Refacto and add lb

application/application.tf

@@ -1,5 +1,5 @@
 locals {
-  app_name   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
+  app_name   = var.component == var.instance ? var.instance : format("%s-%s", var.component, var.instance)
   main_group = format("app-%s", local.app_name)
 }
 data "authentik_group" "akadmin" {
@@ -7,14 +7,13 @@ data "authentik_group" "akadmin" {
 }
 resource "authentik_group" "groups" {
   name       = local.main_group
-  attributes = jsonencode({ "${local.app_name}" = var.attributes })
+  attributes = jsonencode({ "${local.app_name}" = true })
 }
 
 resource "authentik_group" "subgroup" {
   count  = length(var.sub_groups)
-  name   = format("%s-%s", local.main_group, var.sub_groups[count.index])
+  name   = format("%s-%s", local.app_name, var.sub_groups[count.index])
   parent = authentik_group.groups.id
-  attributes = length(var.sub_groups_attributes)>count.index?jsonencode({ "${local.app_name}" = var.sub_groups_attributes[count.index] }):jsonencode({ "${local.app_name}" = var.attributes })
 }
 
 resource "authentik_application" "prj_app" {
@@ -31,7 +30,7 @@ resource "authentik_policy_expression" "policy" {
   name       = local.main_group
   expression = <<-EOF
     attr = request.user.group_attributes()
-    return True if '${local.app_name}' in attr else False
+    return attr['${local.app_name}'] if '${local.app_name}' in attr else False
   EOF
 }
 

application/outputs.tf

@@ -5,6 +5,3 @@ output "application-id" {
 output "policy-id" {
   value = authentik_policy_expression.policy.id
 }
-output "main_group" {
-  value = local.main_group
-}

application/variables.tf

@@ -17,6 +17,9 @@ variable "protocol_provider" {
 variable "dns_name" {
   type = string
 }
+variable "app_name" {
+  type = string
+}
 variable "sub_groups" {
   type    = list(string)
   default = []
@@ -26,9 +29,3 @@ variable "backchannel_providers" {
   type    = list(number)
   default = null
 }
-variable "attributes" {
-  default = {enable = true}
-}
-variable "sub_groups_attributes" {
-  default = []
-}

backup/backup.tf

@@ -1,42 +0,0 @@
-locals {
-  app_slug   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
-}
-
-resource "kubectl_manifest" "backup_schedule" {
-  count = var.backups.enable ? 1 : 0
-  yaml_body  = <<-EOF
-    apiVersion: k8up.io/v1
-    kind: Schedule
-    metadata:
-      name: "${var.app_slug}-backup"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.labels)}
-    spec:
-      backend:
-        repoPasswordSecretRef:
-          key: "${var.backups.restic_key}"
-          name: "${var.backups.secret_name}"
-        s3:
-          accessKeyIDSecretRef:
-            key: "${var.backups.key_id_key}"
-            name: "${var.backups.secret_name}"
-          bucket: "${var.app_slug}-${var.namespace}"
-          endpoint: "${var.backups.endpoint}/restic"
-          secretAccessKeySecretRef:
-            key: "${var.backups.secret_key}"
-            name: "${var.backups.secret-name}"
-      backup:
-        schedule: "${var.backups.schedule.backup}"
-        failedJobsHistoryLimit: 2
-        successfulJobsHistoryLimit: 2
-      check:
-        schedule: "${var.backups.schedule.check}"
-      prune:
-        retention:
-          keepDaily: ${var.backups.retention.keepDaily}
-          keepMonthly: ${var.backups.retention.keepMonthly}
-          keepWeekly: ${var.backups.retention.keepWeekly}
-          keepYearly: ${var.backups.retention.keepYearly}
-        schedule: "${var.backups.schedule.prune}"
-  EOF
-}

backup/outputs.tf

@@ -1,3 +0,0 @@
-output "schedule_name" {
-  value = kubectl_manifest.backup_schedule.name
-}

backup/providers.tf

@@ -1,8 +0,0 @@
-terraform {
-  required_providers {
-    kubectl = {
-        source = "gavinbunney/kubectl"
-        version = "~> 1.14.0"
-    }
-  }
-}

