Refacto and add modules

.ci-img.yml

@@ -1,5 +0,0 @@
----
-lint:
-  image: ghcr.io/terraform-linters/tflint
-opentofu:
-  image: ghcr.io/opentofu/opentofu:latest

application/application.tf

@@ -1,45 +1,9 @@
 locals {
   app_slug   = "${var.instance}${var.component == "" ? "" : "-"}${var.component}"
-  application_labels = merge(var.labels, {
-    "app.kubernetes.io/component" = "authentik-application"
-  })
   app_name   = var.app_name != "" ? var.app_name : var.component == var.instance ? var.instance : format("%s-%s", var.instance, var.component)
   main_group = format("app-%s", local.app_slug)
-  secret_name = var.cert_name != "" ? var.cert_name : "${local.app_slug}-cert"
+  url_icon   = startswith(var.icon, "fa-") ? "fa://${var.icon}" : format("https://%s/%s", var.dns_name, var.icon)
-  dns_name    = var.dns_name != "" ? var.dns_name : var.rule_mapper.host
-  url_icon    = startswith(var.icon, "fa-") ? "fa://${var.icon}" : format("https://%s/%s", local.dns_name, var.icon)
-  backend     = var.rule_mapper.paths[0].backend
-  rules_icons = [{
-    "host" = local.dns_name
-    "http" = {
-      "paths" = [{
-        "path"     = "/${var.icon}"
-        "pathType" = "Prefix"
-        "backend"  = local.backend
-      }]
-    }
-  }]
 }
-
-resource "kubectl_manifest" "ingress_icon" {
-  count           = startswith(var.icon, "fa-") ? 0 : 1
-  force_conflicts = true
-  yaml_body       = <<-EOF
-    apiVersion: "networking.k8s.io/v1"
-    kind: "Ingress"
-    metadata:
-      name: "${local.app_slug}-icons"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.application_labels)}
-    spec:
-      ingressClassName: "${var.ingress_class}"
-      rules: ${jsonencode(local.rules_icons)}
-      tls:
-      - secretName: "${local.secret_name}"
-        hosts: ${jsonencode([local.dns_name])}
-  EOF
-}
-
 data "authentik_group" "akadmin" {
   name = "authentik Admins"
 }
@@ -60,7 +24,7 @@ resource "authentik_application" "app" {
   group                 = var.app_group
   protocol_provider     = var.protocol_provider
   backchannel_providers = var.backchannel_providers
-  meta_launch_url       = format("https://%s", local.dns_name)
+  meta_launch_url       = format("https://%s", var.dns_name)
   meta_icon             = local.url_icon
 }
 

application/outputs.tf

@@ -5,11 +5,6 @@ output "application_id" {
 output "policy_id" {
   value = authentik_policy_expression.policy.id
 }
-
 output "main_group" {
   value = local.main_group
 }
-
-output "main_group_id" {
-  value = authentik_group.groups.id
-}

application/providers.tf

@@ -1,9 +1,5 @@
 terraform {
   required_providers {
-    kubectl = {
-      source  = "gavinbunney/kubectl"
-      version = "~> 1.14.0"
-    }
     authentik = {
       source  = "goauthentik/authentik"
       version = "~> 2023.5.0"

application/variables.tf

@@ -16,8 +16,6 @@ variable "protocol_provider" {
 }
 variable "dns_name" {
   type = string
-  description = "Deprecated, use rule_mapper"
-  default = ""
 }
 variable "app_name" {
   type    = string
@@ -32,46 +30,3 @@ variable "backchannel_providers" {
   type    = list(number)
   default = null
 }
-
-variable "ingress_class" {
-  type    = string
-  default = "traefik"
-}
-
-variable "rule_mapper" {
-  type = object({
-    host = string
-    paths = list(object({
-      path = optional(string)
-      type = optional(string)
-      backend = object({
-        service = object({
-          name = string
-          port = object({
-            name = string
-          })
-        })
-      })
-    }))
-  })
-  default = {
-    host  = "not.defined"
-    paths = []
-  }
-}
-
-variable "cert_name" {
-  type        = string
-  default     = ""
-  description = "Give a secret name for tls, if empty will use the ingress cert_name"
-}
-
-variable "namespace" {
-  type    = string
-  default = ""
-}
-
-variable "labels" {
-  type    = map(string)
-  default = {}
-}

