mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-05 18:31:00 +03:00
++ contour: in-cluster root — minio backend + kubernetes/vault/kafka/postgresql/rabbitmq/minio providers, admin creds via env from vault
This commit is contained in:
parent
ca7332bfdc
commit
128b7b4451
@ -1,3 +1,12 @@
|
||||
# Contour root — in-cluster backend + providers.
|
||||
#
|
||||
# This branch (`contour`) serves ALL closed contours. Backend state lives in the
|
||||
# contour MinIO; the concrete contour is selected by INFRA_ENV. Providers target
|
||||
# in-cluster services (no managed YC). Infra-service admin creds are read from
|
||||
# Vault by a workflow step and injected as env vars (see .gitea/workflows) —
|
||||
# providers pick them up via get_env, so there is no cross-provider data-source
|
||||
# ordering dependency on the vault-secrets stack.
|
||||
|
||||
remote_state {
|
||||
backend = "s3"
|
||||
generate = {
|
||||
@ -5,102 +14,96 @@ remote_state {
|
||||
if_exists = "overwrite_terragrunt"
|
||||
}
|
||||
config = {
|
||||
endpoint = "https://storage.yandexcloud.net"
|
||||
bucket = get_env("S3_PROD_STATE_BUCKET", "tfstate-terragrunt-prod")
|
||||
endpoint = get_env("TF_STATE_S3_ENDPOINT", "")
|
||||
bucket = get_env("TF_STATE_S3_BUCKET", "")
|
||||
key = "${path_relative_to_include()}/terraform.tfstate"
|
||||
region = "ru-central1"
|
||||
region = get_env("TF_STATE_S3_REGION", "ru-central1")
|
||||
access_key = get_env("S3_ACCESS_KEY", get_env("AWS_ACCESS_KEY_ID", ""))
|
||||
secret_key = get_env("S3_SECRET_KEY", get_env("AWS_SECRET_ACCESS_KEY", ""))
|
||||
skip_region_validation = true
|
||||
skip_credentials_validation = true
|
||||
skip_metadata_api_check = true
|
||||
force_path_style = true
|
||||
skip_bucket_root_access = true
|
||||
# Object Storage бакет без versioning/SSE; свежий terragrunt иначе падает на проверке.
|
||||
skip_bucket_versioning = true
|
||||
skip_bucket_ssencryption = true
|
||||
skip_bucket_enforced_tls = true
|
||||
skip_bucket_public_access_blocking = true
|
||||
force_path_style = true
|
||||
}
|
||||
}
|
||||
|
||||
# Генерация общего провайдера для всех модулей
|
||||
generate "provider" {
|
||||
path = "provider.tf"
|
||||
if_exists = "overwrite_terragrunt"
|
||||
contents = <<EOF
|
||||
contents = <<EOF_PROVIDER
|
||||
terraform {
|
||||
required_version = ">= 1.0"
|
||||
required_version = ">= 1.5.0"
|
||||
|
||||
required_providers {
|
||||
yandex = {
|
||||
source = "yandex-cloud/yandex"
|
||||
version = ">= 0.161.0"
|
||||
kubernetes = { source = "hashicorp/kubernetes", version = "~> 2.23" }
|
||||
vault = { source = "hashicorp/vault", version = "~> 4.2" }
|
||||
kafka = { source = "Mongey/kafka", version = "~> 0.7" }
|
||||
postgresql = { source = "cyrilgdn/postgresql", version = "~> 1.21" }
|
||||
rabbitmq = { source = "cyrilgdn/rabbitmq", version = "~> 1.8" }
|
||||
minio = { source = "aminueza/minio", version = "~> 2.0" }
|
||||
random = { source = "hashicorp/random", version = "~> 3.1" }
|
||||
tls = { source = "hashicorp/tls", version = "~> 4.0" }
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = "~> 2.23"
|
||||
}
|
||||
random = {
|
||||
source = "hashicorp/random"
|
||||
version = "~> 3.1"
|
||||
}
|
||||
rabbitmq = {
|
||||
source = "cyrilgdn/rabbitmq"
|
||||
version = "~> 1.8"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
provider "yandex" {
|
||||
token = var.yc_token != "" ? var.yc_token : null
|
||||
service_account_key_file = var.yc_service_account_key_file != "" ? var.yc_service_account_key_file : null
|
||||
cloud_id = var.yc_cloud_id != "" ? var.yc_cloud_id : null
|
||||
