fix

2023-10-18 16:57:40 +02:00
parent 9b172c24ae
commit 8661e6bef9
15 changed files with 520 additions and 180 deletions
--- a/apps/dbgate/application.tf
+++ b/apps/dbgate/application.tf
@@ -1,39 +1,46 @@
 locals {
-  app-name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
-  main-group = format("app-%s", local.app-name)
-}
-data "authentik_group" "akadmin" {
-  name = "authentik Admins"
-}
-resource "authentik_group" "groups" {
-  name         = local.main-group
-  attributes   = jsonencode({"${local.app-name}" = true})
+    dns-name = "${var.sub-domain}.${var.domain-name}"
+    dns-names = [local.dns-name]
 }

-resource "authentik_application" "prj_app" {
-  name              = "${var.instance}"
-  slug              = "${var.component}-${var.instance}"
-  group             = var.app-group
-  protocol_provider = authentik_provider_oauth2.oauth2.id
-  meta_launch_url   = format("https://%s.%s", var.sub-domain, var.domain-name)
-  meta_icon         = format("https://%s.%s/%s", var.sub-domain, var.domain-name, "logo192.png")
+module "ingress" {
+  source = "../../modules/ingress"
+  "component"         = var.component
+  "instance"          = var.instance
+  "namespace"         = var.namespace
+  "issuer"            = var.issuer
+  "ingress-class"     = var.ingress-class
+  "labels"            = local.common-labels
+  "dns-names"         = local.dns-names
 }

-resource "authentik_policy_expression" "policy" {
-  name       = local.main-group
-  expression = <<-EOF
-    attr = request.user.group_attributes()
-    return attr['${local.app-name}'] if '${local.app-name}' in attr else False
-  EOF
+module "application" {
+  source = "../../modules/application"
+  "component"         = var.component
+  "instance"          = var.instance
+  "app-group"         = var.app-group
+  "sub-domain"        = var.sub-domain
+  "domain-name"       = var.domain-name
+  "icon"              = "logo192.png"
+  "protocol_provider" = var.use-oauth?module.oauth2.provider-id:module.forward.provider-id
 }

-resource "authentik_policy_binding" "prj_access_users" {
-  target = authentik_application.prj_app.uuid
-  policy = authentik_policy_expression.policy.id
-  order  = 0
+module "oauth2" {
+  count  = var.use-oauth?1:0
+  source = "../../modules/oauth2"
+  "component"         = var.component
+  "instance"          = var.instance
 }
-resource "authentik_policy_binding" "prj_access_vynil" {
-  target = authentik_application.prj_app.uuid
-  group  = data.authentik_group.akadmin.id
-  order  = 1
+
+module "forward" {
+  count  = var.use-oauth?0:1
+  source = "../../modules/forward"
+  "component"         = var.component
+  "instance"          = var.instance
+  "domain"            = var.domain
+  "namespace"         = var.namespace
+  "ingress-class"     = var.ingress-class
+  "labels"            = local.common-labels
+  "dns-names"         = local.dns-names
+  "authentik-token"   = data.kubernetes_secret_v1.authentik.data["AUTHENTIK_BOOTSTRAP_TOKEN"]
 }
--- a/apps/dbgate/configs.tf
+++ b/apps/dbgate/configs.tf
@@ -51,27 +51,6 @@ locals {
  connection_secrets = merge(local.pg_secrets,local.mongo_secrets)
 }

