Optimize service port definition

application/application.tf

@@ -1,9 +1,43 @@
 locals {
   app_slug   = "${var.instance}${var.component == "" ? "" : "-"}${var.component}"
+  application_labels = merge(var.labels, {
+    "app.kubernetes.io/component" = "authentik-application"
+  })
   app_name   = var.app_name != "" ? var.app_name : var.component == var.instance ? var.instance : format("%s-%s", var.instance, var.component)
   main_group = format("app-%s", local.app_slug)
+  secret_name = var.cert_name != "" ? var.cert_name : "${local.app_slug}-cert"
   url_icon   = startswith(var.icon, "fa-") ? "fa://${var.icon}" : format("https://%s/%s", var.dns_name, var.icon)
+  rules_icons = [{
+    "host" = var.rule_mapper.host
+    "http" = {
+      "paths" = [for mapper in var.rule_mapper.paths : {
+        "path"     = "/${var.icon}"
+        "pathType" = "Prefix"
+        "backend"  = mapper.backend
+      }]
+    }
+  }]
 }
+
+resource "kubectl_manifest" "ingress_icon" {
+  count = startswith(var.icon, "fa-") ? 0 : 1
+  force_conflicts = true
+  yaml_body       = <<-EOF
+    apiVersion: "networking.k8s.io/v1"
+    kind: "Ingress"
+    metadata:
+      name: "${local.app_slug}-icons"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.application_labels)}
+    spec:
+      ingressClassName: "${var.ingress_class}"
+      rules: ${jsonencode(local.rules_icons)}
+      tls:
+      - hosts: ${jsonencode([var.dns_name])}
+        secretName: "${local.secret_name}"
+  EOF
+}
+
 data "authentik_group" "akadmin" {
   name = "authentik Admins"
 }

application/providers.tf

@@ -1,5 +1,9 @@
 terraform {
   required_providers {
+    kubectl = {
+      source  = "gavinbunney/kubectl"
+      version = "~> 1.14.0"
+    }
     authentik = {
       source  = "goauthentik/authentik"
       version = "~> 2023.5.0"

application/variables.tf

@@ -30,3 +30,46 @@ variable "backchannel_providers" {
   type    = list(number)
   default = null
 }
+
+variable "ingress_class" {
+  type    = string
+  default = ""
+}
+
+variable "rule_mapper" {
+  type = object({
+    host = string
+    paths = list(object({
+      path = optional(string)
+      type = optional(string)
+      backend = object({
+        service = object({
+          name = string
+          port = object({
+            name = string
+          })
+        })
+      })
+    }))
+  })
+  default = {
+    host="not.defined"
+    paths= []
+  }
+}
+
+variable "cert_name" {
+  type        = string
+  default     = ""
+  description = "Give a secret name for tls, if empty will use the ingress cert_name"
+}
+
+variable "namespace" {
+  type = string
+  default = ""
+}
+
+variable "labels" {
+  type = map(string)
+  default = {}
+}