fix
This commit is contained in:
232
share/dataset-pg/directus.tf
Normal file
232
share/dataset-pg/directus.tf
Normal file
@@ -0,0 +1,232 @@
|
||||
locals {
|
||||
directus-labels = merge(local.common-labels, {
|
||||
"app.kubernetes.io/component" = "directus"
|
||||
})
|
||||
directus-dns-name = "directus.${local.dns-name}"
|
||||
directus-service = {
|
||||
"name" = "directus-${var.instance}"
|
||||
"port" = {
|
||||
"number" = 80
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
data "kubernetes_secret_v1" "authentik" {
|
||||
metadata {
|
||||
name = "authentik"
|
||||
namespace = "${var.domain}-auth"
|
||||
}
|
||||
}
|
||||
|
||||
data "kubernetes_ingress_v1" "authentik" {
|
||||
metadata {
|
||||
name = "authentik"
|
||||
namespace = "${var.domain}-auth"
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "directus_config" {
|
||||
count = var.extentions.directus.enable ? 1:0
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: "${var.component}-${var.instance}-directus"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.directus-labels)}
|
||||
data:
|
||||
PORT: "8055"
|
||||
DB_CLIENT: "pg"
|
||||
DB_DATABASE: "${var.instance}"
|
||||
DB_HOST: "${var.instance}-${var.component}-rw.${var.namespace}.svc"
|
||||
DB_PORT: "5432"
|
||||
STORAGE_LOCATIONS: "local"
|
||||
STORAGE_LOCAL_ROOT: "/var/store"
|
||||
ADMIN_EMAIL: "admin@${var.domain-name}"
|
||||
TELEMETRY: "false"
|
||||
AUTH_PROVIDERS: "vynil"
|
||||
AUTH_VYNIL_DRIVER: "oauth2"
|
||||
AUTH_VYNIL_ISSUER_URL: "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/directus-${var.instance}/.well-known/openid-configuration"
|
||||
AUTH_VYNIL_IDENTIFIER_KEY: "nickname"
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "directus_secret" {
|
||||
count = var.extentions.directus.enable ? 1:0
|
||||
ignore_fields = ["metadata.annotations"]
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: "secretgenerator.mittwald.de/v1alpha1"
|
||||
kind: "StringSecret"
|
||||
metadata:
|
||||
name: "${var.component}-${var.instance}-directus"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.directus-labels)}
|
||||
spec:
|
||||
forceRegenerate: false
|
||||
fields:
|
||||
- fieldName: "KEY"
|
||||
length: "32"
|
||||
- fieldName: "SECRET"
|
||||
length: "32"
|
||||
- fieldName: "ADMIN_PASSWORD"
|
||||
length: "16"
|
||||
EOF
|
||||
}
|
||||
|
||||
resource "kubectl_manifest" "directus_pvc" {
|
||||
count = var.extentions.directus.enable ? 1:0
|
||||
yaml_body = <<-EOF
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: "${var.component}-${var.instance}-directus"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.common-labels)}
|
||||
spec:
|
||||
accessModes:
|
||||
- "${var.storage.accessMode}"
|
||||
resources:
|
||||
requests:
|
||||
storage: "${var.storage.size}"
|
||||
volumeMode: "${var.storage.type}"
|
||||
EOF
|
||||
}
|
||||
|
||||
|
||||
resource "kubectl_manifest" "directus_deploy" {
|
||||
count = var.extentions.directus.enable ? 1:0
|
||||
yaml_body = <<EOF
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: "${var.component}-${var.instance}-directus"
|
||||
namespace: "${var.namespace}"
|
||||
labels: ${jsonencode(local.directus-labels)}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels: ${jsonencode(local.directus-labels)}
|
||||
template:
|
||||
metadata:
|
||||
labels: ${jsonencode(local.directus-labels)}
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
runAsGroup: 1000
|
||||
runAsUser: 1000
|
||||
restartPolicy: Always
|
||||
containers:
|
||||
- name: directus
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
env:
|
||||
- name: AUTH_VYNIL_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: "client-id"
|
||||
name: "directus-${var.instance}-id"
|
||||
- name: AUTH_VYNIL_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: "client-secret"
|
||||
name: "directus-${var.instance}-id"
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: username
|
||||
name: "${var.instance}-${var.component}-app"
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: password
|
||||
name: "${var.instance}-${var.component}-app"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: "${var.component}-${var.instance}-directus"
|
||||
- configMapRef:
|
||||
name: "${var.component}-${var.instance}-directus"
|
||||
image: "${var.extentions.directus.image.registry}/${var.extentions.directus.image.repository}:${var.extentions.directus.image.tag}"
|
||||
imagePullPolicy: "${var.extentions.directus.image.pullPolicy}"
|
||||
ports:
|
||||
- containerPort: 8055
|
||||
name: http
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
volumeMounts:
|
||||
- name: store
|
||||
mountPath: /var/store
|
||||
volumes:
|
||||
- name: store
|
||||
persistentVolumeClaim:
|
||||
claimName: "${var.component}-${var.instance}-directus"
|
||||
EOF
|
||||
}
|
||||
|
||||
module "directus-service" {
|
||||
count = var.extentions.directus.enable ? 1 : 0
|
||||
source = "/dist/modules/service"
|
||||
component = "directus"
|
||||
instance = var.instance
|
||||
namespace = var.namespace
|
||||
labels = local.directus-labels
|
||||
target = "http"
|
||||
port = local.directus-service.port.number
|
||||
providers = {
|
||||
kubectl = kubectl
|
||||
}
|
||||
}
|
||||
|
||||
module "directus-ingress" {
|
||||
count = var.extentions.directus.enable ? 1 : 0
|
||||
source = "/dist/modules/ingress"
|
||||
component = "directus"
|
||||
instance = var.instance
|
||||
namespace = var.namespace
|
||||
issuer = var.issuer
|
||||
ingress-class = var.ingress-class
|
||||
labels = local.directus-labels
|
||||
dns-names = [local.directus-dns-name]
|
||||
create-redirect = true
|
||||
middlewares = []
|
||||
service = local.directus-service
|
||||
providers = {
|
||||
kubectl = kubectl
|
||||
}
|
||||
}
|
||||
|
||||
module "directus-oauth2" {
|
||||
count = var.extentions.directus.enable ? 1 : 0
|
||||
source = "/dist/modules/oauth2"
|
||||
component = "directus"
|
||||
instance = var.instance
|
||||
namespace = var.namespace
|
||||
labels = local.directus-labels
|
||||
dns-name = local.directus-dns-name
|
||||
redirect-path = ""
|
||||
providers = {
|
||||
kubernetes = kubernetes
|
||||
kubectl = kubectl
|
||||
authentik = authentik
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user