diff --git a/apps/taiga/taiga_ConfigMap.tf b/apps/taiga/taiga_ConfigMap.tf index 38e1ebd..adefa16 100644 --- a/apps/taiga/taiga_ConfigMap.tf +++ b/apps/taiga/taiga_ConfigMap.tf @@ -98,6 +98,10 @@ resource "kubectl_manifest" "cm_scripts" { set -euo pipefail python manage.py migrate python manage.py loaddata initial_project_templates + if [ -f /etc/local-ca/ca.crt ];then + cp /etc/local-ca/ca.crt /usr/local/share/ca-certificates/ + /usr/sbin/update-ca-certificates + fi chown -R taiga:taiga /taiga-back sed -i "s/taiga-events-rabbitmq/{ os.getenv('TAIGA_EVENTS_RABBITMQ_HOST') }/;s/taiga-async-rabbitmq/{ os.getenv('TAIGA_ASYNC_RABBITMQ_HOST') }/" /taiga-back/settings/config.py echo Starting Taiga API... @@ -113,6 +117,10 @@ resource "kubectl_manifest" "cm_scripts" { #!/usr/bin/env bash set -euo pipefail chown -R taiga:taiga /taiga-back + if [ -f /etc/local-ca/ca.crt ];then + cp /etc/local-ca/ca.crt /usr/local/share/ca-certificates/ + /usr/sbin/update-ca-certificates + fi sed -i "s/taiga-events-rabbitmq/{ os.getenv('TAIGA_EVENTS_RABBITMQ_HOST') }/;s/taiga-async-rabbitmq/{ os.getenv('TAIGA_ASYNC_RABBITMQ_HOST') }/" /taiga-back/settings/config.py echo Starting Celery... exec gosu taiga celery -A taiga.celery worker -B \ diff --git a/apps/taiga/taiga_workload.tf b/apps/taiga/taiga_workload.tf index da8191b..6beeffd 100644 --- a/apps/taiga/taiga_workload.tf +++ b/apps/taiga/taiga_workload.tf @@ -187,7 +187,7 @@ resource "kubectl_manifest" "Deployment_taiga-back" { namespace: ${var.namespace} annotations: configmap.reloader.stakater.com/reload: "${kubectl_manifest.cm_env_back.name},${kubectl_manifest.cm_scripts.name},${kubectl_manifest.cm_nginx.name}" - secret.reloader.stakater.com/reload: "${kubectl_manifest.rabbit_user_secret.name},${module.oauth2.secret_client_id_name},${var.instance}-${var.component}-pg-app,${kubectl_manifest.secret.name}" + secret.reloader.stakater.com/reload: "${kubectl_manifest.rabbit_user_secret.name},${module.oauth2.secret_client_id_name},${module.ingress.secret_name},${var.instance}-${var.component}-pg-app,${kubectl_manifest.secret.name}" spec: selector: matchLabels: ${jsonencode(local.back_labels)} @@ -249,6 +249,9 @@ resource "kubectl_manifest" "Deployment_taiga-back" { - name: data mountPath: /taiga-back/media subPath: media + - name: certs + mountPath: /etc/local-ca + readOnly: true livenessProbe: httpGet: path: /api/v1/ @@ -302,6 +305,8 @@ resource "kubectl_manifest" "Deployment_taiga-back" { - name: data mountPath: /taiga-back/media subPath: media + - name: certs + mountPath: /opt/certs - name: nginx image: "${var.images.nginx.registry}/${var.images.nginx.repository}:${var.images.nginx.tag}" imagePullPolicy: ${var.images.nginx.pull_policy} @@ -318,6 +323,10 @@ resource "kubectl_manifest" "Deployment_taiga-back" { - name: taiga-conf mountPath: /etc/nginx/conf.d/ volumes: + - name: certs + secret: + secretName: "${module.ingress.secret_name}" + defaultMode: 0444 - name: scripts configMap: name: ${kubectl_manifest.cm_scripts.name}