fix
This commit is contained in:
22
apps/okd/datas.tf
Normal file
22
apps/okd/datas.tf
Normal file
@@ -0,0 +1,22 @@
|
||||
locals {
|
||||
common-labels = {
|
||||
"vynil.solidite.fr/owner-name" = var.instance
|
||||
"vynil.solidite.fr/owner-namespace" = var.namespace
|
||||
"vynil.solidite.fr/owner-category" = var.category
|
||||
"vynil.solidite.fr/owner-component" = var.component
|
||||
"app.kubernetes.io/managed-by" = "vynil"
|
||||
"app.kubernetes.io/name" = var.component
|
||||
"app.kubernetes.io/instance" = var.instance
|
||||
}
|
||||
}
|
||||
|
||||
data "kubernetes_secret_v1" "authentik" {
|
||||
metadata {
|
||||
name = "authentik"
|
||||
namespace = "${var.domain}-auth"
|
||||
}
|
||||
}
|
||||
|
||||
data "kustomization_overlay" "data" {
|
||||
resources = []
|
||||
}
|
||||
58
apps/okd/deploy.tf
Normal file
58
apps/okd/deploy.tf
Normal file
@@ -0,0 +1,58 @@
|
||||
resource "kubectl_manifest" "deploy" {
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: "${var.component}-${var.instance}"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels: ${jsonencode(local.common-labels)}
|
||||
template:
|
||||
metadata:
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
runAsGroup: 1000
|
||||
containers:
|
||||
- name: okd
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
env:
|
||||
- name: BRIDGE_USER_AUTH
|
||||
value: disabled
|
||||
image: "${var.images.okd.registry}/${var.images.okd.repository}:${var.images.okd.tag}"
|
||||
imagePullPolicy: "${var.images.okd.pullPolicy}"
|
||||
ports:
|
||||
- containerPort: 9000
|
||||
name: http
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
restartPolicy: Always
|
||||
serviceAccount: okd
|
||||
serviceAccountName: okd
|
||||
EOF
|
||||
}
|
||||
161
apps/okd/forward.tf
Normal file
161
apps/okd/forward.tf
Normal file
@@ -0,0 +1,161 @@
|
||||
locals {
|
||||
authentik-token = data.kubernetes_secret_v1.authentik.data["AUTHENTIK_BOOTSTRAP_TOKEN"]
|
||||
request_headers = {
|
||||
"Content-Type" = "application/json"
|
||||
Authorization = "Bearer ${local.authentik-token}"
|
||||
}
|
||||
forward-outpost-providers = jsondecode(data.http.get_forward_outpost.response_body).results[0].providers
|
||||
forward-outpost-pk = jsondecode(data.http.get_forward_outpost.response_body).results[0].pk
|
||||
app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
|
||||
app-icon = "_static/src/browser/media/favicon-dark-support.svg"
|
||||
main-group = format("app-%s", local.app-name)
|
||||
sub-groups = []
|
||||
external-url = format("https://%s", local.dns-names[0])
|
||||
access-token-validity = "hours=10" // ;minutes=10
|
||||
rules-icons = [ for v in local.dns-names : {
|
||||
"host" = "${v}"
|
||||
"http" = {
|
||||
"paths" = [{
|
||||
"backend" = {
|
||||
"service" = local.service
|
||||
}
|
||||
"path" = "/${local.app-icon}"
|
||||
"pathType" = "Prefix"
|
||||
}]
|
||||
}
|
||||
}]
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "prj_ingress_icon" {
|
||||
force_conflicts = true
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: "networking.k8s.io/v1"
|
||||
kind: "Ingress"
|
||||
metadata:
|
||||
name: "${var.instance}-icons"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
ingressClassName: "${var.ingress-class}"
|
||||
rules: ${jsonencode(local.rules-icons)}
|
||||
tls:
|
||||
- hosts: ${jsonencode(local.dns-names)}
|
||||
secretName: "${var.instance}-cert"
|
||||
EOF
|
||||
}
|
||||
|
||||
data "authentik_flow" "default-authorization-flow" {
|
||||
depends_on = [authentik_group.prj_users]
|
||||
slug = "default-provider-authorization-implicit-consent"
|
||||
}
|
||||
|
||||
resource "authentik_provider_proxy" "prj_forward" {
|
||||
name = local.app-name
|
||||
external_host = local.external-url
|
||||
authorization_flow = data.authentik_flow.default-authorization-flow.id
|
||||
mode = "forward_single"
|
||||
access_token_validity = local.access-token-validity
|
||||
}
|
||||
|
||||
|
||||
resource "authentik_application" "prj_application" {
|
||||
name = local.app-name
|
||||
slug = "${var.component}-${var.instance}"
|
||||
group = var.app-group
|
||||
protocol_provider = authentik_provider_proxy.prj_forward.id
|
||||
meta_launch_url = local.external-url
|
||||
meta_icon = format("%s/%s", local.external-url, local.app-icon)
|
||||
}
|
||||
|
||||
resource "authentik_group" "prj_users" {
|
||||
name = local.main-group
|
||||
attributes = jsonencode({"${local.app-name}" = true})
|
||||
}
|
||||
|
||||
resource "authentik_group" "subgroup" {
|
||||
count = length(local.sub-groups)
|
||||
name = format("%s-%s", local.app-name, local.sub-groups[count.index])
|
||||
parent = authentik_group.prj_users.id
