fix

modules/ingress/ingress.tf

@@ -19,11 +19,11 @@ resource "kubectl_manifest" "prj_certificate" {
     apiVersion: "cert-manager.io/v1"
     kind: "Certificate"
     metadata:
-      name: "${var.instance}"
+      name: "${var.instance}${var.component==""?:"":"-"}${var.component}"
       namespace: "${var.namespace}"
       labels: ${jsonencode(var.labels)}
     spec:
-        secretName: "${var.instance}-cert"
+        secretName: "${var.instance}${var.component==""?:"":"-"}${var.component}-cert"
         dnsNames: ${jsonencode(var.dns-names)}
         issuerRef:
           name: "${var.issuer}"
@@ -33,6 +33,7 @@ resource "kubectl_manifest" "prj_certificate" {
 }
 
 resource "kubectl_manifest" "prj_https_redirect" {
+  count = var.component==""?1:0
   yaml_body  = <<-EOF
     apiVersion: "traefik.containo.us/v1alpha1"
     kind: "Middleware"
@@ -53,16 +54,16 @@ resource "kubectl_manifest" "prj_ingress" {
     apiVersion: "networking.k8s.io/v1"
     kind: "Ingress"
     metadata:
-      name: "${var.instance}"
+      name: "${var.instance}${var.component==""?:"":"-"}${var.component}"
       namespace: "${var.namespace}"
       labels: ${jsonencode(var.labels)}
       annotations:
-        "traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in var.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])}"
+        "traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in concat(["${var.instance}-https"],var.middlewares) : format("%s-%s@kubernetescrd", var.namespace, m)])}"
     spec:
       ingressClassName: "${var.ingress-class}"
       rules: ${jsonencode(local.rules)}
       tls:
       - hosts: ${jsonencode(var.dns-names)}
-        secretName: "${var.instance}-cert"
+        secretName: "${var.instance}${var.component==""?:"":"-"}${var.component}-cert"
   EOF
 }

modules/ingress/variables.tf

@@ -22,7 +22,7 @@ variable "dns-names" {
 }
 variable "middlewares" {
   type        = list(string)
+  default     = []
 }
 variable "service" {
 }
-

modules/oauth2/oauth2.tf

@@ -50,7 +50,7 @@ resource "authentik_provider_oauth2" "oauth2" {
   signing_key         = data.authentik_certificate_key_pair.ca.id
   property_mappings   = data.authentik_scope_mapping.oauth2.ids
   redirect_uris       = [
-    "https://${var.dns-name}/"
+    "https://${var.dns-name}/${var.redirect-path}"
   ]
 }
 

modules/oauth2/variables.tf

@@ -13,3 +13,7 @@ variable "labels" {
 variable "dns-name" {
   type        = string
 }
+variable "redirect-path" {
+  type        = string
+  default     = ""
+}

modules/saml/outputs.tf

@@ -0,0 +1,3 @@
+output "provider-id" {
+  value       = authentik_provider_saml.prj.id
+}

modules/saml/providers.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    kubectl = {
+        source = "gavinbunney/kubectl"
+        version = "~> 1.14.0"
+    }
+    authentik = {
+        source = "goauthentik/authentik"
+        version = "~> 2023.5.0"
+    }
+  }
+}

modules/saml/saml.tf

@@ -0,0 +1,56 @@
+data "authentik_flow" "default-authorization-flow" {
+  slug = "default-provider-authorization-implicit-consent"
+}
+data "authentik_flow" "default-authentication-flow" {
+  slug = "default-authentication-flow"
+}
+
+data "authentik_property_mapping_saml" "saml_maps" {
+  managed_list = [
+      "goauthentik.io/providers/saml/email",
+      "goauthentik.io/providers/saml/groups",
+      "goauthentik.io/providers/saml/name",
+      "goauthentik.io/providers/saml/upn",
+      "goauthentik.io/providers/saml/uid",
+      "goauthentik.io/providers/saml/username",
+      "goauthentik.io/providers/saml/ms-windowsaccountname",
+  ]
+}
+
+data "authentik_property_mapping_saml" "saml_name" {
+  managed = "goauthentik.io/providers/saml/username"
+}
+
+data "authentik_certificate_key_pair" "generated" {
+  name = "authentik Self-signed Certificate"
+}
+
+resource "kubectl_manifest" "saml_certificate" {
+  yaml_body  = <<-EOF
+    apiVersion: "cert-manager.io/v1"
+    kind: "Certificate"
+    metadata:
+      name: "${var.instance}-${var.component}-saml"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(var.labels)}
+    spec:
+        secretName: "${var.instance}-${var.component}-saml"
+        dnsNames: ${jsonencode(var.dns-names)}
+        issuerRef:
+          name: "self-sign"
+          kind: "ClusterIssuer"
+          group: "cert-manager.io"
+  EOF
+}
+
+resource "authentik_provider_saml" "prj" {
+  name                = "${var.component}-${var.instance}-saml"
+  authentication_flow = data.authentik_flow.default-authentication-flow.id
+  authorization_flow  = data.authentik_flow.default-authorization-flow.id
+  acs_url             = "https://${var.dns-names[0]}/${var.acs-path}"
+  property_mappings   = data.authentik_property_mapping_saml.saml_maps.ids
+  name_id_mapping     = data.authentik_property_mapping_saml.saml_name.id
+  signing_kp          = data.authentik_certificate_key_pair.generated.id
+  sp_binding          = var.binding
+}
+

modules/saml/variables.tf

@@ -0,0 +1,19 @@
+variable "component" {
+  type        = string
+}
+variable "instance" {
+  type        = string
+}
+variable "dns-names" {
+  type        = list(string)
+}
+variable "acs-path" {
+  type        = string
+}
+variable "binding" {
+  type        = string
+  default     = "post"
+}
+variable "labels" {
+  type        = map(string)
+}