backup/variables.tf

@@ -1,55 +0,0 @@
-variable "component" {
-  type = string
-}
-variable "instance" {
-  type = string
-}
-variable "namespace" {
-  type = string
-}
-variable "labels" {
-  type = map(string)
-}
-variable "backups" {
-  default     = {
-    "enable" = false
-    "endpoint" = ""
-    "key_id_key" = "s3-id"
-    "restic_key" = "bck-password"
-    "retention" = {
-      "keepDaily" = 14
-      "keepMonthly" = 12
-      "keepWeekly" = 6
-      "keepYearly" = 12
-    }
-    "schedule" = {
-      "backup" = "30 3 * * *"
-      "check" = "30 5 * * 1"
-      "db" = "30 3 * * *"
-      "prune" = "30 1 * * 0"
-    }
-    "secret_key" = "s3-secret"
-    "secret_name" = "backup-settings"
-    "use_barman" = false
-  }
-  type        = object({
-    enable = optional(bool),
-    endpoint = optional(string),
-    key_id_key = optional(string),
-    restic_key = optional(string),
-    retention = optional(object({
-      keepDaily = optional(number),
-      keepMonthly = optional(number),
-      keepWeekly = optional(number),
-      keepYearly = optional(number)
-    })),
-    schedule = optional(object({
-      backup = optional(string),
-      check = optional(string),
-      prune = optional(string)
-    })),
-    secret_key = optional(string),
-    secret_name = optional(string),
-    use_barman = optional(bool)
-  })
-}

forward/forward.tf

@@ -74,7 +74,7 @@ resource "restapi_object" "forward_outpost_binding" {
 
 resource "kubectl_manifest" "prj_middleware" {
   yaml_body = <<-EOF
-    apiVersion: traefik.io/v1alpha1
+    apiVersion: traefik.containo.us/v1alpha1
     kind: Middleware
     metadata:
         name: "${local.app_slug}-forward"

ingress/ingress.tf

@@ -58,7 +58,7 @@ resource "kubectl_manifest" "prj_certificate" {
 resource "kubectl_manifest" "prj_https_redirect" {
   count     = var.create_redirect || var.component == "" ? 1 : 0
   yaml_body = <<-EOF
-    apiVersion: "traefik.io/v1alpha1"
+    apiVersion: "traefik.containo.us/v1alpha1"
     kind: "Middleware"
     metadata:
       name: "${local.app_slug}-https"

ingress/outputs.tf

@@ -1,3 +0,0 @@
-output "secret_name" {
-  value = var.create_cert ? "${local.app_slug}-cert":""
-}