|
||||
}
|
||||
|
||||
resource "authentik_policy_expression" "policy" {
|
||||
name = local.main-group
|
||||
expression = <<-EOF
|
||||
attr = request.user.group_attributes()
|
||||
return attr['${local.app-name}'] if '${local.app-name}' in attr else False
|
||||
EOF
|
||||
}
|
||||
|
||||
data "authentik_group" "vynil-admin" {
|
||||
depends_on = [authentik_group.prj_users] # fake dependency so it is not evaluated at plan stage
|
||||
name = "vynil-forward-admins"
|
||||
}
|
||||
|
||||
resource "authentik_policy_binding" "prj_access_users" {
|
||||
target = authentik_application.prj_application.uuid
|
||||
policy = authentik_policy_expression.policy.id
|
||||
order = 0
|
||||
}
|
||||
resource "authentik_policy_binding" "prj_access_vynil" {
|
||||
target = authentik_application.prj_application.uuid
|
||||
group = data.authentik_group.vynil-admin.id
|
||||
order = 1
|
||||
}
|
||||
|
||||
data "http" "get_forward_outpost" {
|
||||
depends_on = [authentik_provider_proxy.prj_forward]
|
||||
url = "http://authentik.${var.domain}-auth.svc/api/v3/outposts/instances/?name__iexact=forward"
|
||||
method = "GET"
|
||||
request_headers = local.request_headers
|
||||
lifecycle {
|
||||
postcondition {
|
||||
condition = contains([200], self.status_code)
|
||||
error_message = "Status code invalid"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "restapi" {
|
||||
uri = "http://authentik.${var.domain}-auth.svc/api/v3/"
|
||||
headers = local.request_headers
|
||||
create_method = "PATCH"
|
||||
update_method = "PATCH"
|
||||
destroy_method = "PATCH"
|
||||
write_returns_object = true
|
||||
id_attribute = "name"
|
||||
}
|
||||
|
||||
resource "restapi_object" "forward_outpost_binding" {
|
||||
path = "/outposts/instances/${local.forward-outpost-pk}/"
|
||||
data = jsonencode({
|
||||
name = "forward"
|
||||
providers = contains(local.forward-outpost-providers, authentik_provider_proxy.prj_forward.id) ? local.forward-outpost-providers : concat(local.forward-outpost-providers, [authentik_provider_proxy.prj_forward.id])
|
||||
})
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "prj_middleware" {
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: "forward-${local.app-name}"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://ak-outpost-forward.${var.domain}-auth.svc:9000/outpost.goauthentik.io/auth/traefik
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-authentik-username
|
||||
# - X-authentik-groups
|
||||
# - X-authentik-email
|
||||
# - X-authentik-name
|
||||
# - X-authentik-uid
|
||||
# - X-authentik-jwt
|
||||
# - X-authentik-meta-jwks
|
||||
# - X-authentik-meta-outpost
|
||||
# - X-authentik-meta-provider
|
||||
# - X-authentik-meta-app
|
||||
# - X-authentik-meta-version
|
||||
EOF
|
||||
}
|
||||
107
apps/okd/index.yaml
Normal file
107
apps/okd/index.yaml
Normal file
@@ -0,0 +1,107 @@
|
||||
---
|
||||
apiVersion: vinyl.solidite.fr/v1beta1
|
||||
kind: Component
|
||||
category: apps
|
||||
metadata:
|
||||
name: okd
|
||||
description: null
|
||||
options:
|
||||
domain-name:
|
||||
default: your_company.com
|
||||
examples:
|
||||
- your_company.com
|
||||
type: string
|
||||
issuer:
|
||||
default: letsencrypt-prod
|
||||
examples:
|
||||
- letsencrypt-prod
|
||||
type: string
|
||||
namespaces:
|
||||
default: []
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
images:
|
||||
default:
|
||||
okd:
|
||||
pullPolicy: IfNotPresent
|
||||
registry: quay.io
|
||||
repository: openshift/origin-console
|
||||
tag: 4.10.0
|
||||
examples:
|
||||
- okd:
|
||||
pullPolicy: IfNotPresent
|
||||
registry: quay.io
|
||||
repository: openshift/origin-console
|
||||
tag: 4.10.0
|
||||
properties:
|
||||
dbgate:
|
||||
default: null
|
||||
properties:
|
||||
pullPolicy:
|
||||
enum:
|
||||
- Always
|
||||
- Never
|
||||
- IfNotPresent
|
||||
okd:
|
||||
default:
|
||||
pullPolicy: IfNotPresent
|
||||
registry: quay.io
|
||||
repository: openshift/origin-console
|
||||
tag: 4.10.0
|
||||
properties:
|
||||
pullPolicy:
|
||||
default: IfNotPresent
|
||||
type: string
|
||||
registry:
|
||||
default: quay.io
|
||||
type: string
|
||||
repository:
|
||||
default: openshift/origin-console
|
||||
type: string
|
||||
tag:
|
||||
default: 4.10.0
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
cluster-admin:
|
||||
default: true
|
||||
examples:
|
||||
- true
|
||||
type: boolean
|
||||
sub-domain:
|
||||
default: okd
|
||||
examples:
|
||||
- okd
|
||||
type: string
|
||||
app-group:
|
||||
default: infra
|
||||
examples:
|
||||
- infra
|
||||
type: string
|
||||
ingress-class:
|
||||
default: traefik
|
||||
examples:
|
||||
- traefik
