1 Commits

Author SHA1 Message Date
9b53fa3eac Refacto and add lb 2024-01-24 15:29:36 +01:00
29 changed files with 7 additions and 723 deletions

View File

@@ -1,5 +1,5 @@
locals {
app_name = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
app_name = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
main_group = format("app-%s", local.app_name)
}
data "authentik_group" "akadmin" {
@@ -12,7 +12,7 @@ resource "authentik_group" "groups" {
resource "authentik_group" "subgroup" {
count = length(var.sub_groups)
name = format("%s-%s", local.main_group, var.sub_groups[count.index])
name = format("%s-%s", local.app_name, var.sub_groups[count.index])
parent = authentik_group.groups.id
}

View File

@@ -5,6 +5,3 @@ output "application-id" {
output "policy-id" {
value = authentik_policy_expression.policy.id
}
output "main_group" {
value = local.main_group
}

View File

@@ -17,6 +17,9 @@ variable "protocol_provider" {
variable "dns_name" {
type = string
}
variable "app_name" {
type = string
}
variable "sub_groups" {
type = list(string)
default = []

View File

@@ -1,42 +0,0 @@
locals {
app_slug = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
}
resource "kubectl_manifest" "backup_schedule" {
count = var.backups.enable ? 1 : 0
yaml_body = <<-EOF
apiVersion: k8up.io/v1
kind: Schedule
metadata:
name: "${var.app_slug}-backup"
namespace: "${var.namespace}"
labels: ${jsonencode(local.labels)}
spec:
backend:
repoPasswordSecretRef:
key: "${var.backups.restic_key}"
name: "${var.backups.secret_name}"
s3:
accessKeyIDSecretRef:
key: "${var.backups.key_id_key}"
name: "${var.backups.secret_name}"
bucket: "${var.app_slug}-${var.namespace}"
endpoint: "${var.backups.endpoint}/restic"
secretAccessKeySecretRef:
key: "${var.backups.secret_key}"
name: "${var.backups.secret-name}"
backup:
schedule: "${var.backups.schedule.backup}"
failedJobsHistoryLimit: 2
successfulJobsHistoryLimit: 2
check:
schedule: "${var.backups.schedule.check}"
prune:
retention:
keepDaily: ${var.backups.retention.keepDaily}
keepMonthly: ${var.backups.retention.keepMonthly}
keepWeekly: ${var.backups.retention.keepWeekly}
keepYearly: ${var.backups.retention.keepYearly}
schedule: "${var.backups.schedule.prune}"
EOF
}

View File

@@ -1,3 +0,0 @@
output "schedule_name" {
value = kubectl_manifest.backup_schedule.name
}

View File

@@ -1,8 +0,0 @@
terraform {
required_providers {
kubectl = {
source = "gavinbunney/kubectl"
version = "~> 1.14.0"
}
}
}

View File

@@ -1,55 +0,0 @@
variable "component" {
type = string
}
variable "instance" {
type = string
}
variable "namespace" {
type = string
}
variable "labels" {
type = map(string)
}
variable "backups" {
default = {
"enable" = false
"endpoint" = ""
"key_id_key" = "s3-id"
"restic_key" = "bck-password"
"retention" = {
"keepDaily" = 14
"keepMonthly" = 12
"keepWeekly" = 6
"keepYearly" = 12
}
"schedule" = {
"backup" = "30 3 * * *"
"check" = "30 5 * * 1"
"db" = "30 3 * * *"
"prune" = "30 1 * * 0"
}
"secret_key" = "s3-secret"
"secret_name" = "backup-settings"
"use_barman" = false
}
type = object({
enable = optional(bool),
endpoint = optional(string),
key_id_key = optional(string),
restic_key = optional(string),
retention = optional(object({
keepDaily = optional(number),
keepMonthly = optional(number),
keepWeekly = optional(number),
keepYearly = optional(number)
})),
schedule = optional(object({
backup = optional(string),
check = optional(string),
prune = optional(string)
})),
secret_key = optional(string),
secret_name = optional(string),
use_barman = optional(bool)
})
}