mongo/mongo.tf

@@ -1,126 +0,0 @@
-locals {
-  app_slug   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
-  mongo-password = data.kubernetes_secret_v1.prj_mongo_secret.data["password"]
-  username = var.username==""?var.component==""?var.instance:var.component:var.username
-  db_name = var.db_name==""?var.component==""?var.instance:var.component:var.db_name
-  mongo-labels = merge(var.labels, {
-    "app.kubernetes.io/component" = "mongo"
-  })
-}
-resource "kubectl_manifest" "prj_mongo_secret" {
-  ignore_fields = ["metadata.annotations"]
-  yaml_body  = <<-EOF
-    apiVersion: "secretgenerator.mittwald.de/v1alpha1"
-    kind: "StringSecret"
-    metadata:
-      name: "${local.app_slug}-mongo"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.mongo-labels)}
-    spec:
-      forceRegenerate: false
-      fields:
-      - fieldName: "password"
-        length: "16"
-  EOF
-}
-data "kubernetes_secret_v1" "prj_mongo_secret" {
-  depends_on = [ kubectl_manifest.prj_mongo_secret ]
-  metadata {
-    name = "${local.app_slug}-mongo"
-    namespace = var.namespace
-  }
-}
-resource "kubectl_manifest" "prj_mongo" {
-  yaml_body  = <<-EOF
-    apiVersion: mongodbcommunity.mongodb.com/v1
-    kind: MongoDBCommunity
-    metadata:
-      name: "${local.app_slug}-mongo"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.mongo-labels)}
-    spec:
-      members: 1
-      type: ${var.mongo_type}
-      version: "${var.mongo_version}"
-      statefulSet:
-        spec:
-          template:
-            metadata:
-              annotations:
-                "k8up.io/backupcommand": "sh -c 'mongodump --username=$MONGODB_USER --password=$MONGODB_PASSWORD mongodb://localhost/$MONGODB_NAME --archive'"
-                "k8up.io/file-extension": ".archive"
-            spec:
-              containers:
-              - name: mongod
-                imagePullPolicy: "${var.pullPolicy}"
-                resources: ${jsonencode(var.resources)}
-                env:
-                - name: MONGODB_NAME
-                  value: ${local.db_name}
-                - name: MONGODB_USER
-                  value: ${local.username}
-                - name: MONGODB_PASSWORD
-                  valueFrom:
-                    secretKeyRef:
-                      name: "${local.app_slug}-mongo"
-                      key: password
-      security:
-        authentication:
-          modes: ["SCRAM"]
-      additionalMongodConfig:
-        storage.wiredTiger.engineConfig.cacheSizeGB: 1
-      users:
-      - name: ${local.username}
-        db: ${local.db_name}
-        passwordSecretRef:
-          name: "${local.app_slug}-mongo"
-        roles:
-        - db: ${local.db_name}
-          name: readWrite
-        scramCredentialsSecretName: "${local.app_slug}-mongo-scram"
-  EOF
-}
-resource "kubectl_manifest" "prj_mongo_sa" {
-  yaml_body  = <<-EOF
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-      name: "mongodb-database"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.mongo-labels)}
-  EOF
-}
-resource "kubectl_manifest" "prj_mongo_role" {
-  yaml_body  = <<-EOF
-    apiVersion: rbac.authorization.k8s.io/v1
-    kind: Role
-    metadata:
-      name: "mongodb-database"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.mongo-labels)}
-    rules:
-    - apiGroups: [""]
-      resources: ["secrets"]
-      verbs: ["get"]
-    - apiGroups: [""]
-      resources: ["pods"]
-      verbs: ["patch", "delete", "get"]
-  EOF
-}
-resource "kubectl_manifest" "prj_mongo_rb" {
-  yaml_body  = <<-EOF
-    apiVersion: rbac.authorization.k8s.io/v1
-    kind: RoleBinding
-    metadata:
-      name: "mongodb-database"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.mongo-labels)}
-    subjects:
-    - kind: ServiceAccount
-      name: mongodb-database
-    roleRef:
-      kind: Role
-      name: mongodb-database
-      apiGroup: rbac.authorization.k8s.io
-  EOF
-}

mongo/outputs.tf

@@ -1,21 +0,0 @@
-output "url" {
-  value = "mongodb://${local.username}:${local.mongo-password}@${local.app_slug}-mongo-svc.${var.namespace}.svc:27017/${local.db_name}"
-}
-output "service" {
-  value = "${local.app_slug}-mongo-svc.${var.namespace}.svc"
-}
-output "password" {
-  value = local.mongo-password
-}
-output "username" {
-  value = local.username
-}
-output "db_name" {
-  value = local.db_name
-}
-output "secret" {
-  value = {
-    name = "${local.app_slug}-mongo"
-    key = "password"
-  }
-}

mongo/providers.tf

@@ -1,8 +0,0 @@
-terraform {
-  required_providers {
-    kubectl = {
-        source = "gavinbunney/kubectl"
-        version = "~> 1.14.0"
-    }
-  }
-}

mongo/variables.tf

@@ -1,55 +0,0 @@
-variable "component" {
-  type = string
-}
-variable "instance" {
-  type = string
-}
-variable "namespace" {
-  type = string
-}
-variable "labels" {
-  type = map(string)
-}
-variable "db_name" {
-  type = string
-  default = ""
-}
-variable "username" {
-  type = string
-  default = ""
-}
-variable "mongo_version" {
-  type = string
-  default = "6.0.13"
-}
-variable "mongo_type" {
-  type = string
-  default = "ReplicaSet"
-}
-variable "pullPolicy" {
-  type = string
-  default = "IfNotPresent"
-}
-variable "resources" {
-  type        = object({
-    limits = optional(object({
-      cpu = string
-      memory = string
-    }))
-    requests = optional(object({
-      cpu = string
-      memory = string
-    }))
-  })
-  default = {
-    limits = {
-      cpu = "1"
-      memory = "1100M"
-    }
-    requests = {
-      cpu = "0.3"
-      memory = "400M"
-    }
-  }
-
-}