forward/forward.tf

@@ -3,10 +3,40 @@ locals {
   forward_labels = merge(var.labels, {
     "app.kubernetes.io/component" = "authentik-forward"
   })
-  external_url              = format("https://%s", var.dns_name)
+  main_group   = format("app-%s", var.app_name)
-  forward_outpost_results   = jsondecode(data.http.proxy_outpost.response_body).results
+  external_url = format("https://%s", var.dns_names[0])
-  forward_outpost_providers = local.forward_outpost_results[0].providers
+  rules_icons = [for v in var.dns_names : {
-  forward_outpost_pk        = local.forward_outpost_results[0].pk
+    "host" = "${v}"
+    "http" = {
+      "paths" = [{
+        "backend" = {
+          "service" = var.service
+        }
+        "path"     = "/${var.icon}"
+        "pathType" = "Prefix"
+      }]
+    }
+  }]
+  forward_outpost_providers = jsondecode(data.http.get_forward_outpost.response_body).results[0].providers
+  forward_outpost_pk        = jsondecode(data.http.get_forward_outpost.response_body).results[0].pk
+}
+
+resource "kubectl_manifest" "ingress_icon" {
+  force_conflicts = true
+  yaml_body       = <<-EOF
+    apiVersion: "networking.k8s.io/v1"
+    kind: "Ingress"
+    metadata:
+      name: "${local.app_slug}-icons"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.forward_labels)}
+    spec:
+      ingressClassName: "${var.ingress_class}"
+      rules: ${jsonencode(local.rules_icons)}
+      tls:
+      - hosts: ${jsonencode(var.dns_names)}
+        secretName: "${var.instance}-cert"
+  EOF
 }
 
 data "authentik_flow" "default_authorization_flow" {
@@ -21,9 +51,9 @@ resource "authentik_provider_proxy" "forward" {
   access_token_validity = var.access_token_validity
 }
 
-data "http" "proxy_outpost" {
+data "http" "get_forward_outpost" {
   depends_on      = [authentik_provider_proxy.forward]
-  url             = "http://authentik.${var.domain}-auth.svc/api/v3/outposts/instances/?name__iexact=${var.domain}-proxy-outpost"
+  url             = "http://authentik.${var.domain}-auth.svc/api/v3/outposts/instances/?name__iexact=forward"
   method          = "GET"
   request_headers = var.request_headers
   lifecycle {
@@ -34,66 +64,6 @@ data "http" "proxy_outpost" {
   }
 }
 
-data "kubernetes_ingress_v1" "authentik" {
-  metadata {
-    name      = "authentik"
-    namespace = "${var.domain}-auth"
-  }
-}
-
-## Begin modification
-data "kubernetes_secret_v1" "authentik" {
-  metadata {
-    name      = "authentik"
-    namespace = "${var.domain}-auth"
-  }
-}
-
-resource "authentik_service_connection_kubernetes" "local" {
-  # count      = length(jsondecode(data.http.proxy_outpost.response_body).results) == 0 ? 1 : 0
-  depends_on = [data.kubernetes_secret_v1.authentik]
-  name       = "${var.domain}-local-forward"
-  local      = true
-}
-
-# data "authentik_flow" "default_authorization_flow" {
-#   count      = length(local.forward_outpost_results) == 0 ? 1 : 0
-#   depends_on = [authentik_service_connection_kubernetes.local]
-#   slug       = "default-provider-authorization-implicit-consent"
-# }
-
-resource "authentik_provider_proxy" "provider_forward" {
-  # count              = length(jsondecode(data.http.proxy_outpost.response_body).results) == 0 ? 1 : 0
-  name               = "authentik-${var.domain}-forward-provider"
-  internal_host      = "http://authentik-authentik"
-  external_host      = "http://authentik-authentik"
-  authorization_flow = data.authentik_flow.default_authorization_flow.id
-}
-
-resource "authentik_outpost" "output_forward" {
-  # count              = length(jsondecode(data.http.proxy_outpost.response_body).results) == 0 ? 1 : 0
-  name               = "forward"
-  type               = "proxy"
-  service_connection = authentik_service_connection_kubernetes.local.id
-  config = jsonencode({
-    "log_level" : "info",
-    "authentik_host" : "http://authentik",
-    "docker_map_ports" : true,
-    "kubernetes_replicas" : 1,
-    "kubernetes_namespace" : var.namespace,
-    "authentik_host_browser" : "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}",
-    "object_naming_template" : "ak-outpost-%(name)s",
-    "authentik_host_insecure" : false,
-    "kubernetes_service_type" : "ClusterIP",
-    "kubernetes_image_pull_secrets" : [],
-    "kubernetes_disabled_components" : [],
-    "kubernetes_ingress_annotations" : {},
-    "kubernetes_ingress_secret_name" : var.ingress_certificat_secret_name
-  })
-  protocol_providers = local.forward_outpost_providers
-}
-## End modification
-
 resource "restapi_object" "forward_outpost_binding" {
   path = "/outposts/instances/${local.forward_outpost_pk}/"
   data = jsonencode({
@@ -128,3 +98,10 @@ resource "kubectl_manifest" "middleware" {
         - X-authentik-meta-version
   EOF
 }
+
+data "kubernetes_ingress_v1" "authentik" {
+  metadata {
+    name      = "authentik"
+    namespace = "${var.domain}-auth"
+  }
+}

