
|
|
if value.database != null && value.enabled == true && can(value.import_database_secret.host)
|
|
}
|
|
}
|
|
|
|
# 2. Reference the local map in your import block using each.key and each.value
|
|
import {
|
|
for_each = local.database_secrets_to_import
|
|
|
|
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key]
|
|
id = each.value.import_database_secret.host
|
|
}
|
|
|
|
import {
|
|
for_each = local.database_secrets_to_import
|
|
|
|
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key]
|
|
id = each.value.import_database_secret.name
|
|
}
|
|
import {
|
|
for_each = local.database_secrets_to_import
|
|
|
|
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key]
|
|
id = each.value.import_database_secret.password
|
|
}
|
|
import {
|
|
for_each = local.database_secrets_to_import
|
|
|
|
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key]
|
|
id = each.value.import_database_secret.port
|
|
}
|
|
import {
|
|
for_each = local.database_secrets_to_import
|
|
|
|
to = bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key]
|
|
id = each.value.import_database_secret.username
|
|
}
|
|
###########################################################################################################################################################################################
|
|
#
|
|
#
|
|
# REDIS PART
|
|
#
|
|
#
|
|
#
|
|
###########################################################################################################################################################################################
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_host" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
|
key = "${each.key}__redis__host"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
value = try(each.value.redis.host, "${each.key}-redis-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
|
|
}
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_port" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
|
key = "${each.key}__redis__port"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
value = try(each.value.redis.port, 5432)
|
|
}
|
|
|
|
##
|
|
## Commenting until I use the redis password option
|
|
##
|
|
#resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_password" {
|
|
# for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
|
# key = "${each.key}__redis__password"
|
|
# project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
# length = 32
|
|
# special = true
|
|
# min_special = 5
|
|
# avoid_ambiguous = true
|
|
#}
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_REPLICATION_MODE" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
|
key = "${each.key}__redis__REPLICATION_MODE"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
value = try(each.value.redis.REPLICATION_MODE, "master")
|
|
}
|
|
|
|
resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_TLS_ENABLED" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
|
key = "${each.key}__redis__TLS_ENABLED"
|
|
project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
|
|
value = try(each.value.redis.TLS_ENABLED, "no")
|
|
}
|
|
|
|
resource "kubernetes_secret_v1" "automatic-redis-secret" {
|
|
for_each = { for key, value in var.kubernetes_input : key => value if value.redis != null && value.enabled == true }
|
|
metadata {
|
|
name = "${each.key}-redis-terraform"
|
|
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
|
}
|
|
|
|
data = {
|
|
REDIS_HOSTNAME = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_host[each.key].value}"
|
|
REDIS_PORT = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_port[each.key].value}"
|
|
REDIS_REPLICATION_MODE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_REPLICATION_MODE[each.key].value}"
|
|
REDIS_TLS_ENABLED = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_TLS_ENABLED[each.key].value}"
|
|
}
|
|
|
|
} |