oauth2/oauth2.tf

@@ -4,9 +4,29 @@ locals {
     "app.kubernetes.io/component" = "authentik-oauth2"
   })
 }
-resource "random_password" "client_id" {
+resource "kubectl_manifest" "oauth2-secret" {
-  length           = 32
+  ignore_fields = ["metadata.annotations"]
-  special          = false
+  yaml_body     = <<-EOF
+    apiVersion: "secretgenerator.mittwald.de/v1alpha1"
+    kind: "StringSecret"
+    metadata:
+      name: "${local.app_slug}-id"
+      namespace: "${var.namespace}"
+      labels: ${jsonencode(local.oauth2_labels)}
+    spec:
+      forceRegenerate: false
+      fields:
+      - fieldName: "client-id"
+        length: "32"
+  EOF
+}
+data "kubernetes_secret_v1" "oauth2-client-id" {
+  depends_on = [kubectl_manifest.oauth2-secret]
+  metadata {
+    name      = kubectl_manifest.oauth2-secret.name
+    namespace = var.namespace
+    labels = local.oauth2_labels
+  }
 }
 
 data "authentik_certificate_key_pair" "ca" {
@@ -29,7 +49,7 @@ data "authentik_flow" "default-authentication-flow" {
 
 resource "authentik_provider_oauth2" "oauth2" {
   name                = "${local.app_slug}"
-  client_id           = random_password.client_id.result
+  client_id           = data.kubernetes_secret_v1.oauth2-client-id.data["client-id"]
   authentication_flow = data.authentik_flow.default-authentication-flow.id
   authorization_flow  = data.authentik_flow.default-authorization-flow.id
   client_type         = "confidential"
@@ -37,21 +57,10 @@ resource "authentik_provider_oauth2" "oauth2" {
   signing_key         = data.authentik_certificate_key_pair.ca.id
   property_mappings   = data.authentik_scope_mapping.oauth2.ids
   redirect_uris = [
-    "https://${var.redirect_path!=""?"${var.dns_name}/${var.redirect_path}":"${var.dns_name}"}"
+    "https://${var.dns_name}/${var.redirect_path}"
   ]
 }
 
-resource "kubernetes_secret_v1" "oauth2-client-id" {
-  metadata {
-    name      = "${local.app_slug}-id"
-    namespace = var.namespace
-    labels    = local.oauth2_labels
-  }
-  data = {
-    client-id = random_password.client_id.result
-  }
-}
-
 resource "kubernetes_secret_v1" "oauth2-client-secret" {
   metadata {
     name      = "${local.app_slug}-secret"
@@ -59,19 +68,10 @@ resource "kubernetes_secret_v1" "oauth2-client-secret" {
     labels    = local.oauth2_labels
   }
   data = {
-    client-id = random_password.client_id.result
     client-secret = authentik_provider_oauth2.oauth2.client_secret
   }
 }
 
-data "kubernetes_secret_v1" "oauth2-client-secret" {
-  depends_on = [kubernetes_secret_v1.oauth2-client-secret]
-  metadata {
-    name      = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
-    namespace = var.namespace
-  }
-}
-
 data "kubernetes_ingress_v1" "authentik" {
   metadata {
     name      = "authentik"

oauth2/outputs.tf

@@ -2,37 +2,6 @@ output "provider-id" {
   value = authentik_provider_oauth2.oauth2.id
 }
 
