No more sercretString dans oauth2

Reviewed-on: #2

application/application.tf

@@ -1,5 +1,5 @@
 locals {
-  app_name   = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
+  app_name   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
   main_group = format("app-%s", local.app_name)
 }
 data "authentik_group" "akadmin" {
@@ -7,13 +7,14 @@ data "authentik_group" "akadmin" {
 }
 resource "authentik_group" "groups" {
   name       = local.main_group
-  attributes = jsonencode({ "${local.app_name}" = true })
+  attributes = jsonencode({ "${local.app_name}" = var.attributes })
 }
 
 resource "authentik_group" "subgroup" {
   count  = length(var.sub_groups)
-  name   = format("%s-%s", local.app_name, var.sub_groups[count.index])
+  name   = format("%s-%s", local.main_group, var.sub_groups[count.index])
   parent = authentik_group.groups.id
+  attributes = length(var.sub_groups_attributes)>count.index?jsonencode({ "${local.app_name}" = var.sub_groups_attributes[count.index] }):jsonencode({ "${local.app_name}" = var.attributes })
 }
 
 resource "authentik_application" "prj_app" {
@@ -30,7 +31,7 @@ resource "authentik_policy_expression" "policy" {
   name       = local.main_group
   expression = <<-EOF
     attr = request.user.group_attributes()
-    return attr['${local.app_name}'] if '${local.app_name}' in attr else False
+    return True if '${local.app_name}' in attr else False
   EOF
 }
 

application/outputs.tf

@@ -5,3 +5,6 @@ output "application-id" {
 output "policy-id" {
   value = authentik_policy_expression.policy.id
 }
+output "main_group" {
+  value = local.main_group
+}

application/variables.tf

@@ -26,3 +26,9 @@ variable "backchannel_providers" {
   type    = list(number)
   default = null
 }
+variable "attributes" {
+  default = {enable = true}
+}
+variable "sub_groups_attributes" {
+  default = []
+}

backup/backup.tf

@@ -0,0 +1,42 @@
+locals {
+  app_slug   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
+}
+
+resource "kubectl_manifest" "backup_schedule" {
+  count = var.backups.enable ? 1 : 0
+  yaml_body  = <<-EOF
+    apiVersion: k8up.io/v1
+    kind: Schedule
+    metadata:
+      name: "${var.app_slug}-backup"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.labels)}
+    spec:
+      backend:
+        repoPasswordSecretRef:
+          key: "${var.backups.restic_key}"
+          name: "${var.backups.secret_name}"
+        s3:
+          accessKeyIDSecretRef:
+            key: "${var.backups.key_id_key}"
+            name: "${var.backups.secret_name}"
+          bucket: "${var.app_slug}-${var.namespace}"
+          endpoint: "${var.backups.endpoint}/restic"
+          secretAccessKeySecretRef:
+            key: "${var.backups.secret_key}"
+            name: "${var.backups.secret-name}"
+      backup:
+        schedule: "${var.backups.schedule.backup}"
+        failedJobsHistoryLimit: 2
+        successfulJobsHistoryLimit: 2
+      check:
+        schedule: "${var.backups.schedule.check}"
+      prune:
+        retention:
+          keepDaily: ${var.backups.retention.keepDaily}
+          keepMonthly: ${var.backups.retention.keepMonthly}
+          keepWeekly: ${var.backups.retention.keepWeekly}
+          keepYearly: ${var.backups.retention.keepYearly}
+        schedule: "${var.backups.schedule.prune}"
+  EOF
+}

backup/outputs.tf

@@ -0,0 +1,3 @@
+output "schedule_name" {
+  value = kubectl_manifest.backup_schedule.name
+}

backup/providers.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    kubectl = {
+        source = "gavinbunney/kubectl"
+        version = "~> 1.14.0"
+    }
+  }
+}

backup/variables.tf

@@ -0,0 +1,55 @@
+variable "component" {
+  type = string
+}
+variable "instance" {
+  type = string
+}
+variable "namespace" {
+  type = string
+}
+variable "labels" {
+  type = map(string)
+}
+variable "backups" {
+  default     = {
+    "enable" = false
+    "endpoint" = ""
+    "key_id_key" = "s3-id"
+    "restic_key" = "bck-password"
+    "retention" = {
+      "keepDaily" = 14
+      "keepMonthly" = 12
+      "keepWeekly" = 6
+      "keepYearly" = 12
+    }
+    "schedule" = {
+      "backup" = "30 3 * * *"
+      "check" = "30 5 * * 1"
+      "db" = "30 3 * * *"
+      "prune" = "30 1 * * 0"
+    }
+    "secret_key" = "s3-secret"
+    "secret_name" = "backup-settings"
+    "use_barman" = false
+  }
+  type        = object({
+    enable = optional(bool),
+    endpoint = optional(string),
+    key_id_key = optional(string),
+    restic_key = optional(string),
+    retention = optional(object({
+      keepDaily = optional(number),
+      keepMonthly = optional(number),
+      keepWeekly = optional(number),
+      keepYearly = optional(number)
+    })),
+    schedule = optional(object({
+      backup = optional(string),
+      check = optional(string),
+      prune = optional(string)
+    })),
+    secret_key = optional(string),
+    secret_name = optional(string),
+    use_barman = optional(bool)
+  })
+}