View File

@@ -74,7 +74,7 @@ resource "restapi_object" "forward_outpost_binding" {
resource "kubectl_manifest" "prj_middleware" {
yaml_body = <<-EOF
apiVersion: traefik.io/v1alpha1
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: "${local.app_slug}-forward"

View File

@@ -58,7 +58,7 @@ resource "kubectl_manifest" "prj_certificate" {
resource "kubectl_manifest" "prj_https_redirect" {
count = var.create_redirect || var.component == "" ? 1 : 0
yaml_body = <<-EOF
apiVersion: "traefik.io/v1alpha1"
apiVersion: "traefik.containo.us/v1alpha1"
kind: "Middleware"
metadata:
name: "${local.app_slug}-https"

View File

@@ -1,3 +0,0 @@
output "secret_name" {
value = var.create_cert ? "${local.app_slug}-cert":""
}

View File

@@ -1,126 +0,0 @@
locals {
app_slug = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
mongo-password = data.kubernetes_secret_v1.prj_mongo_secret.data["password"]
username = var.username==""?var.component==""?var.instance:var.component:var.username
db_name = var.db_name==""?var.component==""?var.instance:var.component:var.db_name
mongo-labels = merge(var.labels, {
"app.kubernetes.io/component" = "mongo"
})
}
resource "kubectl_manifest" "prj_mongo_secret" {
ignore_fields = ["metadata.annotations"]
yaml_body = <<-EOF
apiVersion: "secretgenerator.mittwald.de/v1alpha1"
kind: "StringSecret"
metadata:
name: "${local.app_slug}-mongo"
namespace: "${var.namespace}"
labels: ${jsonencode(local.mongo-labels)}
spec:
forceRegenerate: false
fields:
- fieldName: "password"
length: "16"
EOF
}
data "kubernetes_secret_v1" "prj_mongo_secret" {
depends_on = [ kubectl_manifest.prj_mongo_secret ]
metadata {
name = "${local.app_slug}-mongo"
namespace = var.namespace
}
}
resource "kubectl_manifest" "prj_mongo" {
yaml_body = <<-EOF
apiVersion: mongodbcommunity.mongodb.com/v1
kind: MongoDBCommunity
metadata:
name: "${local.app_slug}-mongo"
namespace: "${var.namespace}"
labels: ${jsonencode(local.mongo-labels)}
spec:
members: 1
type: ${var.mongo_type}
version: "${var.mongo_version}"
statefulSet:
spec:
template:
metadata:
annotations:
"k8up.io/backupcommand": "sh -c 'mongodump --username=$MONGODB_USER --password=$MONGODB_PASSWORD mongodb://localhost/$MONGODB_NAME --archive'"
"k8up.io/file-extension": ".archive"
spec:
containers:
- name: mongod
imagePullPolicy: "${var.pullPolicy}"
resources: ${jsonencode(var.resources)}
env:
- name: MONGODB_NAME
value: ${local.db_name}
- name: MONGODB_USER
value: ${local.username}
- name: MONGODB_PASSWORD
valueFrom:
secretKeyRef:
name: "${local.app_slug}-mongo"
key: password
security:
authentication:
modes: ["SCRAM"]
additionalMongodConfig:
storage.wiredTiger.engineConfig.cacheSizeGB: 1
users:
- name: ${local.username}
db: ${local.db_name}
passwordSecretRef:
name: "${local.app_slug}-mongo"
roles:
- db: ${local.db_name}
name: readWrite
scramCredentialsSecretName: "${local.app_slug}-mongo-scram"
EOF
}
resource "kubectl_manifest" "prj_mongo_sa" {
yaml_body = <<-EOF
apiVersion: v1
kind: ServiceAccount
metadata:
name: "mongodb-database"
namespace: "${var.namespace}"
labels: ${jsonencode(local.mongo-labels)}
EOF
}
resource "kubectl_manifest" "prj_mongo_role" {
yaml_body = <<-EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: "mongodb-database"
namespace: "${var.namespace}"
labels: ${jsonencode(local.mongo-labels)}
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get"]
- apiGroups: [""]
resources: ["pods"]
verbs: ["patch", "delete", "get"]
EOF
}
resource "kubectl_manifest" "prj_mongo_rb" {
yaml_body = <<-EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: "mongodb-database"
namespace: "${var.namespace}"
labels: ${jsonencode(local.mongo-labels)}
subjects:
- kind: ServiceAccount
name: mongodb-database
roleRef:
kind: Role
name: mongodb-database
apiGroup: rbac.authorization.k8s.io
EOF
}