-output "sso_signout_url" {
-  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${var.component}-${var.instance}/end-session/"
-}
 output "sso_configuration_url" {
   value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${local.app_slug}/"
 }
-output "sso_userinfo_url" {
-  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/userinfo/"
-}
-output "sso_authorize_url" {
-  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/authorize/"
-}
-output "sso_token_url" {
-  value = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/token/"
-}
-output "client_id" {
-  value = random_password.client_id.result
-}
-output "client_secret" {
-  value = authentik_provider_oauth2.oauth2.client_secret
-}
-
-output "secret_client_id_name" {
-  value = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
-}
-output "secret_client_secret_name" {
-  value = kubernetes_secret_v1.oauth2-client-secret.metadata[0].name
-}
-output "secret_client_id_key" {
-  value = "client-id"
-}
-output "secret_client_secret_key" {
-  value = "client-secret"
-}

postgresql/outputs.tf

@@ -1,3 +0,0 @@
-output "host" {
-  value = "${var.app_slug}-redis.${var.namespace}.svc"
-}

postgresql/postgresql.tf

@@ -1,87 +0,0 @@
-locals {
-  app_slug   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
-  pg-labels = merge(local.labels, {
-    "app.kubernetes.io/component" = "pg"
-  })
-  pool-labels = merge(local.labels, {
-    "app.kubernetes.io/component" = "pg-pool"
-  })
-}
-
-resource "kubectl_manifest" "prj_pg" {
-  yaml_body  = join("", concat([<<-EOF
-    apiVersion: postgresql.cnpg.io/v1
-    kind: Cluster
-    metadata:
-      name: "${local.app_slug}-pg"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.pg-labels)}
-      annotations:
-        "k8up.io/backupcommand": "pg_dump -U postgres -d ${var.component} --clean"
-        "k8up.io/file-extension": ".sql"
-    spec:
-      instances: ${var.replicas}
-      imageName: "${var.images.postgresql.registry}/${var.images.postgresql.repository}:${var.images.postgresql.tag}"
-      storage:
-        size: "${var.storage.size}"
-      bootstrap:
-        initdb:
-          database: "${var.component}"
-          owner: "${var.component}"
-      monitoring:
-        enablePodMonitor: true
-  EOF
-  ], var.backups.enable&&var.backups.use_barman?[<<-EOF
-      backup:
-        barmanObjectStore:
-          destinationPath: "s3://${var.app_slug}-${var.namespace}/"
-          endpointURL: "${var.backups.endpoint}/barman"
-          s3Credentials:
-            accessKeyId:
-              name: "${var.backups.secret_name}"
-              key: "${var.backups.key_id_key}"
-            secretAccessKey:
-              name: "${var.backups.secret_name}"
-              key: "${var.backups.secret_key}"
-  EOF
-  ]:[""]))
-}
-
-resource "kubectl_manifest" "prj_pg_backup" {
-  count = var.backups.enable ? 1:0
-  yaml_body  = <<-EOF
-    apiVersion: postgresql.cnpg.io/v1
-    kind: ScheduledBackup
-    metadata:
-      name: "${local.app_slug}-pg"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.pg-labels)}
-    spec:
-      schedule: "${var.backups.schedule.db}"
-      backupOwnerReference: self
-      cluster:
-        name: "${local.app_slug}-pg"
-  EOF
-}
-
-resource "kubectl_manifest" "prj_pg_pool" {
-  depends_on = [kubectl_manifest.prj_pg]
-  yaml_body  = <<-EOF
-    apiVersion: postgresql.cnpg.io/v1
-    kind: Pooler
-    metadata:
-      name: "${local.app_slug}-pool"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.pool-labels)}
-    spec:
-      cluster:
-        name: "${local.app_slug}-pg"
-      instances: 1
-      type: rw
-      pgbouncer:
-        poolMode: session
-        parameters:
-          max_client_conn: "1000"
-          default_pool_size: "10"
-  EOF
-}

postgresql/providers.tf

@@ -1,8 +0,0 @@
-terraform {
-  required_providers {
-    kubectl = {
-        source = "gavinbunney/kubectl"
-        version = "~> 1.14.0"
-    }
-  }
-}