forward/providers.tf

@@ -1,10 +1,5 @@
 terraform {
-  required_version = ">= 1.0"
   required_providers {
-    kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = "~> 2.20.0"
-    }
     kubectl = {
       source  = "gavinbunney/kubectl"
       version = "~> 1.14.0"

forward/variables.tf

@@ -18,19 +18,37 @@ variable "labels" {
   type = map(string)
 }
 
-variable "dns_name" {
+variable "ingress_class" {
   type = string
 }
 
+variable "icon" {
+  type = string
+}
+
+variable "dns_names" {
+  type = list(string)
+}
+
 variable "access_token_validity" {
   type    = string
   default = "hours=10" // ;minutes=10
 }
 
+variable "app_name" {
+  type    = string
+  default = ""
+}
+
+variable "service" {
+  type = object({
+    name = string
+    port = object({
+      number = number
+    })
+  })
+}
+
 variable "request_headers" {
   type = map(string)
 }
-
-variable "ingress_certificat_secret_name" {
-  type = string
-}

ingress/ingress.tf

@@ -4,22 +4,23 @@ locals {
   pres_labels = merge(var.labels, {
     "app.kubernetes.io/component" = "presentation"
   })
-  rules = [for rule in var.rules_mapper : {
+  rules = [for v in var.dns_names : {
-    "host" = rule.host
+    "host" = "${v}"
     "http" = {
-      "paths" = [for mapper in rule.paths : {
+      "paths" = [for mapper in var.services_mapping : {
         "path"     = "/${mapper.path}"
-        "pathType" = mapper.type != null && mapper.type != "" ? mapper.type : "Prefix"
+        "pathType" = "Prefix"
-        "backend"  = mapper.backend
+        "backend" = {
+          "service" = mapper.service
+        }
       }]
     }
   }]
-  dns_names   = [for rule in var.rules_mapper : rule.host]
   secret_name = var.cert_name != "" ? var.cert_name : "${local.app_slug}-cert"
   tls = var.entrypoint == "" || length(regexall(".*websecure.*", var.entrypoint)) > 0 ? [
     {
       secretName = local.secret_name
-      hosts      = local.dns_names
+      hosts      = var.dns_names
     }
   ] : []
   middlewares = concat(
@@ -31,7 +32,7 @@ locals {
       "traefik.ingress.kubernetes.io/router.entrypoints" = var.entrypoint
     } : {},
     length(local.middlewares) > 0 ? {
-      "traefik.ingress.kubernetes.io/router.middlewares" : join(",", [for m in local.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])
+      "traefik.ingress.kubernetes.io/router.middlewares" : "${join(",", [for m in local.middlewares : format("%s-%s@kubernetescrd", var.namespace, m)])}"
     } : {},
   )
 }
@@ -47,7 +48,7 @@ resource "kubectl_manifest" "certificate" {
       labels: ${jsonencode(local.pres_labels)}
     spec:
         secretName: "${local.secret_name}"
-        dnsNames: ${jsonencode(local.dns_names)}
+        dnsNames: ${jsonencode(var.dns_names)}
         issuerRef:
           kind: "ClusterIssuer"
           name: "${var.issuer}"

ingress/variables.tf

@@ -17,28 +17,24 @@ variable "ingress_class" {
 variable "labels" {
   type = map(string)
 }
+variable "dns_names" {
+  type = list(string)
+}
 variable "middlewares" {
   type    = list(string)
   default = []
 }
 