View File

@@ -1,21 +0,0 @@
output "url" {
value = "mongodb://${local.username}:${local.mongo-password}@${local.app_slug}-mongo-svc.${var.namespace}.svc:27017/${local.db_name}"
}
output "service" {
value = "${local.app_slug}-mongo-svc.${var.namespace}.svc"
}
output "password" {
value = local.mongo-password
}
output "username" {
value = local.username
}
output "db_name" {
value = local.db_name
}
output "secret" {
value = {
name = "${local.app_slug}-mongo"
key = "password"
}
}

View File

@@ -1,8 +0,0 @@
terraform {
required_providers {
kubectl = {
source = "gavinbunney/kubectl"
version = "~> 1.14.0"
}
}
}

View File

@@ -1,55 +0,0 @@
variable "component" {
type = string
}
variable "instance" {
type = string
}
variable "namespace" {
type = string
}
variable "labels" {
type = map(string)
}
variable "db_name" {
type = string
default = ""
}
variable "username" {
type = string
default = ""
}
variable "mongo_version" {
type = string
default = "6.0.13"
}
variable "mongo_type" {
type = string
default = "ReplicaSet"
}
variable "pullPolicy" {
type = string
default = "IfNotPresent"
}
variable "resources" {
type = object({
limits = optional(object({
cpu = string
memory = string
}))
requests = optional(object({
cpu = string
memory = string
}))
})
default = {
limits = {
cpu = "1"
memory = "1100M"
}
requests = {
cpu = "0.3"
memory = "400M"
}
}
}

View File

@@ -72,14 +72,6 @@ resource "kubernetes_secret_v1" "oauth2-client-secret" {
}
}
data "kubernetes_secret_v1" "oauth2-client-secret" {
depends_on = [kubernetes_secret_v1.oauth2-client-secret]
metadata {
name = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
namespace = var.namespace
}
}
data "kubernetes_ingress_v1" "authentik" {
metadata {
name = "authentik"

View File

@@ -2,37 +2,6 @@ output "provider-id" {
value = authentik_provider_oauth2.oauth2.id
}
output "sso_signout_url" {
value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${var.component}-${var.instance}/end-session/"
}
output "sso_configuration_url" {
value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${local.app_slug}/"
}
output "sso_userinfo_url" {
value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/userinfo/"
}
output "sso_authorize_url" {
value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/authorize/"
}
output "sso_token_url" {
value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/token/"
}
output "client_id" {
value = data.kubernetes_secret_v1.oauth2-client-id.data["client-id"]
}
output "client_secret" {
value = data.kubernetes_secret_v1.oauth2-client-secret.data["client-secret"]
}
output "secret_client_id_name" {
value = kubectl_manifest.oauth2-secret.name
}
output "secret_client_secret_name" {
value = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
}
output "secret_client_id_key" {
value = "client-id"
}
output "secret_client_secret_key" {
value = "client-secret"
}

View File

@@ -1,3 +0,0 @@
output "host" {
value = "${var.app_slug}-redis.${var.namespace}.svc"
}