forward/forward.tf

@@ -1,8 +1,11 @@
 locals {
   forward_outpost_providers = jsondecode(data.http.get_forward_outpost.response_body).results[0].providers
   forward_outpost_pk        = jsondecode(data.http.get_forward_outpost.response_body).results[0].pk
-  app_name                  = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
-  main_group                = format("app-%s", local.app_name)
+  app_slug                  = "${var.instance}${var.component==""?"":"-"}${var.component}"
+  forward_labels = merge(var.labels, {
+    "app.kubernetes.io/component" = "authentik-forward"
+  })
+  main_group                = format("app-%s", var.app_name)
   external_url              = format("https://%s", var.dns_names[0])
   rules_icons = [for v in var.dns_names : {
     "host" = "${v}"
@@ -24,9 +27,9 @@ resource "kubectl_manifest" "prj_ingress_icon" {
     apiVersion: "networking.k8s.io/v1"
     kind: "Ingress"
     metadata:
-      name: "${var.instance}-icons"
+      name: "${local.app_slug}-icons"
       namespace: "${var.namespace}"
-      labels: ${jsonencode(var.labels)}
+      labels: ${jsonencode(local.forward_labels)}
     spec:
       ingressClassName: "${var.ingress_class}"
       rules: ${jsonencode(local.rules_icons)}
@@ -41,7 +44,7 @@ data "authentik_flow" "default-authorization-flow" {
 }
 
 resource "authentik_provider_proxy" "prj_forward" {
-  name                  = local.app_name
+  name                  = local.app_slug
   external_host         = local.external_url
   authorization_flow    = data.authentik_flow.default-authorization-flow.id
   mode                  = "forward_single"
@@ -71,12 +74,12 @@ resource "restapi_object" "forward_outpost_binding" {
 
 resource "kubectl_manifest" "prj_middleware" {
   yaml_body = <<-EOF
-    apiVersion: traefik.containo.us/v1alpha1
+    apiVersion: traefik.io/v1alpha1
     kind: Middleware
     metadata:
-        name: "forward-${local.app_name}"
+        name: "${local.app_slug}-forward"
         namespace: "${var.namespace}"
-        labels: ${jsonencode(var.labels)}
+        labels: ${jsonencode(local.forward_labels)}
     spec:
       forwardAuth:
         address: http://ak-outpost-forward.${var.domain}-auth.svc:9000/outpost.goauthentik.io/auth/traefik

forward/outputs.tf

@@ -3,5 +3,9 @@ output "provider-id" {
 }
 
 output "sso_logout" {
-  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/o/${var.component}-${var.instance}/end-session/"
+  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/o/${local.app_slug}/end-session/"
 }
+
+output "middleware" {
+  value = "${local.app_slug}-forward"
+}

forward/variables.tf

@@ -1,33 +1,48 @@
 variable "component" {
   type = string
 }
+
 variable "instance" {
   type = string
 }
+
 variable "icon" {
   type = string
 }
+
 variable "domain" {
   type = string
 }
+
 variable "namespace" {
   type = string
 }
+
 variable "ingress_class" {
   type = string
 }
+
 variable "labels" {
   type = map(string)
 }
+
 variable "dns_names" {
   type = list(string)
 }
+
 variable "access_token_validity" {
   type    = string
   default = "hours=10" // ;minutes=10
 }
+
+variable "app_name" {
+  type = string
+  default = ""
+}
+
 variable "service" {
 }
+
 variable "request_headers" {
   type = map(string)
 }

ingress/ingress.tf

@@ -1,6 +1,9 @@
 
 locals {
-  name = "${var.instance}${var.component == "" ? "" : "-"}${var.component}"
+  app_slug = "${var.instance}${var.component==""?"":"-"}${var.component}"
+  pres_labels = merge(var.labels, {
+    "app.kubernetes.io/component" = "presentation"
+  })
   rules = [for v in var.dns_names : {
     "host" = "${v}"
     "http" = {
@@ -15,12 +18,12 @@ locals {
   }]
   tls = var.enforce_tls ? [
     {
-      secretName = var.cert_name != "" ? var.cert_name : "${local.name}-cert"
+      secretName = var.cert_name != "" ? var.cert_name : "${local.app_slug}-cert"
       hosts      = var.dns_names
     }
   ] : []
   middlewares = concat(
-    var.create_redirect ? ["${local.name}-https"] : [],
+    var.create_redirect ? ["${local.app_slug}-https"] : [],
     var.middlewares
   )
   annotations = merge(
@@ -39,11 +42,11 @@ resource "kubectl_manifest" "prj_certificate" {
     apiVersion: "cert-manager.io/v1"
     kind: "Certificate"
     metadata:
-      name: "${local.name}"
+      name: "${local.app_slug}"
       namespace: "${var.namespace}"
-      labels: ${jsonencode(var.labels)}
+      labels: ${jsonencode(local.pres_labels)}
     spec:
-        secretName: "${local.name}-cert"
+        secretName: "${local.app_slug}-cert"
         dnsNames: ${jsonencode(var.dns_names)}
         issuerRef:
           kind: "ClusterIssuer"
@@ -55,12 +58,12 @@ resource "kubectl_manifest" "prj_certificate" {
 resource "kubectl_manifest" "prj_https_redirect" {
   count     = var.create_redirect || var.component == "" ? 1 : 0
   yaml_body = <<-EOF
-    apiVersion: "traefik.containo.us/v1alpha1"
+    apiVersion: "traefik.io/v1alpha1"
     kind: "Middleware"
     metadata:
-      name: "${local.name}-https"
+      name: "${local.app_slug}-https"
       namespace: "${var.namespace}"
-      labels: ${jsonencode(var.labels)}
+      labels: ${jsonencode(local.pres_labels)}
     spec:
       redirectScheme:
         scheme: "https"
@@ -74,9 +77,9 @@ resource "kubectl_manifest" "prj_ingress" {
     apiVersion: "networking.k8s.io/v1"
     kind: "Ingress"
     metadata:
-      name: "${local.name}"
+      name: "${local.app_slug}"
       namespace: "${var.namespace}"
-      labels: ${jsonencode(var.labels)}
+      labels: ${jsonencode(local.pres_labels)}
       annotations: ${jsonencode(local.annotations)}
     spec:
       ingressClassName: "${var.ingress_class}"