postgresql/variables.tf

@@ -1,63 +0,0 @@
-variable "component" {
-  type = string
-}
-variable "instance" {
-  type = string
-}
-variable "namespace" {
-  type = string
-}
-variable "labels" {
-  type = map(string)
-}
-
-variable "backups" {
-  default     = {
-    "enable" = false
-    "endpoint" = ""
-    "key_id_key" = "s3-id"
-    "restic_key" = "bck-password"
-    "schedule" = {
-      "db" = "30 3 * * *"
-    }
-    "secret_key" = "s3-secret"
-    "secret_name" = "backup-settings"
-    "use_barman" = false
-  }
-  type        = object({
-    enable = optional(bool),
-    endpoint = optional(string),
-    key_id_key = optional(string),
-    restic_key = optional(string),
-    schedule = optional(object({
-      db = optional(string),
-    })),
-    secret_key = optional(string),
-    secret_name = optional(string),
-    use_barman = optional(bool)
-  })
-}
-variable "images" {
-  type        = object({
-    postgresql = optional(object({registry = optional(string), repository = optional(string), tag = optional(number)})),
-  })
-  default     = {
-    "postgresql" = {
-      "registry" = "ghcr.io"
-      "repository" = "cloudnative-pg/postgresql"
-      "tag" = 15.3
-    }
-  }
-}
-variable "replicas" {
-  type        = number
-  default     = 1
-}
-variable "storage" {
-  type        = object({
-    size = optional(string)
-  })
-  default     = {
-    "size" = "5Gi"
-  }
-}

pvc/outputs.tf

@@ -1,3 +0,0 @@
-output "name" {
-  value = local.app_slug
-}

pvc/providers.tf

@@ -1,8 +0,0 @@
-terraform {
-  required_providers {
-    kubectl = {
-        source = "gavinbunney/kubectl"
-        version = "~> 1.14.0"
-    }
-  }
-}

pvc/pvc.tf

@@ -1,27 +0,0 @@
-locals {
-  app_slug   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
-  pvc_spec = merge({
-    "accessModes" = [var.storage.accessMode]
-    "volumeMode" = var.storage.type
-    "resources" = {
-      "requests" = {
-        "storage" = "${var.storage.size}"
-      }
-    }
-  }, var.storage.volume.class != "" ?{
-    "storageClassName" = var.storage.class
-  }:{})
-}
-resource "kubectl_manifest" "pvc" {
-  yaml_body  = <<-EOF
-    apiVersion: v1
-    kind: PersistentVolumeClaim
-    metadata:
-      name: ${local.app_slug}
-      namespace: "${var.namespace}"
-      annotations:
-        k8up.io/backup: "true"
-      labels: ${jsonencode(local.labels)}
-    spec: ${jsonencode(local.pvc_spec)}
-  EOF
-}

pvc/variables.tf

@@ -1,26 +0,0 @@
-variable "component" {
-  type = string
-}
-variable "instance" {
-  type = string
-}
-variable "namespace" {
-  type = string
-}
-variable "labels" {
-  type = map(string)
-}
-variable "storage" {
-  type        = object({
-    accessMode = optional(string),
-    class = optional(string),
-    size = optional(string),
-    type = optional(string)
-  })
-  default     = {
-    "accessMode" = "ReadWriteOnce"
-    "class" = ""
-    "size" = "10Gi"
-    "type" = "Filesystem"
-  }
-}

redis/outputs.tf

@@ -1,6 +0,0 @@
-output "host" {
-  value = "${local.app_slug}-redis.${var.namespace}.svc"
-}
-output "url" {
-  value = "redis://${local.app_slug}-redis.${var.namespace}.svc:6379"
-}

redis/providers.tf

@@ -1,8 +0,0 @@
-terraform {
-  required_providers {
-    kubectl = {
-        source = "gavinbunney/kubectl"
-        version = "~> 1.14.0"
-    }
-  }
-}