View File

@@ -1,87 +0,0 @@
locals {
app_slug = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
pg-labels = merge(local.labels, {
"app.kubernetes.io/component" = "pg"
})
pool-labels = merge(local.labels, {
"app.kubernetes.io/component" = "pg-pool"
})
}
resource "kubectl_manifest" "prj_pg" {
yaml_body = join("", concat([<<-EOF
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: "${local.app_slug}-pg"
namespace: "${var.namespace}"
labels: ${jsonencode(local.pg-labels)}
annotations:
"k8up.io/backupcommand": "pg_dump -U postgres -d ${var.component} --clean"
"k8up.io/file-extension": ".sql"
spec:
instances: ${var.replicas}
imageName: "${var.images.postgresql.registry}/${var.images.postgresql.repository}:${var.images.postgresql.tag}"
storage:
size: "${var.storage.size}"
bootstrap:
initdb:
database: "${var.component}"
owner: "${var.component}"
monitoring:
enablePodMonitor: true
EOF
], var.backups.enable&&var.backups.use_barman?[<<-EOF
backup:
barmanObjectStore:
destinationPath: "s3://${var.app_slug}-${var.namespace}/"
endpointURL: "${var.backups.endpoint}/barman"
s3Credentials:
accessKeyId:
name: "${var.backups.secret_name}"
key: "${var.backups.key_id_key}"
secretAccessKey:
name: "${var.backups.secret_name}"
key: "${var.backups.secret_key}"
EOF
]:[""]))
}
resource "kubectl_manifest" "prj_pg_backup" {
count = var.backups.enable ? 1:0
yaml_body = <<-EOF
apiVersion: postgresql.cnpg.io/v1
kind: ScheduledBackup
metadata:
name: "${local.app_slug}-pg"
namespace: "${var.namespace}"
labels: ${jsonencode(local.pg-labels)}
spec:
schedule: "${var.backups.schedule.db}"
backupOwnerReference: self
cluster:
name: "${local.app_slug}-pg"
EOF
}
resource "kubectl_manifest" "prj_pg_pool" {
depends_on = [kubectl_manifest.prj_pg]
yaml_body = <<-EOF
apiVersion: postgresql.cnpg.io/v1
kind: Pooler
metadata:
name: "${local.app_slug}-pool"
namespace: "${var.namespace}"
labels: ${jsonencode(local.pool-labels)}
spec:
cluster:
name: "${local.app_slug}-pg"
instances: 1
type: rw
pgbouncer:
poolMode: session
parameters:
max_client_conn: "1000"
default_pool_size: "10"
EOF
}

View File

@@ -1,8 +0,0 @@
terraform {
required_providers {
kubectl = {
source = "gavinbunney/kubectl"
version = "~> 1.14.0"
}
}
}

View File

@@ -1,63 +0,0 @@
variable "component" {
type = string
}
variable "instance" {
type = string
}
variable "namespace" {
type = string
}
variable "labels" {
type = map(string)
}
variable "backups" {
default = {
"enable" = false
"endpoint" = ""
"key_id_key" = "s3-id"
"restic_key" = "bck-password"
"schedule" = {
"db" = "30 3 * * *"
}
"secret_key" = "s3-secret"
"secret_name" = "backup-settings"
"use_barman" = false
}
type = object({
enable = optional(bool),
endpoint = optional(string),
key_id_key = optional(string),
restic_key = optional(string),
schedule = optional(object({
db = optional(string),
})),
secret_key = optional(string),
secret_name = optional(string),
use_barman = optional(bool)
})
}
variable "images" {
type = object({
postgresql = optional(object({registry = optional(string), repository = optional(string), tag = optional(number)})),
})
default = {
"postgresql" = {
"registry" = "ghcr.io"
"repository" = "cloudnative-pg/postgresql"
"tag" = 15.3
}
}
}
variable "replicas" {
type = number
default = 1
}
variable "storage" {
type = object({
size = optional(string)
})
default = {
"size" = "5Gi"
}
}

View File

@@ -1,3 +0,0 @@
output "name" {
value = local.app_slug
}

View File

@@ -1,8 +0,0 @@
terraform {
required_providers {
kubectl = {
source = "gavinbunney/kubectl"
version = "~> 1.14.0"
}
}
}

View File

@@ -1,27 +0,0 @@
locals {
app_slug = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
pvc_spec = merge({
"accessModes" = [var.storage.accessMode]
"volumeMode" = var.storage.type
"resources" = {
"requests" = {
"storage" = "${var.storage.size}"
}
}
}, var.storage.volume.class != "" ?{
"storageClassName" = var.storage.class
}:{})
}
resource "kubectl_manifest" "pvc" {
yaml_body = <<-EOF
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: ${local.app_slug}
namespace: "${var.namespace}"
annotations:
k8up.io/backup: "true"
labels: ${jsonencode(local.labels)}
spec: ${jsonencode(local.pvc_spec)}
EOF
}

