352 lines
11 KiB
Terraform
352 lines
11 KiB
Terraform
resource "kubernetes_service_v1" "automatic_service" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
|
|
metadata {
|
|
name = "${each.key}-svc"
|
|
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
|
labels = {
|
|
deployment_method = "Terraform"
|
|
}
|
|
annotations = each.value.service_type == "LoadBalancer" ? {
|
|
"metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
|
|
} : {}
|
|
|
|
|
|
|
|
}
|
|
spec {
|
|
selector = {
|
|
app = each.key
|
|
}
|
|
dynamic "port" {
|
|
for_each = each.value.service_port != null ? each.value.service_port : []
|
|
content {
|
|
port = port.value
|
|
target_port = port.value
|
|
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
|
|
|
|
}
|
|
}
|
|
|
|
# port {
|
|
# port = each.value.service_port
|
|
# target_port = each.value.service_port
|
|
# }
|
|
type = each.value.service_type
|
|
|
|
|
|
}
|
|
depends_on = [resource.kubernetes_namespace_v1.automatic]
|
|
|
|
|
|
}
|
|
|
|
resource "kubernetes_ingress_v1" "automatic_ingress" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true }
|
|
metadata {
|
|
name = "${each.key}-ingress"
|
|
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
|
|
|
annotations = {
|
|
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
|
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
|
}
|
|
}
|
|
|
|
spec {
|
|
ingress_class_name = "traefik"
|
|
# Dynamic TLS configuration for cert-manager
|
|
tls {
|
|
hosts = [join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])]
|
|
secret_name = "${each.key}-tls-secret" # cert-manager will create and manage this secret automatically
|
|
}
|
|
|
|
rule {
|
|
host = join(".", [coalesce(each.value.domain_name, each.key), "geeraert.eu"])
|
|
http {
|
|
path {
|
|
path = "/"
|
|
backend {
|
|
service {
|
|
name = "${each.key}-svc"
|
|
port {
|
|
number = each.value.service_port[0] #selecting the first of the list
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
resource "kubernetes_ingress_v1" "automatic_ingress_legacy" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true && value.docker != true && value.exposed == true && value.legacy_domain == true }
|
|
metadata {
|
|
name = "${each.key}-ingress-legacy"
|
|
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
|
|
|
annotations = {
|
|
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
|
|
"traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
|
|
}
|
|
}
|
|
|
|
spec {
|
|
ingress_class_name = "traefik"
|
|
# Dynamic TLS configuration for cert-manager
|
|
tls {
|
|
hosts = [join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])]
|
|
secret_name = "${each.key}-tryton-tls-secret" # cert-manager will create and manage this secret automatically
|
|
}
|
|
|
|
rule {
|
|
host = join(".", [coalesce(each.value.domain_name, each.key), "tryton.geeraert.eu"])
|
|
http {
|
|
path {
|
|
path = "/"
|
|
backend {
|
|
service {
|
|
name = "${each.key}-svc"
|
|
port {
|
|
number = each.value.service_port[0] #selecting the first of the list
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
resource "kubernetes_deployment_v1" "automatic" {
|
|
for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
|
|
metadata {
|
|
namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
|
|
name = coalesce(each.value.name, each.key)
|
|
|
|
labels = {
|
|
app = each.key
|
|
deployment_method = "Terraform"
|
|
}
|
|
}
|
|
|
|
spec {
|
|
replicas = each.value.replicas
|
|
|
|
selector {
|
|
match_labels = {
|
|
app = each.key
|
|
}
|
|
}
|
|
|
|
template {
|
|
metadata {
|
|
labels = {
|
|
app = each.key
|
|
deployment_method = "Terraform"
|
|
}
|
|
}
|
|
|
|
spec {
|
|
container {
|
|
image = each.value.image
|
|
name = coalesce(each.value.name, each.key)
|
|
dynamic "port" {
|
|
for_each = each.value.service_port != null ? each.value.service_port : []
|
|
content {
|
|
container_port = port.value
|
|
# name = "${each.key}-${port.value}"
|
|
name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
|
|
}
|
|
}
|
|
|
|
|
|
dynamic "volume_mount" {
|
|
for_each = each.value.pvc != null ? each.value.pvc : {}
|
|
content {
|
|
mount_path = volume_mount.value.mount_path
|
|
name = "${volume_mount.key}-volume"
|
|
sub_path = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
|
|
}
|
|
}
|
|
|