ingress/outputs.tf

@@ -0,0 +1,3 @@
+output "secret_name" {
+  value = var.create_cert ? "${local.app_slug}-cert":""
+}

mongo/mongo.tf

@@ -0,0 +1,126 @@
+locals {
+  app_slug   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
+  mongo-password = data.kubernetes_secret_v1.prj_mongo_secret.data["password"]
+  username = var.username==""?var.component==""?var.instance:var.component:var.username
+  db_name = var.db_name==""?var.component==""?var.instance:var.component:var.db_name
+  mongo-labels = merge(var.labels, {
+    "app.kubernetes.io/component" = "mongo"
+  })
+}
+resource "kubectl_manifest" "prj_mongo_secret" {
+  ignore_fields = ["metadata.annotations"]
+  yaml_body  = <<-EOF
+    apiVersion: "secretgenerator.mittwald.de/v1alpha1"
+    kind: "StringSecret"
+    metadata:
+      name: "${local.app_slug}-mongo"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.mongo-labels)}
+    spec:
+      forceRegenerate: false
+      fields:
+      - fieldName: "password"
+        length: "16"
+  EOF
+}
+data "kubernetes_secret_v1" "prj_mongo_secret" {
+  depends_on = [ kubectl_manifest.prj_mongo_secret ]
+  metadata {
+    name = "${local.app_slug}-mongo"
+    namespace = var.namespace
+  }
+}
+resource "kubectl_manifest" "prj_mongo" {
+  yaml_body  = <<-EOF
+    apiVersion: mongodbcommunity.mongodb.com/v1
+    kind: MongoDBCommunity
+    metadata:
+      name: "${local.app_slug}-mongo"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.mongo-labels)}
+    spec:
+      members: 1
+      type: ${var.mongo_type}
+      version: "${var.mongo_version}"
+      statefulSet:
+        spec:
+          template:
+            metadata:
+              annotations:
+                "k8up.io/backupcommand": "sh -c 'mongodump --username=$MONGODB_USER --password=$MONGODB_PASSWORD mongodb://localhost/$MONGODB_NAME --archive'"
+                "k8up.io/file-extension": ".archive"
+            spec:
+              containers:
+              - name: mongod
+                imagePullPolicy: "${var.pullPolicy}"
+                resources: ${jsonencode(var.resources)}
+                env:
+                - name: MONGODB_NAME
+                  value: ${local.db_name}
+                - name: MONGODB_USER
+                  value: ${local.username}
+                - name: MONGODB_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: "${local.app_slug}-mongo"
+                      key: password
+      security:
+        authentication:
+          modes: ["SCRAM"]
+      additionalMongodConfig:
+        storage.wiredTiger.engineConfig.cacheSizeGB: 1
+      users:
+      - name: ${local.username}
+        db: ${local.db_name}
+        passwordSecretRef:
+          name: "${local.app_slug}-mongo"
+        roles:
+        - db: ${local.db_name}
+          name: readWrite
+        scramCredentialsSecretName: "${local.app_slug}-mongo-scram"
+  EOF
+}
+resource "kubectl_manifest" "prj_mongo_sa" {
+  yaml_body  = <<-EOF
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      name: "mongodb-database"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.mongo-labels)}
+  EOF
+}
+resource "kubectl_manifest" "prj_mongo_role" {
+  yaml_body  = <<-EOF
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: Role
+    metadata:
+      name: "mongodb-database"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.mongo-labels)}
+    rules:
+    - apiGroups: [""]
+      resources: ["secrets"]
+      verbs: ["get"]
+    - apiGroups: [""]
+      resources: ["pods"]
+      verbs: ["patch", "delete", "get"]
+  EOF
+}
+resource "kubectl_manifest" "prj_mongo_rb" {
+  yaml_body  = <<-EOF
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: RoleBinding
+    metadata:
+      name: "mongodb-database"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.mongo-labels)}
+    subjects:
+    - kind: ServiceAccount
+      name: mongodb-database
+    roleRef:
+      kind: Role
+      name: mongodb-database
+      apiGroup: rbac.authorization.k8s.io
+  EOF
+}

mongo/outputs.tf

@@ -0,0 +1,21 @@
+output "url" {
+  value = "mongodb://${local.username}:${local.mongo-password}@${local.app_slug}-mongo-svc.${var.namespace}.svc:27017/${local.db_name}"
+}
+output "service" {
+  value = "${local.app_slug}-mongo-svc.${var.namespace}.svc"
+}
+output "password" {
+  value = local.mongo-password
+}
+output "username" {
+  value = local.username
+}
+output "db_name" {
+  value = local.db_name
+}
+output "secret" {
+  value = {
+    name = "${local.app_slug}-mongo"
+    key = "password"
+  }
+}

mongo/providers.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    kubectl = {
+        source = "gavinbunney/kubectl"
+        version = "~> 1.14.0"
+    }
+  }
+}

mongo/variables.tf

@@ -0,0 +1,55 @@
+variable "component" {
+  type = string
+}
+variable "instance" {
+  type = string
+}
+variable "namespace" {
+  type = string
+}
+variable "labels" {
+  type = map(string)
+}
+variable "db_name" {
+  type = string
+  default = ""
+}
+variable "username" {
+  type = string
+  default = ""
+}
+variable "mongo_version" {
+  type = string
+  default = "6.0.13"
+}
+variable "mongo_type" {
+  type = string
+  default = "ReplicaSet"
+}
+variable "pullPolicy" {
+  type = string
+  default = "IfNotPresent"
+}
+variable "resources" {
+  type        = object({
+    limits = optional(object({
+      cpu = string
+      memory = string
+    }))
+    requests = optional(object({
+      cpu = string
+      memory = string
+    }))
+  })
+  default = {
+    limits = {
+      cpu = "1"
+      memory = "1100M"
+    }
+    requests = {
+      cpu = "0.3"
+      memory = "400M"
+    }
+  }
+
+}