-
-resource "kubectl_manifest" "dbgate-init" {
-  yaml_body  = <<-EOF
-    apiVersion: v1
-    kind: ConfigMap
-    metadata:
-      name: "${var.component}-${var.instance}-init"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.common-labels)}
-    data:
-      start.sh: |-
-        if [ -e /etc/local-ca/ca.crt ];then
-          cp /etc/local-ca/ca.crt /usr/local/share/ca-certificates/
-          update-ca-certificates
-        fi
-        exec /bin/su node -c /home/dbgate-docker/entrypoint.sh "$@"
-  EOF
-}
-
-
-
 resource "kubectl_manifest" "dbgate-config" {
  yaml_body  = <<-EOF
    apiVersion: v1
--- a/apps/dbgate/deploy.tf
+++ b/apps/dbgate/deploy.tf
@@ -1,3 +1,7 @@
+locals {
+   deploy-envs = merge({},
+}
+
 resource "kubectl_manifest" "deploy" {
  yaml_body  = <<-EOF
    apiVersion: apps/v1
--- a/apps/dbgate/index.yaml
+++ b/apps/dbgate/index.yaml
@@ -6,117 +6,12 @@ metadata:
  name: dbgate
  description: null
 options:
-  mongo:
-    default: []
-    examples:
-    - []
-    items:
-      properties:
-        dbname:
-          default: ''
-          type: string
-        name:
-          default: ''
-          type: string
-        namespace:
-          default: ''
-          type: string
-        secret:
-          properties:
-            key:
-              default: ''
-              type: string
-            name:
-              default: ''
-              type: string
-          type: object
-        username:
-          default: ''
-          type: string
-      type: object
-    type: array
  issuer:
    default: letsencrypt-prod
    examples:
    - letsencrypt-prod
    type: string
-  ingress-class:
-    default: traefik
-    examples:
-    - traefik
-    type: string
-  storage:
-    default:
-      accessMode: ReadWriteOnce
-      size: 1Gi
-      type: Filesystem
-    examples:
-    - accessMode: ReadWriteOnce
-      size: 1Gi
-      type: Filesystem
-    properties:
-      accessMode:
-        default: ReadWriteOnce
-        enum:
-        - ReadWriteOnce
-        - ReadOnlyMany
-        - ReadWriteMany
-        type: string
-      size:
-        default: 1Gi
-        type: string
-      type:
-        default: Filesystem
-        enum:
-        - Filesystem
-        - Block
-        type: string
-    type: object
-  pg:
-    default: []
-    examples:
-    - []
-    items:
-      properties:
-        dbname:
-          default: ''
-          type: string
-        name:
-          default: ''
-          type: string
-        namespace:
-          default: ''
-          type: string
-        secret:
-          properties:
-            key:
-              default: ''
-              type: string
-            name:
-              default: ''
-              type: string
-          type: object
-        username:
-          default: ''
-          type: string
-      type: object
-    type: array
-  domain-name:
-    default: your_company.com
-    examples:
-    - your_company.com
-    type: string
-  sub-domain:
-    default: dbgate
-    examples:
-    - dbgate
-    type: string
-  domain:
-    default: your-company
-    examples:
-    - your-company
-    type: string
-  maria:
+  mongo:
    default: []
    examples:
    - []
@@ -151,20 +46,20 @@ options:
        pullPolicy: IfNotPresent
        registry: docker.io
        repository: dbgate/dbgate
-        tag: 5.2.7
+        tag: 5.2.7-alpine
    examples:
    - dbgate:
        pullPolicy: IfNotPresent
        registry: docker.io
        repository: dbgate/dbgate
-        tag: 5.2.7
+        tag: 5.2.7-alpine
    properties:
      dbgate:
        default:
          pullPolicy: IfNotPresent
          registry: docker.io
          repository: dbgate/dbgate
-          tag: 5.2.7
+          tag: 5.2.7-alpine
        properties:
          pullPolicy:
            default: IfNotPresent
@@ -180,10 +75,120 @@ options:
            default: dbgate/dbgate
            type: string
          tag:
-            default: 5.2.7
+            default: 5.2.7-alpine
            type: string
        type: object
    type: object
+  sub-domain:
+    default: dbgate
+    examples:
+    - dbgate
+    type: string
+  use-oauth:
+    default: false
+    examples:
+    - false
+    type: boolean
+  domain:
+    default: your-company
+    examples:
+    - your-company
+    type: string
+  ingress-class:
+    default: traefik
+    examples:
+    - traefik
+    type: string
+  pg:
+    default: []
+    examples:
+    - []
+    items:
+      properties:
+        dbname:
+          default: ''
+          type: string
+        name:
+          default: ''
+          type: string
+        namespace:
+          default: ''
+          type: string
+        secret:
+          properties:
+            key:
+              default: ''
+              type: string
+            name:
+              default: ''
+              type: string
+          type: object