|
dynamic "volume_mount" {
|
|
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
|
|
content {
|
|
mount_path = "/backup"
|
|
name = "${each.key}-db-backup"
|
|
}
|
|
}
|
|
|
|
dynamic "env_from" {
|
|
for_each = each.value.secret_ref != null ? each.value.secret_ref : []
|
|
content {
|
|
dynamic "secret_ref" {
|
|
for_each = [1]
|
|
content {
|
|
name = env_from.value
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
dynamic "env_from" {
|
|
for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
|
|
#for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-terraform"] : []
|
|
content {
|
|
dynamic "secret_ref" {
|
|
for_each = [1]
|
|
content {
|
|
name = env_from.value
|
|
}
|
|
}
|
|
}
|
|
}
|
|
dynamic "env_from" {
|
|
for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
|
|
content {
|
|
dynamic "secret_ref" {
|
|
for_each = [1]
|
|
content {
|
|
name = env_from.value
|
|
}
|
|
}
|
|
}
|
|
}
|
|
dynamic "env_from" {
|
|
for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
|
|
content {
|
|
dynamic "config_map_ref" {
|
|
for_each = [1]
|
|
content {
|
|
name = env_from.value
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
command = each.value.command != null ? each.value.command : []
|
|
|
|
|
|
dynamic "env" {
|
|
for_each = each.value.environment != null ? each.value.environment : {}
|
|
content {
|
|
name = env.key
|
|
value = env.value.value != null ? env.value.value : null
|
|
dynamic "value_from" {
|
|
for_each = env.value.value_from != null ? env.value.value_from : {}
|
|
content {
|
|
dynamic "secret_key_ref" {
|
|
for_each = [1]
|
|
content {
|
|
name = env.value.value_from.secret_key_ref.name
|
|
key = env.value.value_from.secret_key_ref.key
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
dynamic "resources" {
|
|
for_each = each.value.requirements != null ? [1] : []
|
|
content {
|
|
limits = {
|
|
cpu = each.value.requirements.limits-cpu
|
|
memory = each.value.requirements.limits-memory
|
|
}
|
|
requests = {
|
|
cpu = each.value.requirements.requests-cpu
|
|
memory = each.value.requirements.requests-memory
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
|
|
dynamic "security_context" {
|
|
for_each = each.value.security_context == true ? [1] : []
|
|
content {
|
|
privileged = true
|
|
#capabilities = {
|
|
# add : ["NET_ADMIN", "NET_RAW"]
|
|
#}
|
|
}
|
|
}
|
|
dynamic "liveness_probe" {
|
|
for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
|
|
content {
|
|
dynamic "tcp_socket" {
|
|
for_each = each.value.liveness_tcp_socket != null ? [""] : []
|
|
content {
|
|
port = each.value.liveness_tcp_socket
|
|
}
|
|
}
|
|
|
|
dynamic "http_get" {
|
|
for_each = each.value.liveness_http_get != null ? [""] : []
|
|
content {
|
|
port = each.value.liveness_http_get
|
|
path = coalesce(each.value.liveness_http_get_path, "/")
|
|
}
|
|
}
|
|
|
|
initial_delay_seconds = 3
|
|
period_seconds = 3
|
|
}
|
|
}
|
|
}
|
|
dynamic "dns_config" {
|
|
for_each = each.value.dns_nameservers != null ? [1] : []
|
|
content {
|
|
nameservers = [each.value.dns_nameservers]
|
|
}
|
|
|
|
}
|
|
service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null
|
|
|
|
dynamic "volume" {
|
|
for_each = each.value.pvc != null ? each.value.pvc : {}
|
|
content {
|
|
name = "${volume.key}-volume"
|
|
|
|
dynamic "config_map" {
|
|
for_each = volume.value.config_map ? [1] : []
|
|
content {
|
|
name = volume.key
|
|
}
|
|
}
|
|
|
|
dynamic "host_path" {
|
|
for_each = volume.value.host_path != null || (!(volume.value.config_map) && !(volume.value.secret)) ? [1] : []
|
|
content {
|
|
path = coalesce(volume.value.host_path, join("/", [var.storage_path.main_storage, coalesce(each.value.namespace, each.value.connected_namespace, each.key), volume.key]))
|
|
|
|
}
|
|
}
|
|
|
|
dynamic "secret" {
|
|
for_each = volume.value.secret ? [1] : []
|
|
content {
|
|
secret_name = volume.key
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
dynamic "volume" {
|
|
for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
|
|
content {
|
|
name = "${each.key}-db-backup"
|
|
|
|
host_path {
|
|
path = join("/", [var.storage_path.fast_access, "Backup", coalesce(each.value.namespace, each.value.connected_namespace, each.key), "${each.key}-db-backup"])
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
}
|
|
}
|