mysql/mysql.tf

@@ -1,17 +1,21 @@
 locals {
-  mysql_host     = "${var.instance}-${var.component}-db.${var.namespace}.svc"
-  mysql_username = data.kubernetes_secret_v1.prj_mysql_secret.data["rootUser"]
-  mysql_password = data.kubernetes_secret_v1.prj_mysql_secret.data["rootPassword"]
+  mysql_labels = merge(var.labels, {
+    "app.kubernetes.io/component" = "mysql"
+  })
+  app_slug       = "${var.instance}${var.component == "" ? "" : "-"}${var.component}"
+  mysql_host     = "${local.app_slug}-mysql.${var.namespace}.svc"
+  mysql_username = data.kubernetes_secret_v1.mysql_secret.data["rootUser"]
+  mysql_password = data.kubernetes_secret_v1.mysql_secret.data["rootPassword"]
 }
 
-resource "kubectl_manifest" "prj_mysql_secret" {
+resource "kubectl_manifest" "mysql_secret" {
   yaml_body = <<-EOF
     apiVersion: "secretgenerator.mittwald.de/v1alpha1"
     kind: "StringSecret"
     metadata:
-      name: "${var.instance}-${var.component}-db"
+      name: "${local.app_slug}-mysql"
       namespace: "${var.namespace}"
-      labels: ${jsonencode(var.labels)}
+      labels: ${jsonencode(local.mysql_labels)}
     spec:
       forceRegenerate: false
       data:
@@ -27,19 +31,26 @@ resource "kubectl_manifest" "prj_mysql_secret" {
   EOF
 }
 
-resource "kubectl_manifest" "prj_mysql" {
-  depends_on = [kubectl_manifest.prj_mysql_secret]
+data "kubernetes_secret_v1" "mysql_secret" {
+  depends_on = [kubectl_manifest.mysql_secret]
+  metadata {
+    name      = "${local.app_slug}-mysql"
+    namespace = var.namespace
+    labels = local.mysql_labels
+  }
+}
+
+resource "kubectl_manifest" "mysql" {
   yaml_body  = <<-EOF
     apiVersion: mysql.oracle.com/v2
     kind: InnoDBCluster
     metadata:
-      name: "${var.instance}-${var.component}-db"
+      name: "${local.app_slug}-mysql"
       namespace: "${var.namespace}"
-      labels: ${jsonencode(var.labels)}
+      labels: ${jsonencode(local.mysql_labels)}
     spec:
-      secretName: ${kubectl_manifest.prj_mysql_secret.name}
+      secretName: ${data.kubernetes_secret_v1.mysql_secret.metadata[0].name}
       tlsUseSelfSigned: true
-      # tlsSecretName: "${var.instance}-db-cert"
       instances: 1
       router:
         instances: 1
@@ -55,38 +66,29 @@ resource "kubectl_manifest" "prj_mysql" {
 }
 
 resource "time_sleep" "wait_mysql_ready" {
-  depends_on      = [kubectl_manifest.prj_mysql_secret, kubectl_manifest.prj_mysql]
+  depends_on = [kubectl_manifest.mysql]
   create_duration = "45s"
 }
 
-data "kubernetes_secret_v1" "prj_mysql_secret" {
-  depends_on = [kubectl_manifest.prj_mysql_secret, kubectl_manifest.prj_mysql, time_sleep.wait_mysql_ready]
-  metadata {
-    name      = "${var.instance}-${var.component}-db"
-    namespace = var.namespace
-  }
-}
-
 resource "mysql_database" "app" {
-  depends_on = [kubectl_manifest.prj_mysql_secret, kubectl_manifest.prj_mysql, time_sleep.wait_mysql_ready]
-  name       = var.database
+  depends_on = [
+    kubectl_manifest.mysql,
+    time_sleep.wait_mysql_ready
+  ]
+  name = var.database
 }
 
 resource "mysql_user" "app_user" {
-  depends_on         = [kubectl_manifest.prj_mysql_secret, kubectl_manifest.prj_mysql, time_sleep.wait_mysql_ready]
-  host               = data.kubernetes_secret_v1.prj_mysql_secret.data["userHost"]
-  user               = data.kubernetes_secret_v1.prj_mysql_secret.data["username"]
-  plaintext_password = data.kubernetes_secret_v1.prj_mysql_secret.data["password"]
+  depends_on = [
+    time_sleep.wait_mysql_ready,
+    mysql_database.app,
+  ]
+  host               = data.kubernetes_secret_v1.mysql_secret.data["userHost"]
+  user               = data.kubernetes_secret_v1.mysql_secret.data["username"]
+  plaintext_password = data.kubernetes_secret_v1.mysql_secret.data["password"]
 }
 
 resource "mysql_grant" "app_user_grant" {
-  depends_on = [
-    kubectl_manifest.prj_mysql_secret,
-    kubectl_manifest.prj_mysql,
-    time_sleep.wait_mysql_ready,
-    mysql_database.app,
-    mysql_user.app_user
-  ]
   user       = mysql_user.app_user.user
   host       = mysql_user.app_user.host
   database   = mysql_database.app.name

mysql/outpost.tf

@@ -0,0 +1,12 @@
+output "dns_names" {
+  value = [
+    "${local.app_slug}-mysql",
+    "${local.app_slug}-mysql-instances"
+  ]
+}
+output "mysql_host" {
+  value =" ${local.app_slug}-mysql"
+}
+output "secret_name" {
+  value = "${local.app_slug}-db"
+}