folder_id = var.yc_folder_id != "" ? var.yc_folder_id : null
|
||||
zone = "ru-central1-a"
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
# Если kubeconfig_path указан и файл существует - используем его
|
||||
# Иначе провайдер автоматически использует in-cluster config (для runner'а в k8s)
|
||||
config_path = var.kubeconfig_path != "" ? var.kubeconfig_path : null
|
||||
config_context = var.kube_context != "" ? var.kube_context : null
|
||||
}
|
||||
|
||||
variable "yc_token" {
|
||||
type = string
|
||||
default = ""
|
||||
description = "Yandex Cloud IAM token"
|
||||
}
|
||||
|
||||
variable "yc_service_account_key_file" {
|
||||
type = string
|
||||
default = ""
|
||||
description = "Path to Yandex Cloud service account key file"
|
||||
}
|
||||
|
||||
variable "yc_cloud_id" {
|
||||
type = string
|
||||
default = ""
|
||||
description = "Yandex Cloud ID"
|
||||
}
|
||||
|
||||
variable "yc_folder_id" {
|
||||
type = string
|
||||
default = ""
|
||||
description = "Yandex Cloud folder ID"
|
||||
}
|
||||
|
||||
variable "kubeconfig_path" {
|
||||
type = string
|
||||
default = ""
|
||||
description = "Path to kubeconfig file"
|
||||
}
|
||||
|
||||
variable "kube_context" {
|
||||
type = string
|
||||
default = ""
|
||||
description = "Kubernetes context"
|
||||
}
|
||||
EOF
|
||||
|
||||
provider "kubernetes" {
|
||||
config_path = var.kubeconfig_path != "" ? var.kubeconfig_path : null
|
||||
config_context = var.kube_context != "" ? var.kube_context : null
|
||||
}
|
||||
|
||||
# Vault: static VAULT_TOKEN if provided, else in-cluster k8s auth by the runner SA.
|
||||
provider "vault" {
|
||||
%{if get_env("VAULT_TOKEN", "") == ""~}
|
||||
auth_login_kubernetes {
|
||||
role = "${get_env("VAULT_K8S_ROLE", "terraform")}"
|
||||
mount_path = "auth/${get_env("VAULT_K8S_AUTH_BACKEND", "kubernetes")}"
|
||||
}
|
||||
%{endif~}
|
||||
}
|
||||
|
||||
# In-cluster PostgreSQL (admin). Password injected from Vault secrets/postgresql/admin.
|
||||
provider "postgresql" {
|
||||
host = "${get_env("PG_ADMIN_HOST", "postgresql.postgresql.svc.cluster.local")}"
|
||||
port = ${get_env("PG_ADMIN_PORT", "5432")}
|
||||
username = "${get_env("PG_ADMIN_USER", "postgres")}"
|
||||
password = "${get_env("PG_ADMIN_PASSWORD", "")}"
|
||||
sslmode = "disable"
|
||||
superuser = false
|
||||
}
|
||||
|
||||
# In-cluster Kafka (Bitnami). Admin = inter_broker super-user from Vault secrets/kafka/bootstrap.
|
||||
provider "kafka" {
|
||||
bootstrap_servers = ["${get_env("KAFKA_BOOTSTRAP", "kafka-kafka-contour.kafka.svc.cluster.local:9092")}"]
|
||||
tls_enabled = false
|
||||
sasl_mechanism = "${get_env("KAFKA_SASL_MECHANISM", "plain")}"
|
||||
sasl_username = "${get_env("KAFKA_ADMIN_USER", "inter_broker_user")}"
|
||||
sasl_password = "${get_env("KAFKA_ADMIN_PASSWORD", "")}"
|
||||
}
|
||||
|
||||
# In-cluster RabbitMQ management API. Admin from Vault secrets/rabbitmq/auth.
|
||||
provider "rabbitmq" {
|
||||
endpoint = "${get_env("RABBITMQ_ENDPOINT", "http://rabbitmq.rabbitmq.svc.cluster.local:15672")}"
|
||||
username = "${get_env("RABBITMQ_ADMIN_USER", "admin")}"
|
||||
password = "${get_env("RABBITMQ_ADMIN_PASSWORD", "")}"
|
||||
}
|
||||
|
||||
# In-cluster MinIO S3 API. Admin from Vault secrets/minio/admin.
|
||||
provider "minio" {
|
||||
minio_server = "${get_env("MINIO_ENDPOINT", "minio.minio.svc.cluster.local:9000")}"
|
||||
minio_user = "${get_env("MINIO_ADMIN_USER", "")}"
|
||||
minio_password = "${get_env("MINIO_ADMIN_PASSWORD", "")}"
|
||||
minio_ssl = false
|
||||
}
|
||||
EOF_PROVIDER
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user