-variable "rules_mapper" {
+variable "services_mapping" {
   type = list(object({
-    host = string
-    paths = list(object({
     path = optional(string)
-      type = optional(string)
-      backend = object({
     service = object({
-          name = string
+      name= string
       port = object({
-            name = string
+        number = number
-          })
       })
     })
   }))
-  }))
-  description = "Simplified rules mapper for ingress"
 }
 
 variable "entrypoint" {

ldap/ldap.tf

@@ -30,7 +30,7 @@ data "authentik_group" "vynil_admin" {
 resource "authentik_group" "groups" {
   count      = length(local.sorted_groups)
   name       = local.sorted_groups[count.index].name
-  attributes = jsonencode({ local.app_name = true })
+  attributes = jsonencode({ "${local.app_name}" = true })
 }
 
 data "authentik_group" "readed_groups" {

oauth2/oauth2.tf

@@ -4,10 +4,29 @@ locals {
     "app.kubernetes.io/component" = "authentik-oauth2"
   })
 }
-
+resource "kubectl_manifest" "oauth2_secret" {
-resource "random_password" "client_id" {
+  ignore_fields = ["metadata.annotations"]
-  length  = 32
+  yaml_body     = <<-EOF
-  special = false
+    apiVersion: "secretgenerator.mittwald.de/v1alpha1"
+    kind: "StringSecret"
+    metadata:
+      name: "${local.app_slug}-id"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.oauth2_labels)}
+    spec:
+      forceRegenerate: false
+      fields:
+      - fieldName: "client-id"
+        length: "32"
+  EOF
+}
+data "kubernetes_secret_v1" "oauth2_client_id" {
+  depends_on = [kubectl_manifest.oauth2_secret]
+  metadata {
+    name      = kubectl_manifest.oauth2_secret.name
+    namespace = var.namespace
+    labels    = local.oauth2_labels
+  }
 }
 
 data "authentik_certificate_key_pair" "ca" {
@@ -30,7 +49,7 @@ data "authentik_flow" "default_authentication_flow" {
 
 resource "authentik_provider_oauth2" "oauth2" {
   name                = local.app_slug
-  client_id           = random_password.client_id.result
+  client_id           = data.kubernetes_secret_v1.oauth2_client_id.data["client-id"]
   authentication_flow = data.authentik_flow.default_authentication_flow.id
   authorization_flow  = data.authentik_flow.default_authorization_flow.id
   client_type         = "confidential"
@@ -38,26 +57,32 @@ resource "authentik_provider_oauth2" "oauth2" {
   signing_key         = data.authentik_certificate_key_pair.ca.id
   property_mappings   = data.authentik_scope_mapping.oauth2.ids
   redirect_uris = [
-    "https://${var.redirect_path != "" ? "${var.dns_name}/${var.redirect_path}" : var.dns_name}"
+    "https://${var.dns_name}/${var.redirect_path}"
   ]
 }
 
+resource "kubernetes_secret_v1" "oauth2_client_secret" {
+  metadata {
+    name      = "${local.app_slug}-secret"
+    namespace = var.namespace
+    labels    = local.oauth2_labels
+  }
+  data = {
+    client-secret = authentik_provider_oauth2.oauth2.client_secret
+  }
+}
+
+data "kubernetes_secret_v1" "oauth2_client_secret" {
+  depends_on = [kubernetes_secret_v1.oauth2_client_secret]
+  metadata {
+    name      = kubernetes_secret_v1.oauth2_client_secret.metadata[0].name
+    namespace = var.namespace
+  }
+}
+
 data "kubernetes_ingress_v1" "authentik" {
   metadata {
     name      = "authentik"
     namespace = "${var.domain}-auth"
   }
 }
-
-resource "kubernetes_secret" "oauth2_client_secret" {
-  metadata {
-    name      = "${local.app_slug}-oauth2"
-    namespace = var.namespace
-    labels    = local.oauth2_labels
-  }
-  data = {
-    oidc_endpoint = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${local.app_slug}/"
-    client_id     = random_password.client_id.result
-    client_secret = authentik_provider_oauth2.oauth2.client_secret
-  }
-}

oauth2/outputs.tf

@@ -5,32 +5,34 @@ output "provider_id" {
 output "sso_signout_url" {
   value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${var.component}-${var.instance}/end-session/"
 }
-
 output "sso_configuration_url" {
   value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${local.app_slug}/"
 }
-
 output "sso_userinfo_url" {
   value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/userinfo/"
 }
-
 output "sso_authorize_url" {
   value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/authorize/"
 }
-
 output "sso_token_url" {
   value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/token/"
 }
-
 output "client_id" {
-  value = random_password.client_id.result
+  value = data.kubernetes_secret_v1.oauth2_client_id.data["client-id"]
 }
-
 output "client_secret" {
-  value = authentik_provider_oauth2.oauth2.client_secret
+  value = data.kubernetes_secret_v1.oauth2_client_secret.data["client-secret"]
 }
 