oauth2/oauth2.tf

@@ -1,25 +1,12 @@
-resource "kubectl_manifest" "oauth2-secret" {
-  ignore_fields = ["metadata.annotations"]
-  yaml_body     = <<-EOF
-    apiVersion: "secretgenerator.mittwald.de/v1alpha1"
-    kind: "StringSecret"
-    metadata:
-      name: "${var.component}-${var.instance}-id"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(var.labels)}
-    spec:
-      forceRegenerate: false
-      fields:
-      - fieldName: "client-id"
-        length: "32"
-  EOF
+locals {
+  app_slug = "${var.instance}${var.component==""?"":"-"}${var.component}"
+  oauth2_labels = merge(var.labels, {
+    "app.kubernetes.io/component" = "authentik-oauth2"
+  })
 }
-data "kubernetes_secret_v1" "oauth2-client-id" {
-  depends_on = [kubectl_manifest.oauth2-secret]
-  metadata {
-    name      = kubectl_manifest.oauth2-secret.name
-    namespace = var.namespace
-  }
+resource "random_password" "client_id" {
+  length           = 32
+  special          = false
 }
 
 data "authentik_certificate_key_pair" "ca" {
@@ -41,8 +28,8 @@ data "authentik_flow" "default-authentication-flow" {
 }
 
 resource "authentik_provider_oauth2" "oauth2" {
-  name                = "${var.component}-${var.instance}"
-  client_id           = data.kubernetes_secret_v1.oauth2-client-id.data["client-id"]
+  name                = "${local.app_slug}"
+  client_id           = random_password.client_id.result
   authentication_flow = data.authentik_flow.default-authentication-flow.id
   authorization_flow  = data.authentik_flow.default-authorization-flow.id
   client_type         = "confidential"
@@ -50,21 +37,41 @@ resource "authentik_provider_oauth2" "oauth2" {
   signing_key         = data.authentik_certificate_key_pair.ca.id
   property_mappings   = data.authentik_scope_mapping.oauth2.ids
   redirect_uris = [
-    "https://${var.dns_name}/${var.redirect_path}"
+    "https://${var.redirect_path!=""?"${var.dns_name}/${var.redirect_path}":"${var.dns_name}"}"
   ]
 }
 
+resource "kubernetes_secret_v1" "oauth2-client-id" {
+  metadata {
+    name      = "${local.app_slug}-id"
+    namespace = var.namespace
+    labels    = local.oauth2_labels
+  }
+  data = {
+    client-id = random_password.client_id.result
+  }
+}
+
 resource "kubernetes_secret_v1" "oauth2-client-secret" {
   metadata {
-    name      = "${var.component}-${var.instance}-secret"
+    name      = "${local.app_slug}-secret"
     namespace = var.namespace
-    labels    = var.labels
+    labels    = local.oauth2_labels
   }
   data = {
+    client-id = random_password.client_id.result
     client-secret = authentik_provider_oauth2.oauth2.client_secret
   }
 }
 
+data "kubernetes_secret_v1" "oauth2-client-secret" {
+  depends_on = [kubernetes_secret_v1.oauth2-client-secret]
+  metadata {
+    name      = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
+    namespace = var.namespace
+  }
+}
+
 data "kubernetes_ingress_v1" "authentik" {
   metadata {
     name      = "authentik"

oauth2/outputs.tf

@@ -2,6 +2,37 @@ output "provider-id" {
   value = authentik_provider_oauth2.oauth2.id
 }
 
-output "sso_configuration_url" {
-  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${var.component}-${var.instance}"
+output "sso_signout_url" {
+  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${var.component}-${var.instance}/end-session/"
+}
+output "sso_configuration_url" {
+  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${local.app_slug}/"
+}
+output "sso_userinfo_url" {
+  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/userinfo/"
+}
+output "sso_authorize_url" {
+  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/authorize/"
+}
+output "sso_token_url" {
+  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/token/"
+}
+output "client_id" {
+  value = random_password.client_id.result
+}
+output "client_secret" {
+  value = authentik_provider_oauth2.oauth2.client_secret
+}
+
+output "secret_client_id_name" {
+  value = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
+}
+output "secret_client_secret_name" {
+  value = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
+}
+output "secret_client_id_key" {
+  value = "client-id"
+}
+output "secret_client_secret_key" {
+  value = "client-secret"
 }

postgresql/outputs.tf

@@ -0,0 +1,3 @@
+output "host" {
+  value = "${var.app_slug}-redis.${var.namespace}.svc"
+}

postgresql/postgresql.tf

@@ -0,0 +1,87 @@
+locals {
+  app_slug   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
+  pg-labels = merge(local.labels, {
+    "app.kubernetes.io/component" = "pg"
+  })
+  pool-labels = merge(local.labels, {
+    "app.kubernetes.io/component" = "pg-pool"
+  })
+}
+
+resource "kubectl_manifest" "prj_pg" {
+  yaml_body  = join("", concat([<<-EOF
+    apiVersion: postgresql.cnpg.io/v1
+    kind: Cluster
+    metadata:
+      name: "${local.app_slug}-pg"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.pg-labels)}
+      annotations:
+        "k8up.io/backupcommand": "pg_dump -U postgres -d ${var.component} --clean"
+        "k8up.io/file-extension": ".sql"
+    spec:
+      instances: ${var.replicas}
+      imageName: "${var.images.postgresql.registry}/${var.images.postgresql.repository}:${var.images.postgresql.tag}"
+      storage:
+        size: "${var.storage.size}"
+      bootstrap:
+        initdb:
+          database: "${var.component}"
+          owner: "${var.component}"
+      monitoring:
+        enablePodMonitor: true
+  EOF
+  ], var.backups.enable&&var.backups.use_barman?[<<-EOF
+      backup:
+        barmanObjectStore:
+          destinationPath: "s3://${var.app_slug}-${var.namespace}/"
+          endpointURL: "${var.backups.endpoint}/barman"
+          s3Credentials:
+            accessKeyId:
+              name: "${var.backups.secret_name}"
+              key: "${var.backups.key_id_key}"
+            secretAccessKey:
+              name: "${var.backups.secret_name}"
+              key: "${var.backups.secret_key}"
+  EOF
+  ]:[""]))
+}
+
+resource "kubectl_manifest" "prj_pg_backup" {
+  count = var.backups.enable ? 1:0
+  yaml_body  = <<-EOF
+    apiVersion: postgresql.cnpg.io/v1
+    kind: ScheduledBackup
+    metadata:
+      name: "${local.app_slug}-pg"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.pg-labels)}
+    spec:
+      schedule: "${var.backups.schedule.db}"
+      backupOwnerReference: self
+      cluster:
+        name: "${local.app_slug}-pg"
+  EOF
+}
+
+resource "kubectl_manifest" "prj_pg_pool" {
+  depends_on = [kubectl_manifest.prj_pg]
+  yaml_body  = <<-EOF
+    apiVersion: postgresql.cnpg.io/v1
+    kind: Pooler
+    metadata:
+      name: "${local.app_slug}-pool"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.pool-labels)}
+    spec:
+      cluster:
+        name: "${local.app_slug}-pg"
+      instances: 1
+      type: rw
+      pgbouncer:
+        poolMode: session
+        parameters:
+          max_client_conn: "1000"
+          default_pool_size: "10"
+  EOF
+}

