Refacto OAuth2

application/application.tf

@@ -1,26 +1,28 @@
 locals {
-  app_slug   = "${var.instance}${var.component == "" ? "" : "-"}${var.component}"
+  app_slug = "${var.instance}${var.component == "" ? "" : "-"}${var.component}"
   application_labels = merge(var.labels, {
     "app.kubernetes.io/component" = "authentik-application"
   })
-  app_name   = var.app_name != "" ? var.app_name : var.component == var.instance ? var.instance : format("%s-%s", var.instance, var.component)
-  main_group = format("app-%s", local.app_slug)
+  app_name    = var.app_name != "" ? var.app_name : var.component == var.instance ? var.instance : format("%s-%s", var.instance, var.component)
+  main_group  = format("app-%s", local.app_slug)
   secret_name = var.cert_name != "" ? var.cert_name : "${local.app_slug}-cert"
-  url_icon   = startswith(var.icon, "fa-") ? "fa://${var.icon}" : format("https://%s/%s", var.dns_name, var.icon)
+  dns_name    = var.dns_name != "" ? var.dns_name : var.rule_mapper.host
+  url_icon    = startswith(var.icon, "fa-") ? "fa://${var.icon}" : format("https://%s/%s", local.dns_name, var.icon)
+  backend     = var.rule_mapper.paths[0].backend
   rules_icons = [{
-    "host" = var.rule_mapper.host
+    "host" = local.dns_name
     "http" = {
-      "paths" = [for mapper in var.rule_mapper.paths : {
+      "paths" = [{
         "path"     = "/${var.icon}"
         "pathType" = "Prefix"
-        "backend"  = mapper.backend
+        "backend"  = local.backend
       }]
     }
   }]
 }
 
 resource "kubectl_manifest" "ingress_icon" {
-  count = startswith(var.icon, "fa-") ? 0 : 1
+  count           = startswith(var.icon, "fa-") ? 0 : 1
   force_conflicts = true
   yaml_body       = <<-EOF
     apiVersion: "networking.k8s.io/v1"
@@ -33,8 +35,8 @@ resource "kubectl_manifest" "ingress_icon" {
       ingressClassName: "${var.ingress_class}"
       rules: ${jsonencode(local.rules_icons)}
       tls:
-      - hosts: ${jsonencode([var.dns_name])}
-        secretName: "${local.secret_name}"
+      - secretName: "${local.secret_name}"
+        hosts: ${jsonencode([local.dns_name])}
   EOF
 }
 
@@ -58,7 +60,7 @@ resource "authentik_application" "app" {
   group                 = var.app_group
   protocol_provider     = var.protocol_provider
   backchannel_providers = var.backchannel_providers
-  meta_launch_url       = format("https://%s", var.dns_name)
+  meta_launch_url       = format("https://%s", local.dns_name)
   meta_icon             = local.url_icon
 }
 

application/outputs.tf

@@ -5,6 +5,11 @@ output "application_id" {
 output "policy_id" {
   value = authentik_policy_expression.policy.id
 }
+
 output "main_group" {
   value = local.main_group
 }
+
+output "main_group_id" {
+  value = authentik_group.groups.id
+}

application/variables.tf

@@ -15,7 +15,9 @@ variable "protocol_provider" {
   default = null
 }
 variable "dns_name" {
-  type = string
+  type        = string
+  description = "Deprecated, use rule_mapper"
+  default = ""
 }
 variable "app_name" {
   type    = string
@@ -33,7 +35,7 @@ variable "backchannel_providers" {
 
 variable "ingress_class" {
   type    = string
-  default = ""
+  default = "traefik"
 }
 
 variable "rule_mapper" {
@@ -53,8 +55,8 @@ variable "rule_mapper" {
     }))
   })
   default = {
-    host="not.defined"
-    paths= []
+    host  = "not.defined"
+    paths = []
   }
 }
 
@@ -65,11 +67,11 @@ variable "cert_name" {
 }
 
 variable "namespace" {
-  type = string
+  type    = string
   default = ""
 }
 
 variable "labels" {
-  type = map(string)
+  type    = map(string)
   default = {}
 }

oauth2/oauth2.tf

@@ -4,9 +4,10 @@ locals {
     "app.kubernetes.io/component" = "authentik-oauth2"
   })
 }
+
 resource "random_password" "client_id" {
-  length           = 32
-  special          = false
+  length  = 32
+  special = false
 }
 
 data "authentik_certificate_key_pair" "ca" {
@@ -30,8 +31,8 @@ data "authentik_flow" "default_authentication_flow" {
 resource "authentik_provider_oauth2" "oauth2" {
   name                = local.app_slug
   client_id           = random_password.client_id.result
-  authentication_flow = data.authentik_flow.default-authentication-flow.id
-  authorization_flow  = data.authentik_flow.default-authorization-flow.id
+  authentication_flow = data.authentik_flow.default_authentication_flow.id
+  authorization_flow  = data.authentik_flow.default_authorization_flow.id
   client_type         = "confidential"
   sub_mode            = "user_username"
   signing_key         = data.authentik_certificate_key_pair.ca.id
@@ -41,40 +42,22 @@ resource "authentik_provider_oauth2" "oauth2" {
   ]
 }
 