View File

@@ -1,26 +0,0 @@
variable "component" {
type = string
}
variable "instance" {
type = string
}
variable "namespace" {
type = string
}
variable "labels" {
type = map(string)
}
variable "storage" {
type = object({
accessMode = optional(string),
class = optional(string),
size = optional(string),
type = optional(string)
})
default = {
"accessMode" = "ReadWriteOnce"
"class" = ""
"size" = "10Gi"
"type" = "Filesystem"
}
}

View File

@@ -1,6 +0,0 @@
output "host" {
value = "${local.app_slug}-redis.${var.namespace}.svc"
}
output "url" {
value = "redis://${local.app_slug}-redis.${var.namespace}.svc:6379"
}

View File

@@ -1,8 +0,0 @@
terraform {
required_providers {
kubectl = {
source = "gavinbunney/kubectl"
version = "~> 1.14.0"
}
}
}

View File

@@ -1,41 +0,0 @@
locals {
app_slug = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
redis-labels = merge(var.labels, {
"app.kubernetes.io/component" = "redis"
})
cfg = merge({
"image" = "${var.images.redis.registry}/${var.images.redis.repository}:${var.images.redis.tag}"
"imagePullPolicy" = "${var.images.redis.pullPolicy}"
},lookup(var.password, "enabled", false)?{
redisSecret = {
name = lookup(var.password, "name", var.component)
key = lookup(var.password, "key", "redis-password")
}
}:{})
}
resource "kubectl_manifest" "redis" {
yaml_body = <<-EOF
apiVersion: "redis.redis.opstreelabs.in/v1beta1"
kind: "Redis"
metadata:
name: "${local.app_slug}-redis"
namespace: "${var.namespace}"
labels: ${jsonencode(local.redis-labels)}
spec:
kubernetesConfig: ${jsonencode(local.cfg)}
storage:
volumeClaimTemplate:
spec:
accessModes: ["ReadWriteOnce"]
resources:
requests:
storage: "${var.storage.size}"
redisExporter:
enabled: ${var.exporter.enabled}
image: "${var.images.redis_exporter.registry}/${var.images.redis_exporter.repository}:${var.images.redis_exporter.tag}"
securityContext:
runAsUser: 1000
fsGroup: 1000
EOF
}

View File

@@ -1,65 +0,0 @@
variable "component" {
type = string
}
variable "instance" {
type = string
}
variable "namespace" {
type = string
}
variable "labels" {
type = map(string)
}
variable "annotations" {
type = map(string)
default = {}
}
variable "images" {
type = object({
redis = optional(object({pullPolicy = optional(string), registry = optional(string), repository = optional(string), tag = optional(string)})),
redis_exporter = optional(object({pullPolicy = optional(string), registry = optional(string), repository = optional(string), tag = optional(string)}))
})
default = {
"redis" = {
"pullPolicy" = "IfNotPresent"
"registry" = "quay.io"
"repository" = "opstree/redis"
"tag" = "v7.0.12"
}
"redis_exporter" = {
"pullPolicy" = "IfNotPresent"
"registry" = "quay.io"
"repository" = "opstree/redis-exporter"
"tag" = "v1.44.0"
}
}
}
variable "exporter" {
type = object({
enabled = optional(bool)
})
default = {
"enabled" = true
}
}
variable "password" {
type = object({
enabled = optional(bool),
name = optional(string),
key = optional(string)
})
default = {
"enabled" = false
"name" = ""
"key" = ""
}
}
variable "storage" {
type = object({
size = optional(string)
})
default = {
"size" = "2Gi"
}
}

View File

@@ -1,11 +0,0 @@
output "name" {
value = "${local.app_slug}"
}
output "default_definition" {
value = {
"name" = "${local.app_slug}"
"port" = {
"number" = var.ports[0]
}
}
}