postgresql/providers.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    kubectl = {
+        source = "gavinbunney/kubectl"
+        version = "~> 1.14.0"
+    }
+  }
+}

postgresql/variables.tf

@@ -0,0 +1,63 @@
+variable "component" {
+  type = string
+}
+variable "instance" {
+  type = string
+}
+variable "namespace" {
+  type = string
+}
+variable "labels" {
+  type = map(string)
+}
+
+variable "backups" {
+  default     = {
+    "enable" = false
+    "endpoint" = ""
+    "key_id_key" = "s3-id"
+    "restic_key" = "bck-password"
+    "schedule" = {
+      "db" = "30 3 * * *"
+    }
+    "secret_key" = "s3-secret"
+    "secret_name" = "backup-settings"
+    "use_barman" = false
+  }
+  type        = object({
+    enable = optional(bool),
+    endpoint = optional(string),
+    key_id_key = optional(string),
+    restic_key = optional(string),
+    schedule = optional(object({
+      db = optional(string),
+    })),
+    secret_key = optional(string),
+    secret_name = optional(string),
+    use_barman = optional(bool)
+  })
+}
+variable "images" {
+  type        = object({
+    postgresql = optional(object({registry = optional(string), repository = optional(string), tag = optional(number)})),
+  })
+  default     = {
+    "postgresql" = {
+      "registry" = "ghcr.io"
+      "repository" = "cloudnative-pg/postgresql"
+      "tag" = 15.3
+    }
+  }
+}
+variable "replicas" {
+  type        = number
+  default     = 1
+}
+variable "storage" {
+  type        = object({
+    size = optional(string)
+  })
+  default     = {
+    "size" = "5Gi"
+  }
+}

pvc/outputs.tf

@@ -0,0 +1,3 @@
+output "name" {
+  value = local.app_slug
+}

pvc/providers.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    kubectl = {
+        source = "gavinbunney/kubectl"
+        version = "~> 1.14.0"
+    }
+  }
+}

pvc/pvc.tf

@@ -0,0 +1,27 @@
+locals {
+  app_slug   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
+  pvc_spec = merge({
+    "accessModes" = [var.storage.accessMode]
+    "volumeMode" = var.storage.type
+    "resources" = {
+      "requests" = {
+        "storage" = "${var.storage.size}"
+      }
+    }
+  }, var.storage.volume.class != "" ?{
+    "storageClassName" = var.storage.class
+  }:{})
+}
+resource "kubectl_manifest" "pvc" {
+  yaml_body  = <<-EOF
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      name: ${local.app_slug}
+      namespace: "${var.namespace}"
+      annotations:
+        k8up.io/backup: "true"
+      labels: ${jsonencode(local.labels)}
+    spec: ${jsonencode(local.pvc_spec)}
+  EOF
+}

pvc/variables.tf

@@ -0,0 +1,26 @@
+variable "component" {
+  type = string
+}
+variable "instance" {
+  type = string
+}
+variable "namespace" {
+  type = string
+}
+variable "labels" {
+  type = map(string)
+}
+variable "storage" {
+  type        = object({
+    accessMode = optional(string),
+    class = optional(string),
+    size = optional(string),
+    type = optional(string)
+  })
+  default     = {
+    "accessMode" = "ReadWriteOnce"
+    "class" = ""
+    "size" = "10Gi"
+    "type" = "Filesystem"
+  }
+}

redis/outputs.tf

@@ -0,0 +1,6 @@
+output "host" {
+  value = "${local.app_slug}-redis.${var.namespace}.svc"
+}
+output "url" {
+  value = "redis://${local.app_slug}-redis.${var.namespace}.svc:6379"
+}

redis/providers.tf

@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    kubectl = {
+        source = "gavinbunney/kubectl"
+        version = "~> 1.14.0"
+    }
+  }
+}