+        username:
+          default: ''
+          type: string
+      type: object
+    type: array
+  maria:
+    default: []
+    examples:
+    - []
+    items:
+      properties:
+        dbname:
+          default: ''
+          type: string
+        name:
+          default: ''
+          type: string
+        namespace:
+          default: ''
+          type: string
+        secret:
+          properties:
+            key:
+              default: ''
+              type: string
+            name:
+              default: ''
+              type: string
+          type: object
+        username:
+          default: ''
+          type: string
+      type: object
+    type: array
+  storage:
+    default:
+      accessMode: ReadWriteOnce
+      size: 1Gi
+      type: Filesystem
+    examples:
+    - accessMode: ReadWriteOnce
+      size: 1Gi
+      type: Filesystem
+    properties:
+      accessMode:
+        default: ReadWriteOnce
+        enum:
+        - ReadWriteOnce
+        - ReadOnlyMany
+        - ReadWriteMany
+        type: string
+      size:
+        default: 1Gi
+        type: string
+      type:
+        default: Filesystem
+        enum:
+        - Filesystem
+        - Block
+        type: string
+    type: object
+  domain-name:
+    default: your_company.com
+    examples:
+    - your_company.com
+    type: string
  app-group:
    default: dev
    examples:
@@ -201,7 +206,7 @@ providers:
  authentik: true
  kubectl: true
  postgresql: null
-  restapi: null
-  http: null
+  restapi: true
+  http: true
  gitea: null
 tfaddtype: null
--- a/apps/dbgate/ingress.tf
+++ b/apps/dbgate/ingress.tf
@@ -1,77 +0,0 @@
-
-locals {
-    dns-name = "${var.sub-domain}.${var.domain-name}"
-    dns-names = [local.dns-name]
-    middlewares = ["${var.instance}-https"]
-    service = {
-      "name"  = "${var.component}-${var.instance}"
-      "port" = {
-        "number" = 80
-      }
-    }
-    rules = [ for v in local.dns-names : {
-      "host" = "${v}"
-      "http" = {
-        "paths" = [{
-          "backend"  = {
-            "service" = local.service
-          }
-          "path"     = "/"
-          "pathType" = "Prefix"
-        }]
-      }
-    }]
-}
-
-resource "kubectl_manifest" "prj_certificate" {
-  yaml_body  = <<-EOF
-    apiVersion: "cert-manager.io/v1"
-    kind: "Certificate"
-    metadata:
-      name: "${var.instance}"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.common-labels)}
-    spec:
-        secretName: "${var.instance}-cert"
-        dnsNames: ${jsonencode(local.dns-names)}
-        issuerRef:
-          name: "${var.issuer}"
-          kind: "ClusterIssuer"
-          group: "cert-manager.io"
-  EOF
-}
-
-resource "kubectl_manifest" "prj_https_redirect" {
-  yaml_body  = <<-EOF
-    apiVersion: "traefik.containo.us/v1alpha1"
-    kind: "Middleware"
-    metadata:
-      name: "${var.instance}-https"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.common-labels)}
-    spec:
-      redirectScheme:
-        scheme: "https"
-        permanent: true
-  EOF
-}
-
-resource "kubectl_manifest" "prj_ingress" {
-  force_conflicts = true
-  yaml_body  = <<-EOF
-    apiVersion: "networking.k8s.io/v1"
-    kind: "Ingress"
-    metadata:
-      name: "${var.instance}"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.common-labels)}
-      annotations:
-        "traefik.ingress.kubernetes.io/router.middlewares": "${join(",", [for m in local.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])}"
-    spec:
-      ingressClassName: "${var.ingress-class}"
-      rules: ${jsonencode(local.rules)}
-      tls:
-      - hosts: ${jsonencode(local.dns-names)}
-        secretName: "${var.instance}-cert"
-  EOF
-}
--- a/apps/dbgate/oauth2.tf
+++ b/apps/dbgate/oauth2.tf
@@ -1,4 +1,5 @@
 resource "kubectl_manifest" "oauth2-secret" {
+  count = var.use-oauth?1:0
  ignore_fields = ["metadata.annotations"]
  yaml_body  = <<-EOF
    apiVersion: "secretgenerator.mittwald.de/v1alpha1"
@@ -15,6 +16,7 @@ resource "kubectl_manifest" "oauth2-secret" {
  EOF
 }
 data "kubernetes_secret_v1" "oauth2-client-id" {
+  count = var.use-oauth?1:0
  depends_on = [kubectl_manifest.oauth2-secret]
  metadata {
    name = kubectl_manifest.oauth2-secret.name
@@ -41,6 +43,7 @@ data "authentik_flow" "default-authentication-flow" {
 }

 resource "authentik_provider_oauth2" "oauth2" {
+  count = var.use-oauth?1:0
  name                = "${var.component}-${var.instance}"
  client_id           = "${data.kubernetes_secret_v1.oauth2-client-id.data["client-id"]}"
  authentication_flow = data.authentik_flow.default-authentication-flow.id
@@ -55,6 +58,7 @@ resource "authentik_provider_oauth2" "oauth2" {
 }

 resource "kubernetes_secret_v1" "oauth2-client-secret" {
+  count = var.use-oauth?1:0
  metadata {
    name = "${var.component}-${var.instance}-secret"
    namespace = var.namespace