|
||||
type: string
|
||||
domain:
|
||||
default: your-company
|
||||
examples:
|
||||
- your-company
|
||||
type: string
|
||||
dependencies:
|
||||
- dist: null
|
||||
category: share
|
||||
component: authentik-forward
|
||||
- dist: null
|
||||
category: core
|
||||
component: secret-generator
|
||||
providers:
|
||||
kubernetes: true
|
||||
authentik: true
|
||||
kubectl: true
|
||||
postgresql: null
|
||||
restapi: true
|
||||
http: true
|
||||
gitea: null
|
||||
tfaddtype: null
|
||||
76
apps/okd/ingress.tf
Normal file
76
apps/okd/ingress.tf
Normal file
@@ -0,0 +1,76 @@
|
||||
|
||||
locals {
|
||||
dns-names = ["${var.sub-domain}.${var.domain-name}"]
|
||||
middlewares = ["${var.instance}-https", "forward-${local.app-name}"]
|
||||
service = {
|
||||
"name" = "${var.component}-${var.instance}"
|
||||
"port" = {
|
||||
"number" = 80
|
||||
}
|
||||
}
|
||||
rules = [ for v in local.dns-names : {
|
||||
"host" = "${v}"
|
||||
"http" = {
|
||||
"paths" = [{
|
||||
"backend" = {
|
||||
"service" = local.service
|
||||
}
|
||||
"path" = "/"
|
||||
"pathType" = "Prefix"
|
||||
}]
|
||||
}
|
||||
}]
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "prj_certificate" {
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: "cert-manager.io/v1"
|
||||
kind: "Certificate"
|
||||
metadata:
|
||||
name: "${var.instance}"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
secretName: "${var.instance}-cert"
|
||||
dnsNames: ${jsonencode(local.dns-names)}
|
||||
issuerRef:
|
||||
name: "${var.issuer}"
|
||||
kind: "ClusterIssuer"
|
||||
group: "cert-manager.io"
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "prj_https_redirect" {
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: "traefik.containo.us/v1alpha1"
|
||||
kind: "Middleware"
|
||||
metadata:
|
||||
name: "${var.instance}-https"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
redirectScheme:
|
||||
scheme: "https"
|
||||
permanent: true
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "prj_ingress" {
|
||||
force_conflicts = true
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: "networking.k8s.io/v1"
|
||||
kind: "Ingress"
|
||||
metadata:
|
||||
name: "${var.instance}"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
annotations:
|
||||
"traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in local.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])}"
|
||||
spec:
|
||||
ingressClassName: "${var.ingress-class}"
|
||||
rules: ${jsonencode(local.rules)}
|
||||
tls:
|
||||
- hosts: ${jsonencode(local.dns-names)}
|
||||
secretName: "${var.instance}-cert"
|
||||
EOF
|
||||
}
|
||||
68
apps/okd/rbac.tf
Normal file
68
apps/okd/rbac.tf
Normal file
@@ -0,0 +1,68 @@
|
||||
locals {
|
||||
sorted-namespaces = reverse(distinct(sort(var.namespaces)))
|
||||
}
|
||||
resource "kubectl_manifest" "okd_sa" {
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: "${var.component}-${var.instance}"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "okd_crb" {
|
||||
count = var.cluster-admin ? 1 : 0
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: "${var.namespace}-${var.component}-${var.instance}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "${var.component}-${var.instance}"
|
||||
namespace: "${var.namespace}"
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "okd_roles" {
|
||||
count = length(local.sorted-namespaces)
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: "${var.namespace}-${var.component}-${var.instance}"
|
||||
namespace: "${local.sorted-namespaces[count.index]}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
rules:
|
||||
- apiGroups: ["*"]
|
||||
resources: ["*"]
|
||||
verbs: ["*"]
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "okd_role_bindings" {
|
||||
count = length(local.sorted-namespaces)
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: "${var.namespace}-${var.component}-${var.instance}"
|
||||
namespace: "${local.sorted-namespaces[count.index]}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "${var.component}-${var.instance}"
|
||||
namespace: "${var.namespace}"
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: "${var.namespace}-${var.component}-${var.instance}"
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
EOF
|
||||
}
|
||||
18
apps/okd/svc.tf
Normal file
18
apps/okd/svc.tf
Normal file
@@ -0,0 +1,18 @@
|
||||
resource "kubectl_manifest" "service" {
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: "${var.component}-${var.instance}"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector: ${jsonencode(local.common-labels)}
|
||||
EOF
|
||||
}
|
||||
Reference in New Issue
Block a user