redis/redis.tf

@@ -0,0 +1,41 @@
+locals {
+  app_slug   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
+  redis-labels = merge(var.labels, {
+    "app.kubernetes.io/component" = "redis"
+  })
+  cfg = merge({
+    "image" = "${var.images.redis.registry}/${var.images.redis.repository}:${var.images.redis.tag}"
+    "imagePullPolicy" = "${var.images.redis.pullPolicy}"
+  },lookup(var.password, "enabled", false)?{
+    redisSecret = {
+      name = lookup(var.password, "name", var.component)
+      key  = lookup(var.password, "key", "redis-password")
+    }
+  }:{})
+}
+
+resource "kubectl_manifest" "redis" {
+  yaml_body  = <<-EOF
+    apiVersion: "redis.redis.opstreelabs.in/v1beta1"
+    kind: "Redis"
+    metadata:
+      name: "${local.app_slug}-redis"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.redis-labels)}
+    spec:
+      kubernetesConfig: ${jsonencode(local.cfg)}
+      storage:
+        volumeClaimTemplate:
+          spec:
+            accessModes: ["ReadWriteOnce"]
+            resources:
+              requests:
+                storage: "${var.storage.size}"
+      redisExporter:
+        enabled: ${var.exporter.enabled}
+        image: "${var.images.redis_exporter.registry}/${var.images.redis_exporter.repository}:${var.images.redis_exporter.tag}"
+      securityContext:
+        runAsUser: 1000
+        fsGroup: 1000
+  EOF
+}

redis/variables.tf

@@ -0,0 +1,65 @@
+variable "component" {
+  type = string
+}
+variable "instance" {
+  type = string
+}
+variable "namespace" {
+  type = string
+}
+variable "labels" {
+  type = map(string)
+}
+variable "annotations" {
+  type = map(string)
+  default = {}
+}
+
+variable "images" {
+  type        = object({
+    redis = optional(object({pullPolicy = optional(string), registry = optional(string), repository = optional(string), tag = optional(string)})),
+    redis_exporter = optional(object({pullPolicy = optional(string), registry = optional(string), repository = optional(string), tag = optional(string)}))
+  })
+  default     = {
+    "redis" = {
+      "pullPolicy" = "IfNotPresent"
+      "registry" = "quay.io"
+      "repository" = "opstree/redis"
+      "tag" = "v7.0.12"
+    }
+    "redis_exporter" = {
+      "pullPolicy" = "IfNotPresent"
+      "registry" = "quay.io"
+      "repository" = "opstree/redis-exporter"
+      "tag" = "v1.44.0"
+    }
+  }
+}
+variable "exporter" {
+  type        = object({
+    enabled = optional(bool)
+  })
+  default     = {
+    "enabled" = true
+  }
+}
+variable "password" {
+  type        = object({
+    enabled = optional(bool),
+    name = optional(string),
+    key = optional(string)
+  })
+  default     = {
+    "enabled" = false
+    "name" = ""
+    "key" = ""
+  }
+}
+variable "storage" {
+  type        = object({
+    size = optional(string)
+  })
+  default     = {
+    "size" = "2Gi"
+  }
+}

saml/outputs.tf

@@ -1,3 +1,27 @@
+output "app_id" {
+  value       = "${local.app_slug}-saml"
+}
 output "provider-id" {
   value       = authentik_provider_saml.prj.id
-}
+}
+output "issuer" {
+  value       = authentik_provider_saml.prj.issuer
+}
+output "url_slo_post" {
+  value       = authentik_provider_saml.prj.url_slo_post
+}
+output "url_slo_redirect" {
+  value       = authentik_provider_saml.prj.url_slo_redirect
+}
+output "url_sso_init" {
+  value       = authentik_provider_saml.prj.url_sso_init
+}
+output "url_sso_post" {
+  value       = authentik_provider_saml.prj.url_sso_post
+}
+output "url_sso_redirect" {
+  value       = authentik_provider_saml.prj.url_sso_redirect
+}
+output "certificate_data" {
+  value       = data.authentik_certificate_key_pair.generated.certificate_data
+}

saml/saml.tf

@@ -1,3 +1,9 @@
+locals{
+  app_slug = "${var.instance}${var.component==""?"":"-"}${var.component}"
+  saml_labels = merge(var.labels, {
+    "app.kubernetes.io/component" = "authentik-saml"
+  })
+}
 data "authentik_flow" "default-authorization-flow" {
   slug = "default-provider-authorization-implicit-consent"
 }
@@ -6,7 +12,7 @@ data "authentik_flow" "default-authentication-flow" {
 }
 
 data "authentik_property_mapping_saml" "saml_maps" {
-  managed_list = [
+  managed_list = var.group_mapping==null?[
       "goauthentik.io/providers/saml/email",
       "goauthentik.io/providers/saml/groups",
       "goauthentik.io/providers/saml/name",
@@ -14,9 +20,24 @@ data "authentik_property_mapping_saml" "saml_maps" {
       "goauthentik.io/providers/saml/uid",
       "goauthentik.io/providers/saml/username",
       "goauthentik.io/providers/saml/ms-windowsaccountname",
+  ]:[
+      "goauthentik.io/providers/saml/email",
+      "goauthentik.io/providers/saml/name",
+      "goauthentik.io/providers/saml/upn",
+      "goauthentik.io/providers/saml/uid",
+      "goauthentik.io/providers/saml/username",
+      "goauthentik.io/providers/saml/ms-windowsaccountname",
   ]
 }
 
+resource "authentik_property_mapping_saml" "mapping" {
+  count         = var.group_mapping==null?0:1
+  friendly_name = "groups"
+  name          = "${local.app_slug} Group mapping"
+  saml_name     = "http://schemas.xmlsoap.org/claims/Group"
+  expression    = var.group_mapping
+}
+
 data "authentik_property_mapping_saml" "saml_name" {
   managed = "goauthentik.io/providers/saml/username"
 }
@@ -30,27 +51,29 @@ resource "kubectl_manifest" "saml_certificate" {
     apiVersion: "cert-manager.io/v1"
     kind: "Certificate"
     metadata:
-      name: "${var.instance}-${var.component}-saml"
+      name: "${local.app_slug}-saml"
       namespace: "${var.namespace}"
-      labels: ${jsonencode(var.labels)}
+      labels: ${jsonencode(local.saml_labels)}
     spec:
-        secretName: "${var.instance}-${var.component}-saml"
+        secretName: "${local.app_slug}-saml"
         dnsNames: ${jsonencode(var.dns_names)}
         issuerRef:
-          name: "self-sign"
+          name: "${var.issuer}"
           kind: "ClusterIssuer"
           group: "cert-manager.io"
   EOF
 }
 