redis/redis.tf

@@ -1,41 +0,0 @@
-locals {
-  app_slug   = (var.component == var.instance || var.component=="") ? var.instance : format("%s-%s", var.component, var.instance)
-  redis-labels = merge(var.labels, {
-    "app.kubernetes.io/component" = "redis"
-  })
-  cfg = merge({
-    "image" = "${var.images.redis.registry}/${var.images.redis.repository}:${var.images.redis.tag}"
-    "imagePullPolicy" = "${var.images.redis.pullPolicy}"
-  },lookup(var.password, "enabled", false)?{
-    redisSecret = {
-      name = lookup(var.password, "name", var.component)
-      key  = lookup(var.password, "key", "redis-password")
-    }
-  }:{})
-}
-
-resource "kubectl_manifest" "redis" {
-  yaml_body  = <<-EOF
-    apiVersion: "redis.redis.opstreelabs.in/v1beta1"
-    kind: "Redis"
-    metadata:
-      name: "${local.app_slug}-redis"
-      namespace: "${var.namespace}"
-      labels: ${jsonencode(local.redis-labels)}
-    spec:
-      kubernetesConfig: ${jsonencode(local.cfg)}
-      storage:
-        volumeClaimTemplate:
-          spec:
-            accessModes: ["ReadWriteOnce"]
-            resources:
-              requests:
-                storage: "${var.storage.size}"
-      redisExporter:
-        enabled: ${var.exporter.enabled}
-        image: "${var.images.redis_exporter.registry}/${var.images.redis_exporter.repository}:${var.images.redis_exporter.tag}"
-      securityContext:
-        runAsUser: 1000
-        fsGroup: 1000
-  EOF
-}

redis/variables.tf

@@ -1,65 +0,0 @@
-variable "component" {
-  type = string
-}
-variable "instance" {
-  type = string
-}
-variable "namespace" {
-  type = string
-}
-variable "labels" {
-  type = map(string)
-}
-variable "annotations" {
-  type = map(string)
-  default = {}
-}
-
-variable "images" {
-  type        = object({
-    redis = optional(object({pullPolicy = optional(string), registry = optional(string), repository = optional(string), tag = optional(string)})),
-    redis_exporter = optional(object({pullPolicy = optional(string), registry = optional(string), repository = optional(string), tag = optional(string)}))
-  })
-  default     = {
-    "redis" = {
-      "pullPolicy" = "IfNotPresent"
-      "registry" = "quay.io"
-      "repository" = "opstree/redis"
-      "tag" = "v7.0.12"
-    }
-    "redis_exporter" = {
-      "pullPolicy" = "IfNotPresent"
-      "registry" = "quay.io"
-      "repository" = "opstree/redis-exporter"
-      "tag" = "v1.44.0"
-    }
-  }
-}
-variable "exporter" {
-  type        = object({
-    enabled = optional(bool)
-  })
-  default     = {
-    "enabled" = true
-  }
-}
-variable "password" {
-  type        = object({
-    enabled = optional(bool),
-    name = optional(string),
-    key = optional(string)
-  })
-  default     = {
-    "enabled" = false
-    "name" = ""
-    "key" = ""
-  }
-}
-variable "storage" {
-  type        = object({
-    size = optional(string)
-  })
-  default     = {
-    "size" = "2Gi"
-  }
-}

saml/outputs.tf

@@ -1,27 +1,3 @@
-output "app_id" {
-  value       = "${local.app_slug}-saml"
-}
 output "provider-id" {
   value       = authentik_provider_saml.prj.id
-}
+}
-output "issuer" {
-  value       = authentik_provider_saml.prj.issuer
-}
-output "url_slo_post" {
-  value       = authentik_provider_saml.prj.url_slo_post
-}
-output "url_slo_redirect" {
-  value       = authentik_provider_saml.prj.url_slo_redirect
-}
-output "url_sso_init" {
-  value       = authentik_provider_saml.prj.url_sso_init
-}
-output "url_sso_post" {
-  value       = authentik_provider_saml.prj.url_sso_post
-}
-output "url_sso_redirect" {
-  value       = authentik_provider_saml.prj.url_sso_redirect
-}
-output "certificate_data" {
-  value       = data.authentik_certificate_key_pair.generated.certificate_data
-}

saml/saml.tf

@@ -1,6 +1,6 @@
 locals{
   app_slug = "${var.instance}${var.component==""?"":"-"}${var.component}"
-  saml_labels = merge(var.labels, {
+    saml_labels = merge(var.labels, {
     "app.kubernetes.io/component" = "authentik-saml"
   })
 }
@@ -12,7 +12,7 @@ data "authentik_flow" "default-authentication-flow" {
 }
 