-output "oauth2_secret_name" {
+output "secret_client_id_name" {
-  value = kubernetes_secret.oauth2_client_secret.metadata[0].name
+  value = kubectl_manifest.oauth2_secret.name
+}
+output "secret_client_secret_name" {
+  value = kubernetes_secret_v1.oauth2_client_secret.metadata[0].name
+}
+output "secret_client_id_key" {
+  value = "client-id"
+}
+output "secret_client_secret_key" {
+  value = "client-secret"
 }
-

pvc/pvc.tf

@@ -8,7 +8,7 @@ locals {
     "volumeMode"  = var.storage.type
     "resources" = {
       "requests" = {
-        "storage" = var.storage.size
+        "storage" = "${var.storage.size}"
       }
     }
     }, var.storage.class != "" ? {
@@ -16,7 +16,6 @@ locals {
   } : {})
 }
 resource "kubectl_manifest" "pvc" {
-  ignore_fields = ["spec.resources.requests.storage"]
   yaml_body = <<-EOF
     apiVersion: v1
     kind: PersistentVolumeClaim
@@ -25,7 +24,6 @@ resource "kubectl_manifest" "pvc" {
       namespace: "${var.namespace}"
       annotations:
         k8up.io/backup: "${var.backup}"
-        resize.kubesphere.io/storage_limit: "${var.storage.max_size}
       labels: ${jsonencode(local.pvc_labels)}
     spec: ${jsonencode(local.pvc_spec)}
   EOF

pvc/variables.tf

@@ -15,14 +15,12 @@ variable "storage" {
     access_mode = optional(string),
     class      = optional(string),
     size       = optional(string),
-    max_size    = optional(string),
     type       = optional(string)
   })
   default = {
     "access_mode" = "ReadWriteOnce"
     "class"      = ""
-    "size"        = "2Gi"
+    "size"       = "10Gi"
-    "max_size"    = "10Gi"
     "type"       = "Filesystem"
   }
 }

rabbitmq/outputs.tf

@@ -1,23 +0,0 @@
-output "conn_string" {
-  value = "mqtt://${urlencode(data.kubernetes_secret_v1.rabbit_secret.data["username"])}:${urlencode(data.kubernetes_secret_v1.rabbit_secret.data["password"])}@${local.app_slug}-mq.${var.namespace}.svc:1883"
-}
-
-output "service" {
-  value = "${local.app_slug}-mq.${var.namespace}.svc"
-}
-
-output "db_host" {
-  value = "${local.app_slug}-mq"
-}
-
-output "db_port" {
-  value = "1883"
-}
-
-output "cert_secret_name" {
-  value = local.secret_name
-}
-
-output "user_secret_name" {
-  value = "${local.app_slug}-user"
-}

rabbitmq/providers.tf

@@ -1,8 +0,0 @@
-terraform {
-  required_providers {
-    kubectl = {
-      source  = "gavinbunney/kubectl"
-      version = "~> 1.14.0"
-    }
-  }
-}