 resource "authentik_provider_saml" "prj" {
-  name                = "${var.component}-${var.instance}-saml"
+  name                = "${local.app_slug}-saml"
   authentication_flow = data.authentik_flow.default-authentication-flow.id
   authorization_flow  = data.authentik_flow.default-authorization-flow.id
   acs_url             = "https://${var.dns_names[0]}/${var.acs_path}"
-  property_mappings   = data.authentik_property_mapping_saml.saml_maps.ids
+  property_mappings   = var.group_mapping==null?data.authentik_property_mapping_saml.saml_maps.ids:concat(data.authentik_property_mapping_saml.saml_maps.ids,[authentik_property_mapping_saml.mapping[0].id])
   name_id_mapping     = data.authentik_property_mapping_saml.saml_name.id
   signing_kp          = data.authentik_certificate_key_pair.generated.id
   sp_binding          = var.binding
+  audience            = var.audience
+  issuer              = var.saml_issuer
 }
 

saml/variables.tf

@@ -4,6 +4,9 @@ variable "component" {
 variable "instance" {
   type        = string
 }
+variable "issuer" {
+  type = string
+}
 variable "dns_names" {
   type        = list(string)
 }
@@ -14,6 +17,21 @@ variable "binding" {
   type        = string
   default     = "post"
 }
+variable "namespace" {
+  type        = string
+}
 variable "labels" {
   type        = map(string)
 }
+variable "group_mapping" {
+  type        = string
+  default     = null
+}
+variable "audience" {
+  type        = string
+  default     = null
+}
+variable "saml_issuer" {
+  type        = string
+  default     = null
+}

service/outputs.tf

@@ -0,0 +1,11 @@
+output "name" {
+  value = "${local.app_slug}"
+}
+output "default_definition" {
+  value = {
+    "name"  = "${local.app_slug}"
+    "port" = {
+      "number" = var.ports[0]
+    }
+  }
+}

service/svc.tf

@@ -1,29 +1,58 @@
 locals {
+  selector = var.selector==null?var.labels:var.selector
+  app_slug = "${var.instance}${var.component==""?"":"-"}${var.component}"
   cluster_ports = var.svc_type == "ClusterIP" ? [for idx, target in var.targets : {
     "name"       = target
     "port"       = var.ports[idx]
     "protocol"   = var.protocols[idx]
     "targetPort" = target
   }] : []
+  ext_ports = var.svc_type == "ExternalName" ? [for idx, target in var.targets : {
+    "name"       = target
+    "port"       = var.ports[idx]
+    "protocol"   = var.protocols[idx]
+    "targetPort" = var.ports[idx]
+  }] : []
+  lb_ports = var.svc_type == "LoadBalancer" ? [for idx, port in var.lb_ports : {
+    "port"       = port
+    "targetPort" = var.ports[idx]
+  }] : []
   node_ports = var.svc_type == "NodePort" ? [for idx, port in var.ports : {
     "port"       = port
     "targetPort" = port
     "nodePort"   = var.node_ports[idx]
   }] : []
+  metadata = merge(
+    {
+      "name"= "${local.app_slug}"
+      "namespace"= var.namespace
+      "labels"= var.labels
+    },
+    length(var.annotations) > 0 ? {
+      "annotations"= var.annotations
+    } : {}
+  )
   spec = {
     "ClusterIP" = {
       type     = "ClusterIP"
       ports    = local.cluster_ports
-      selector = var.labels
+      selector = local.selector
     },
     "ExternalName" = {
       type         = "ExternalName"
       externalName = var.target_host
+      ports = local.ext_ports
     },
     "NodePort" = {
       type     = "NodePort"
-      selector = var.labels
+      selector = local.selector
       ports    = local.node_ports
+    },
+    "LoadBalancer" = {
+      type     = "LoadBalancer"
+      selector = local.selector
+      ports    = local.lb_ports
+      externalTrafficPolicy = var.lb_policy
     }
   }
 }
@@ -31,10 +60,7 @@ resource "kubectl_manifest" "service" {
   yaml_body = <<-EOF
     apiVersion: v1
     kind: Service
-    metadata:
-      name: "${var.instance}-${var.component}"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(var.labels)}
+    metadata: ${jsonencode(local.metadata)}
     spec: ${jsonencode(local.spec[var.svc_type])}
   EOF
 }

service/variables.tf

@@ -10,12 +10,20 @@ variable "namespace" {
 variable "labels" {
   type = map(string)
 }
+variable "selector" {
+  type = map(string)
+  default = null
+}
+variable "annotations" {
+  type = map(string)
+  default = {}
+}
 variable "svc_type" {
   type    = string
   default = "ClusterIP"
   validation {
-    condition     = contains(["ClusterIP", "ExternalName", "NodePort"], var.svc_type)
-    error_message = "Only ClusterIP or ExternalName is allowed"
+    condition     = contains(["ClusterIP", "ExternalName", "NodePort", "LoadBalancer"], var.svc_type)
+    error_message = "Only ClusterIP, ExternalName, NodePort or LoadBalancer is allowed"
   }
 }
 variable "ports" {
@@ -46,3 +54,15 @@ variable "node_ports" {
     error_message = "The range of valid ports is 30000-32767"
   }
 }
+variable "lb_ports" {
+  type    = list(number)
+  default = [8080]
+}
+variable "lb_policy" {
+  type    = string
+  default = "Cluster"
+  validation {
+    condition     = contains(["Cluster", "Local"], var.lb_policy)
+    error_message = "Only Cluster or Local is allowed"
+  }
+}