vynil/kydah-modules
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refacto and add modules

Browse Source
This commit is contained in:
Xavier Mortelette
2024-02-06 11:03:20 +01:00
parent 140321f714
commit 1e1cedcaeb
47 changed files with 685 additions and 360 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
oauth2/oauth2.tf
View File

@@ -1,10 +1,10 @@
locals {
app_slug = "${var.instance}${var.component==""?"":"-"}${var.component}"
app_slug = "${var.instance}${var.component == "" ? "" : "-"}${var.component}"
oauth2_labels = merge(var.labels, {
"app.kubernetes.io/component" = "authentik-oauth2"
})
}
resource "kubectl_manifest" "oauth2-secret" {
resource "kubectl_manifest" "oauth2_secret" {
ignore_fields = ["metadata.annotations"]
yaml_body = <<-EOF
apiVersion: "secretgenerator.mittwald.de/v1alpha1"
@@ -20,12 +20,12 @@ resource "kubectl_manifest" "oauth2-secret" {
length: "32"
EOF
}
data "kubernetes_secret_v1" "oauth2-client-id" {
depends_on = [kubectl_manifest.oauth2-secret]
data "kubernetes_secret_v1" "oauth2_client_id" {
depends_on = [kubectl_manifest.oauth2_secret]
metadata {
name = kubectl_manifest.oauth2-secret.name
name = kubectl_manifest.oauth2_secret.name
namespace = var.namespace
labels = local.oauth2_labels
labels = local.oauth2_labels
}
}
@@ -40,18 +40,18 @@ data "authentik_scope_mapping" "oauth2" {
"goauthentik.io/providers/oauth2/scope-profile"
]
}
data "authentik_flow" "default-authorization-flow" {
data "authentik_flow" "default_authorization_flow" {
slug = "default-provider-authorization-implicit-consent"
}
data "authentik_flow" "default-authentication-flow" {
data "authentik_flow" "default_authentication_flow" {
slug = "default-authentication-flow"
}
resource "authentik_provider_oauth2" "oauth2" {
name = "${local.app_slug}"
client_id = data.kubernetes_secret_v1.oauth2-client-id.data["client-id"]
authentication_flow = data.authentik_flow.default-authentication-flow.id
authorization_flow = data.authentik_flow.default-authorization-flow.id
name = local.app_slug
client_id = data.kubernetes_secret_v1.oauth2_client_id.data["client-id"]
authentication_flow = data.authentik_flow.default_authentication_flow.id
authorization_flow = data.authentik_flow.default_authorization_flow.id
client_type = "confidential"
sub_mode = "user_username"
signing_key = data.authentik_certificate_key_pair.ca.id
@@ -61,7 +61,7 @@ resource "authentik_provider_oauth2" "oauth2" {
]
}
resource "kubernetes_secret_v1" "oauth2-client-secret" {
resource "kubernetes_secret_v1" "oauth2_client_secret" {
metadata {
name = "${local.app_slug}-secret"
namespace = var.namespace
@@ -72,10 +72,10 @@ resource "kubernetes_secret_v1" "oauth2-client-secret" {
}
}
data "kubernetes_secret_v1" "oauth2-client-secret" {
depends_on = [kubernetes_secret_v1.oauth2-client-secret]
data "kubernetes_secret_v1" "oauth2_client_secret" {
depends_on = [kubernetes_secret_v1.oauth2_client_secret]
metadata {
name = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
name = kubernetes_secret_v1.oauth2_client_secret.metadata[0].name
namespace = var.namespace
}
}

10
oauth2/outputs.tf
View File

@@ -1,4 +1,4 @@
output "provider-id" {
output "provider_id" {
value = authentik_provider_oauth2.oauth2.id
}
@@ -18,17 +18,17 @@ output "sso_token_url" {
value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/token/"
}
output "client_id" {
value = data.kubernetes_secret_v1.oauth2-client-id.data["client-id"]
value = data.kubernetes_secret_v1.oauth2_client_id.data["client-id"]
}
output "client_secret" {
value = data.kubernetes_secret_v1.oauth2-client-secret.data["client-secret"]
value = data.kubernetes_secret_v1.oauth2_client_secret.data["client-secret"]
}
output "secret_client_id_name" {
value = kubectl_manifest.oauth2-secret.name
value = kubectl_manifest.oauth2_secret.name
}
output "secret_client_secret_name" {
value = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
value = kubernetes_secret_v1.oauth2_client_secret.metadata[0].name
}
output "secret_client_id_key" {
value = "client-id"

12
oauth2/providers.tf
View File

@@ -2,16 +2,16 @@
terraform {
required_providers {
kubernetes = {
source = "hashicorp/kubernetes"
version = "~> 2.20.0"
source = "hashicorp/kubernetes"
version = "~> 2.20.0"
}
kubectl = {
source = "gavinbunney/kubectl"
version = "~> 1.14.0"
source = "gavinbunney/kubectl"
version = "~> 1.14.0"
}
authentik = {
source = "goauthentik/authentik"
version = "~> 2023.5.0"
source = "goauthentik/authentik"
version = "~> 2023.5.0"
}
}
}