64 lines
1.9 KiB
HCL
64 lines
1.9 KiB
HCL
locals {
|
|
app_slug = "${var.instance}${var.component == "" ? "" : "-"}${var.component}"
|
|
oauth2_labels = merge(var.labels, {
|
|
"app.kubernetes.io/component" = "authentik-oauth2"
|
|
})
|
|
}
|
|
|
|
resource "random_password" "client_id" {
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
data "authentik_certificate_key_pair" "ca" {
|
|
name = "authentik Self-signed Certificate"
|
|
}
|
|
|
|
data "authentik_scope_mapping" "oauth2" {
|
|
managed_list = [
|
|
"goauthentik.io/providers/oauth2/scope-email",
|
|
"goauthentik.io/providers/oauth2/scope-openid",
|
|
"goauthentik.io/providers/oauth2/scope-profile"
|
|
]
|
|
}
|
|
data "authentik_flow" "default_authorization_flow" {
|
|
slug = "default-provider-authorization-implicit-consent"
|
|
}
|
|
data "authentik_flow" "default_authentication_flow" {
|
|
slug = "default-authentication-flow"
|
|
}
|
|
|
|
resource "authentik_provider_oauth2" "oauth2" {
|
|
name = local.app_slug
|
|
client_id = random_password.client_id.result
|
|
authentication_flow = data.authentik_flow.default_authentication_flow.id
|
|
authorization_flow = data.authentik_flow.default_authorization_flow.id
|
|
client_type = "confidential"
|
|
sub_mode = "user_username"
|
|
signing_key = data.authentik_certificate_key_pair.ca.id
|
|
property_mappings = data.authentik_scope_mapping.oauth2.ids
|
|
redirect_uris = [
|
|
"https://${var.redirect_path != "" ? "${var.dns_name}/${var.redirect_path}" : var.dns_name}"
|
|
]
|
|
}
|
|
|
|
data "kubernetes_ingress_v1" "authentik" {
|
|
metadata {
|
|
name = "authentik"
|
|
namespace = "${var.domain}-auth"
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_secret" "oauth2_client_secret" {
|
|
metadata {
|
|
name = "${local.app_slug}-oauth2"
|
|
namespace = var.namespace
|
|
labels = local.oauth2_labels
|
|
}
|
|
data = {
|
|
oidc_endpoint = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${local.app_slug}/"
|
|
client_id = random_password.client_id.result
|
|
client_secret = authentik_provider_oauth2.oauth2.client_secret
|
|
}
|
|
}
|