151 lines
4.3 KiB
HCL
151 lines
4.3 KiB
HCL
locals {
|
|
needKnownHost = var.haveGitea && (length(local.sorted-stages)>0 || var.haveTekton)
|
|
needDeploy = var.haveGitea && length(local.sorted-stages)>0
|
|
gitea_host = "http://gitea-http.${var.domain}-ci.svc:3000/"
|
|
gitea_username = data.kubernetes_secret_v1.gitea.data["username"]
|
|
gitea_password = data.kubernetes_secret_v1.gitea.data["password"]
|
|
ci-user-password = random_password.password.result
|
|
}
|
|
|
|
data "kubernetes_secret_v1" "gitea-cert" {
|
|
metadata {
|
|
name = "gitea-cert"
|
|
namespace = "${var.domain}-ci"
|
|
}
|
|
}
|
|
|
|
data "kubernetes_secret_v1" "gitea" {
|
|
metadata {
|
|
name = "gitea-admin-user"
|
|
namespace = "${var.domain}-ci"
|
|
}
|
|
}
|
|
|
|
data "kubernetes_ingress_v1" "gitea" {
|
|
metadata {
|
|
name = "gitea"
|
|
namespace = "${var.domain}-ci"
|
|
}
|
|
}
|
|
|
|
data "kubernetes_service" "gitea-ssh" {
|
|
metadata {
|
|
name = "gitea-ssh"
|
|
namespace = "${var.domain}-ci"
|
|
}
|
|
}
|
|
|
|
resource "null_resource" "get_known" {
|
|
count = local.needKnownHost?1:0
|
|
triggers = { always_run = "${timestamp()}" }
|
|
provisioner "local-exec" {
|
|
command = "ssh-keyscan -p ${data.kubernetes_service.gitea-ssh.spec.0.port.0.port} ${var.gitea-ssh-domain!=""?var.gitea-ssh-domain:data.kubernetes_ingress_v1.gitea.spec[0].rule[0].host} > ${path.module}/known_host.txt"
|
|
}
|
|
}
|
|
|
|
data "local_file" "known_host" {
|
|
count = local.needKnownHost?1:0
|
|
filename = "${path.module}/known_host.txt"
|
|
depends_on = [null_resource.get_known]
|
|
}
|
|
|
|
resource "kubectl_manifest" "ssh-creds" {
|
|
depends_on = [kubernetes_namespace_v1.ns]
|
|
count = var.haveGitea?length(local.sorted-stages):0
|
|
yaml_body = <<-EOF
|
|
apiVersion: "secretgenerator.mittwald.de/v1alpha1"
|
|
kind: "SSHKeyPair"
|
|
metadata:
|
|
name: "ssh-credentials"
|
|
namespace: "${local.sorted-stages[count.index].namespace}"
|
|
labels: ${jsonencode(local.common_labels)}
|
|
spec:
|
|
length: "4096"
|
|
forceRegenerate: false
|
|
data:
|
|
known_hosts: "${data.local_file.known_host[0].content}"
|
|
EOF
|
|
lifecycle {
|
|
ignore_changes = [
|
|
yaml_body,
|
|
]
|
|
}
|
|
}
|
|
|
|
data "kubernetes_secret_v1" "ssh-creds-read" {
|
|
depends_on = [kubectl_manifest.ssh-creds]
|
|
count = var.haveGitea?length(local.sorted-stages):0
|
|
metadata {
|
|
name = "ssh-credentials"
|
|
namespace = "${local.sorted-stages[count.index].namespace}"
|
|
}
|
|
}
|
|
|
|
resource "random_password" "password" {
|
|
length = 16
|
|
special = true
|
|
override_special = "!#$%&*()-_=+[]{}<>:?"
|
|
}
|
|
|
|
resource "gitea_user" "user-ci" {
|
|
count = local.needKnownHost?1:0
|
|
username = "${var.instance}-ci"
|
|
login_name = "${var.instance}-ci"
|
|
password = local.ci-user-password
|
|
email = "${var.instance}-ci@${var.domain_name}"
|
|
active = true
|
|
admin = false
|
|
allow_create_organization = false
|
|
must_change_password = false
|
|
force_password_change = false
|
|
send_notification = false
|
|
visibility = "limited"
|
|
}
|
|
|
|
resource "gitea_public_key" "user-ci-keys" {
|
|
count = var.haveGitea?length(local.sorted-stages):0
|
|
title = "Stage ${local.sorted-stages[count.index].name} for organisation ${var.instance}"
|
|
username = gitea_user.user-ci[0].username
|
|
key = data.kubernetes_secret_v1.ssh-creds-read[count.index].data["ssh-publickey"]
|
|
}
|
|
|
|
resource "gitea_org" "orga" {
|
|
count = var.haveGitea?1:0
|
|
name = "${trimprefix(var.instance,"org-")}"
|
|
}
|
|
|
|
resource "gitea_repository" "deploy" {
|
|
count = local.needKnownHost?1:0
|
|
username = gitea_org.orga[0].name
|
|
name = "deploy"
|
|
private = true
|
|
}
|
|
|
|
resource "gitea_team" "cd-team" {
|
|
count = local.needKnownHost?1:0
|
|
name = "Deployment"
|
|
organisation = gitea_org.orga[0].name
|
|
description = "Deployment"
|
|
permission = "write"
|
|
members = [gitea_user.user-ci[0].username]
|
|
include_all_repositories = false
|
|
repositories = local.needKnownHost?[gitea_repository.deploy[0].name]:[]
|
|
}
|
|
|
|
resource "gitea_team" "ci-team" {
|
|
count = local.needKnownHost?1:0
|
|
name = "Automation"
|
|
organisation = gitea_org.orga[0].name
|
|
description = "Automation"
|
|
permission = "read"
|
|
members = [gitea_user.user-ci[0].username]
|
|
}
|
|
|
|
resource "gitea_team" "dev-team" {
|
|
count = var.haveGitea?1:0
|
|
name = "Devs"
|
|
organisation = gitea_org.orga[0].name
|
|
description = "Dev Team"
|
|
permission = "write"
|
|
}
|