 data "authentik_property_mapping_saml" "saml_maps" {
-  managed_list = var.group_mapping==null?[
+  managed_list = [
       "goauthentik.io/providers/saml/email",
       "goauthentik.io/providers/saml/groups",
       "goauthentik.io/providers/saml/name",
@@ -20,24 +20,9 @@ data "authentik_property_mapping_saml" "saml_maps" {
       "goauthentik.io/providers/saml/uid",
       "goauthentik.io/providers/saml/username",
       "goauthentik.io/providers/saml/ms-windowsaccountname",
-  ]:[
-      "goauthentik.io/providers/saml/email",
-      "goauthentik.io/providers/saml/name",
-      "goauthentik.io/providers/saml/upn",
-      "goauthentik.io/providers/saml/uid",
-      "goauthentik.io/providers/saml/username",
-      "goauthentik.io/providers/saml/ms-windowsaccountname",
   ]
 }
 
-resource "authentik_property_mapping_saml" "mapping" {
-  count         = var.group_mapping==null?0:1
-  friendly_name = "groups"
-  name          = "${local.app_slug} Group mapping"
-  saml_name     = "http://schemas.xmlsoap.org/claims/Group"
-  expression    = var.group_mapping
-}
-
 data "authentik_property_mapping_saml" "saml_name" {
   managed = "goauthentik.io/providers/saml/username"
 }
@@ -69,11 +54,9 @@ resource "authentik_provider_saml" "prj" {
   authentication_flow = data.authentik_flow.default-authentication-flow.id
   authorization_flow  = data.authentik_flow.default-authorization-flow.id
   acs_url             = "https://${var.dns_names[0]}/${var.acs_path}"
-  property_mappings   = var.group_mapping==null?data.authentik_property_mapping_saml.saml_maps.ids:concat(data.authentik_property_mapping_saml.saml_maps.ids,[authentik_property_mapping_saml.mapping[0].id])
+  property_mappings   = data.authentik_property_mapping_saml.saml_maps.ids
   name_id_mapping     = data.authentik_property_mapping_saml.saml_name.id
   signing_kp          = data.authentik_certificate_key_pair.generated.id
   sp_binding          = var.binding
-  audience            = var.audience
-  issuer              = var.saml_issuer
 }
 

saml/variables.tf

@@ -17,21 +17,6 @@ variable "binding" {
   type        = string
   default     = "post"
 }
-variable "namespace" {
-  type        = string
-}
 variable "labels" {
   type        = map(string)
 }
-variable "group_mapping" {
-  type        = string
-  default     = null
-}
-variable "audience" {
-  type        = string
-  default     = null
-}
-variable "saml_issuer" {
-  type        = string
-  default     = null
-}

service/outputs.tf

@@ -1,11 +0,0 @@
-output "name" {
-  value = "${local.app_slug}"
-}
-output "default_definition" {
-  value = {
-    "name"  = "${local.app_slug}"
-    "port" = {
-      "number" = var.ports[0]
-    }
-  }
-}

service/svc.tf

@@ -1,5 +1,4 @@
 locals {
-  selector = var.selector==null?var.labels:var.selector
   app_slug = "${var.instance}${var.component==""?"":"-"}${var.component}"
   cluster_ports = var.svc_type == "ClusterIP" ? [for idx, target in var.targets : {
     "name"       = target
@@ -36,7 +35,7 @@ locals {
     "ClusterIP" = {
       type     = "ClusterIP"
       ports    = local.cluster_ports
-      selector = local.selector
+      selector = var.labels
     },
     "ExternalName" = {
       type         = "ExternalName"
@@ -45,12 +44,12 @@ locals {
     },
     "NodePort" = {
       type     = "NodePort"
-      selector = local.selector
+      selector = var.labels
       ports    = local.node_ports
     },
     "LoadBalancer" = {
       type     = "LoadBalancer"
-      selector = local.selector
+      selector = var.labels
       ports    = local.lb_ports
       externalTrafficPolicy = var.lb_policy
     }

service/variables.tf

@@ -10,10 +10,6 @@ variable "namespace" {
 variable "labels" {
   type = map(string)
 }
-variable "selector" {
-  type = map(string)
-  default = null
-}
 variable "annotations" {
   type = map(string)
   default = {}