rabbitmq/rabbitmq.tf

@@ -1,101 +0,0 @@
-locals {
-  app_slug = "${var.instance}${var.component == "" ? "" : "-"}${var.component}"
-  rabbit_labels = merge(var.labels, {
-    "app.kubernetes.io/component" = "rabbitmq"
-  })
-  secret_name = var.cert_name != "" ? var.cert_name : "${local.app_slug}-cert"
-  pvc_spec = merge({
-    "storage" = var.storage.size
-    }, var.storage.class != "" ? {
-    "storageClassName" = var.storage.class
-  } : {})
-}
-
-resource "kubectl_manifest" "certificate" {
-  count     = var.cert_name == "" ? 1 : 0
-  yaml_body = <<-EOF
-    apiVersion: "cert-manager.io/v1"
-    kind: "Certificate"
-    metadata:
-      name: "${local.app_slug}"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.rabbit_labels)}
-    spec:
-        secretName: "${local.secret_name}"
-        dnsNames:
-        - "${local.app_slug}-mq.${var.namespace}.svc"
-        - "*.${local.app_slug}-mq-nodes.${var.namespace}.svc"
-        issuerRef:
-          kind: "ClusterIssuer"
-          name: "${var.issuer}"
-          group: "cert-manager.io"
-  EOF
-}
-
-resource "kubectl_manifest" "rabbit_secret" {
-  yaml_body = <<-EOF
-    apiVersion: "secretgenerator.mittwald.de/v1alpha1"
-    kind: "StringSecret"
-    metadata:
-      name: "${local.app_slug}-user"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.rabbit_labels)}
-    spec:
-      forceRegenerate: false
-      data:
-        username: "${var.instance}"
-        port: "5672"
-        host: "${local.app_slug}-mq.${var.namespace}.svc"
-      fields:
-      - fieldName: "password"
-        length: "32"
-  EOF
-}
-
-data "kubernetes_secret_v1" "rabbit_secret" {
-  depends_on = [kubectl_manifest.rabbit_secret]
-  metadata {
-    name      = "${local.app_slug}-user"
-    namespace = var.namespace
-    labels    = local.rabbit_labels
-  }
-}
-
-# based on https://github.com/rabbitmq/cluster-operator/tree/main/docs/examples
-
-resource "kubectl_manifest" "rabbitmq" {
-  depends_on = [
-    kubectl_manifest.certificate,
-    kubectl_manifest.rabbit_secret,
-    data.kubernetes_secret_v1.rabbit_secret,
-  ]
-  yaml_body = <<-EOF
-    apiVersion: rabbitmq.com/v1beta1
-    kind: RabbitmqCluster
-    metadata:
-      name: "${local.app_slug}-mq"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.rabbit_labels)}
-    spec:
-      replicas: ${var.replicas}
-      image: "${var.image.registry}/${var.image.repository}:${var.image.tag}"
-      imagePullPolicy: "${var.image.pull_policy}"
-      persistence: ${jsonencode(local.pvc_spec)}
-      resources: ${jsonencode(var.resources)}
-      tls:
-        secretName: ${local.secret_name}
-      rabbitmq:
-        erlangInetConfig: |
-          {inet6, true}.
-        envConfig: |
-            SERVER_ADDITIONAL_ERL_ARGS="-kernel inetrc '/etc/rabbitmq/erl_inetrc'  -proto_dist inet6_tcp"
-            RABBITMQ_CTL_ERL_ARGS="-proto_dist inet6_tcp"
-        additionalConfig: |
-          cluster_formation.k8s.host = kubernetes.default.svc.cluster.local
-          default_user=${data.kubernetes_secret_v1.rabbit_secret.data["username"]}
-          default_pass=${data.kubernetes_secret_v1.rabbit_secret.data["password"]}
-        additionalPlugins: ${jsonencode(var.plugins)}
-      service:
-        ipFamilyPolicy: "PreferDualStack"
-  EOF
-}

rabbitmq/variables.tf

@@ -1,78 +0,0 @@
-variable "component" {
-  type = string
-}
-variable "instance" {
-  type = string
-}
-variable "namespace" {
-  type = string
-}
-variable "labels" {
-  type = map(string)
-}
-variable "issuer" {
-  type = string
-}
-variable "replicas" {
-  type    = number
-  default = 1
-}
-variable "image" {
-  type = object({
-    registry    = optional(string),
-    repository  = optional(string),
-    tag         = optional(string),
-    pull_policy = optional(string)
-  })
-  description = "Image parameters"
-  default = {
-    "registry"    = "docker.io"
-    "repository"  = "rabbitmq"
-    "tag"         = "3.11.28-management-alpine"
-    "pull_policy" = "IfNotPresent"
-  }
-}
-variable "storage" {
-  description = "Storage parameters"
-  type = object({
-    class = optional(string),
-    size  = optional(string),
-  })
-  default = {
-    class = ""
-    size  = "1Gi"
-  }
-}
-variable "resources" {
-  description = "Resources parameters"
-  type = object({
-    requests = optional(object({
-      cpu    = optional(string),
-      memory = optional(string)
-    })),
-    limits = optional(object({
-      cpu    = optional(string),
-      memory = optional(string)
-    }))
-  })
-  default = {
-    requests = {
-      cpu    = "1000m",
-      memory = "2Gi"
-    },
-    limits = {
-      cpu    = "1000m",
-      memory = "2Gi"
-    }
-  }
-}
-variable "cert_name" {
-  type        = string
-  default     = ""
-  description = "Give a secret name for tls, if empty a new one will be created"
-}
-variable "plugins" {
-  description = "RabitMQ plugins"
-  type        = list(string)
-  default     = ["rabbitmq_mqtt", "rabbitmq_web_mqtt"]
-}