-resource "kubernetes_secret_v1" "oauth2-client-id" {
-  metadata {
-    name      = "${local.app_slug}-id"
-    namespace = var.namespace
-    labels    = local.oauth2_labels
-  }
-  data = {
-    client-id = random_password.client_id.result
-  }
-}
-
-resource "kubernetes_secret_v1" "oauth2-client-secret" {
-  metadata {
-    name      = "${local.app_slug}-secret"
-    namespace = var.namespace
-    labels    = local.oauth2_labels
-  }
-  data = {
-    client-id = random_password.client_id.result
-    client-secret = authentik_provider_oauth2.oauth2.client_secret
-  }
-}
-
-data "kubernetes_secret_v1" "oauth2_client_secret" {
-  depends_on = [kubernetes_secret_v1.oauth2_client_secret]
-  metadata {
-    name      = kubernetes_secret_v1.oauth2_client_secret.metadata[0].name
-    namespace = var.namespace
-  }
-}
-
 data "kubernetes_ingress_v1" "authentik" {
   metadata {
     name      = "authentik"
     namespace = "${var.domain}-auth"
   }
 }
+
+resource "kubernetes_secret" "oauth2_client_secret" {
+  metadata {
+    name      = "${local.app_slug}-oauth2"
+    namespace = var.namespace
+    labels    = local.oauth2_labels
+  }
+  data = {
+    oidc_endpoint = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${local.app_slug}/"
+    client_id     = random_password.client_id.result
+    client_secret = authentik_provider_oauth2.oauth2.client_secret
+  }
+}

oauth2/outputs.tf

@@ -5,34 +5,32 @@ output "provider_id" {
 output "sso_signout_url" {
   value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${var.component}-${var.instance}/end-session/"
 }
+
 output "sso_configuration_url" {
   value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${local.app_slug}/"
 }
+
 output "sso_userinfo_url" {
   value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/userinfo/"
 }
+
 output "sso_authorize_url" {
   value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/authorize/"
 }
+
 output "sso_token_url" {
   value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/token/"
 }
+
 output "client_id" {
   value = random_password.client_id.result
 }
+
 output "client_secret" {
   value = authentik_provider_oauth2.oauth2.client_secret
 }
 
-output "secret_client_id_name" {
-  value = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
-}
-output "secret_client_secret_name" {
-  value = kubernetes_secret_v1.oauth2_client_secret.metadata[0].name
-}
-output "secret_client_id_key" {
-  value = "client-id"
-}
-output "secret_client_secret_key" {
-  value = "client-secret"
+output "oauth2_secret_name" {
+  value = kubernetes_secret.oauth2_client_secret.metadata[0].name
 }
+

service/svc.tf

@@ -1,11 +1,10 @@
 locals {
-  selector = var.selector==null?var.labels:var.selector
-  app_slug = "${var.instance}${var.component==""?"":"-"}${var.component}"
-  cluster_ports = var.svc_type == "ClusterIP" ? [for idx, target in var.targets : {
-    "name"       = target
-    "port"       = var.ports[idx]
-    "protocol"   = var.protocols[idx]
-    "targetPort" = target
+  app_slug = "${var.instance}${var.component == "" ? "" : "-"}${var.component}"
+  default_ports = var.svc_type != "NodePort" ? [for port_map in var.port_mapper : {
+    "name"       = port_map.name != null && port_map.name != "" ? port_map.name : "${port_map.port}-${port_map.protocol}"
+    "port"       = port_map.port
+    "protocol"   = port_map.protocol
+    "targetPort" = port_map.target
   }] : []
   node_ports = var.svc_type == "NodePort" ? [for port_map in var.port_mapper : {
     "port"       = port_map.port
@@ -24,9 +23,10 @@ locals {
   )
   spec = {
     "ClusterIP" = {
-      type     = "ClusterIP"
-      ports    = local.cluster_ports
-      selector = local.selector
+      type           = "ClusterIP"
+      ports          = local.default_ports
+      selector       = var.labels
+      ipFamilyPolicy = var.ip_family
     },
     "ExternalName" = {
       type         = "ExternalName"
@@ -34,14 +34,15 @@ locals {
       ports        = local.default_ports
     },
     "NodePort" = {
-      type     = "NodePort"
-      selector = local.selector
-      ports    = local.node_ports
+      type           = "NodePort"
+      selector       = var.labels
+      ports          = local.node_ports
+      ipFamilyPolicy = var.ip_family
     },
     "LoadBalancer" = {
-      type     = "LoadBalancer"
-      selector = local.selector
-      ports    = local.lb_ports
+      type                  = "LoadBalancer"
+      selector              = var.labels
+      ports                 = local.default_ports
       externalTrafficPolicy = var.lb_policy
       ipFamilyPolicy        = var.ip_family
     }

service/variables.tf

@@ -10,10 +10,6 @@ variable "namespace" {
 variable "labels" {
   type = map(string)
 }
-variable "selector" {
-  type = map(string)
-  default = null
-}
 variable "annotations" {
   type    = map(string)
   default = {}