redis/outputs.tf

@@ -6,10 +6,6 @@ output "service" {
   value = "${local.app_slug}-redis.${var.namespace}.svc"
 }
 
-output "port" {
-  value = 6379
-}
-
 output "db_host" {
   value = "${local.app_slug}-redis"
 }

redis/redis.tf

@@ -5,7 +5,7 @@ locals {
   })
   cfg = merge({
     "image"           = "${var.images.redis.registry}/${var.images.redis.repository}:${var.images.redis.tag}"
-    "imagePullPolicy" = var.images.redis.pull_policy
+    "imagePullPolicy" = "${var.images.redis.pull_policy}"
     }, lookup(var.password, "enabled", false) ? {
     redisSecret = {
       name = lookup(var.password, "name", var.component)

redis/variables.tf

@@ -10,6 +10,10 @@ variable "namespace" {
 variable "labels" {
   type = map(string)
 }
+variable "annotations" {
+  type    = map(string)
+  default = {}
+}
 
 variable "images" {
   type = object({

saml/outputs.tf

@@ -1,11 +1,3 @@
-output "provider_id" {
+output "provider-id" {
   value = authentik_provider_saml.prj.id
 }
-
-output "metadata_url" {
-  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/api/v3/providers/saml/${authentik_provider_saml.prj.id}/metadata/?download"
-}
-
-output "saml_certificate_secret_name" {
-  value = "${local.app_slug}-saml"
-}

saml/providers.tf

@@ -1,10 +1,5 @@
 terraform {
-  required_version = ">= 1.0"
   required_providers {
-    kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = "~> 2.20.0"
-    }
     kubectl = {
       source  = "gavinbunney/kubectl"
       version = "~> 1.14.0"

saml/saml.tf

@@ -60,9 +60,3 @@ resource "authentik_provider_saml" "prj" {
   sp_binding          = var.binding
 }
 
-data "kubernetes_ingress_v1" "authentik" {
-  metadata {
-    name      = "authentik"
-    namespace = "${var.domain}-auth"
-  }
-}

saml/variables.tf

@@ -4,12 +4,6 @@ variable "component" {
 variable "instance" {
   type = string
 }
-variable "namespace" {
-  type = string
-}
-variable "domain" {
-  type = string
-}
 variable "issuer" {
   type = string
 }

service/outputs.tf

@@ -1,15 +1,11 @@
 output "name" {
   value = local.app_slug
 }
-output "ingress_backend_exposure" {
+output "default_definition" {
-  value = [for port_map in var.port_mapper :
+  value = {
-    {
+    "name" = "${local.app_slug}"
-      "service" = {
-        "name" = local.app_slug
     "port" = {
-          "name" = port_map.name
+      "number" = var.ports[0]
     }
   }
-    }
-  ]
 }

service/svc.tf

@@ -1,16 +1,26 @@
 locals {
   app_slug = "${var.instance}${var.component == "" ? "" : "-"}${var.component}"
-  selector = length(var.selector) > 0 ? var.selector : var.labels
+  cluster_ports = var.svc_type == "ClusterIP" ? [for idx, target in var.targets : {
-  default_ports = var.svc_type != "NodePort" ? [for port_map in var.port_mapper : {
+    "name"       = target
-    "name"       = lower(port_map.name != null && port_map.name != "" ? port_map.name : "${port_map.port}-${port_map.protocol}")
+    "port"       = var.ports[idx]
-    "port"       = port_map.port
+    "protocol"   = var.protocols[idx]
-    "protocol"   = port_map.protocol
+    "targetPort" = target
-    "targetPort" = port_map.target
   }] : []
-  node_ports = var.svc_type == "NodePort" ? [for port_map in var.port_mapper : {
+  ext_ports = var.svc_type == "ExternalName" ? [for idx, target in var.targets : {
-    "port"       = port_map.port
+    "name"       = target
-    "targetPort" = port_map.target
+    "port"       = var.ports[idx]
-    "nodePort"   = port_map.port
+    "protocol"   = var.protocols[idx]
+    "targetPort" = var.ports[idx]
+  }] : []
+  lb_ports = var.svc_type == "LoadBalancer" ? [for port in var.lb_ports : {
+    "port"       = port.port.number
+    "name"       = port.name
+    "targetPort" = port.port.number
+  }] : []
+  node_ports = var.svc_type == "NodePort" ? [for idx, port in var.ports : {
+    "port"       = port
+    "targetPort" = port
+    "nodePort"   = var.node_ports[idx]
   }] : []
   metadata = merge(
     {
@@ -25,25 +35,25 @@ locals {
   spec = {
     "ClusterIP" = {
       type           = "ClusterIP"
-      ports          = local.default_ports
+      ports          = local.cluster_ports
-      selector       = local.selector
+      selector       = var.labels
       ipFamilyPolicy = var.ip_family
     },
     "ExternalName" = {
       type           = "ExternalName"
       externalName   = var.target_host
-      ports        = local.default_ports
+      ports          = local.ext_ports
     },
     "NodePort" = {
       type           = "NodePort"
-      selector       = local.selector
+      selector       = var.labels
       ports          = local.node_ports
       ipFamilyPolicy = var.ip_family
     },
     "LoadBalancer" = {
       type                  = "LoadBalancer"
-      selector              = local.selector
+      selector              = var.labels
-      ports                 = local.default_ports
+      ports                 = local.lb_ports
       externalTrafficPolicy = var.lb_policy
       ipFamilyPolicy        = var.ip_family
     }
@@ -69,6 +79,6 @@ resource "kubectl_manifest" "endpoint" {
     subsets:
       - addresses:
           - ip: ${var.target_host}
-        ports:  ${jsonencode([for port_map in var.port_mapper : { "port" = port_map.port }])}
+        ports:  ${jsonencode([for port in var.ports : { "port" = port }])}
   EOF
 }

service/variables.tf

@@ -9,12 +9,6 @@ variable "namespace" {
 }
 variable "labels" {
   type = map(string)
-  description = "Service labels"
-}
-variable "selector" {
-  type        = map(string)
-  description = "Service selector labels (default same as labels)"
-  default     = {}
 }
 variable "annotations" {
   type    = map(string)
@@ -38,39 +32,43 @@ variable "ip_family" {
   }
 }
 
-variable "port_mapper" {
+variable "ports" {
-  description = "List information for port mapping in the service"
+  type    = list(number)
-  type = list(object({
+  default = [80]
-    name     = optional(string)
+}
-    port     = number
+variable "targets" {
-    protocol = string
+  type    = list(string)
-    target   = string
+  default = ["http"]
-  }))
+}
-  default = [{
+variable "protocols" {
-    "name"     = "80-TCP",
+  type    = list(any)
-    "port"     = 80,
+  default = ["TCP"]
-    "protocol" = "TCP"
+  validation {
-    "target"   = "80-TCP"
+    condition     = alltrue([for proto in var.protocols : contains(["TCP", "UDP"], proto)])
-  }]
+    error_message = "Only TCP or UDP is allowed"
-  validation {
+  }
-    condition = alltrue(
-      [for port_map in var.port_mapper : contains(["TCP", "UDP"], port_map.protocol)]
-    )
-    error_message = "Only numeric on containerPort and TCP or UDP on protocol is allowed"
-  }
-  # validation {
-  #   condition = (var.svc_type == "NodePort") == alltrue(
-  #     [for port_map in var.port_mapper : port_map.port >= 30000 && port_map.port <= 32767]
-  #   )
-  #   error_message = "The range of valid ports is 30000-32767 for a NodePort type"
-  # }
 }
-
 variable "target_host" {
   type    = string
   default = ""
 }
-
+variable "node_ports" {
+  type    = list(number)
+  default = [30080]
+  validation {
+    condition     = alltrue([for port in var.node_ports : port >= 30000 && port <= 32767])
+    error_message = "The range of valid ports is 30000-32767"
+  }
+}
+variable "lb_ports" {
+  type = list(object({
+    name = string
+    port = object({
+      number = number
+    })
+  }))
+  default = []
+}
 variable "lb_policy" {
   type    = string
   default = "Cluster"