sarex/terraform-contour-mirror
1
0
Fork 0
mirror of https://gitlab.sarex.io/infra/terraform-contour-mirror.git synced 2026-08-08 21:21:34 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix user import vs create mechanic

Browse Source
This commit is contained in:
Kochetkov S 2026-07-10 12:36:37 +03:00
parent 43b28d0c85
commit 15dc79196c
3 changed files with 28 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
infrastructure.yaml
View File

@ -660,6 +660,7 @@ environments:
users: users:
- name: iam - name: iam
clusterRef: prod clusterRef: prod
adopt: true
permissions: permissions:
- topic: ams-sync - topic: ams-sync
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
@ -701,6 +702,7 @@ environments:
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
- name: inspections - name: inspections
clusterRef: prod clusterRef: prod
adopt: true
permissions: permissions:
- topic: assets_broadcast - topic: assets_broadcast
roles: [ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_CONSUMER]
@ -724,6 +726,7 @@ environments:
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
- name: issues - name: issues
clusterRef: prod clusterRef: prod
adopt: true
permissions: permissions:
- topic: assets_broadcast - topic: assets_broadcast
roles: [ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_CONSUMER]
@ -751,11 +754,13 @@ environments:
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
- name: kafka-topics-test - name: kafka-topics-test
clusterRef: prod clusterRef: prod
adopt: true
permissions: permissions:
- topic: sarex.prod.kafka-topics-test.events.v1 - topic: sarex.prod.kafka-topics-test.events.v1
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
- name: message-hub-user - name: message-hub-user
clusterRef: prod clusterRef: prod
adopt: true
permissions: permissions:
- topic: assets_broadcast - topic: assets_broadcast
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
@ -765,6 +770,7 @@ environments:
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
- name: platform - name: platform
clusterRef: prod clusterRef: prod
adopt: true
permissions: permissions:
- topic: ams-sync - topic: ams-sync
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER, ACCESS_ROLE_TOPIC_ADMIN] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER, ACCESS_ROLE_TOPIC_ADMIN]
@ -800,6 +806,7 @@ environments:
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
- name: pm - name: pm
clusterRef: prod clusterRef: prod
adopt: true
permissions: permissions:
- topic: assets_broadcast - topic: assets_broadcast
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
@ -807,7 +814,7 @@ environments:
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
- name: premises - name: premises
clusterRef: prod clusterRef: prod
adoptExisting: true adopt: true
permissions: permissions:
- topic: assets_broadcast - topic: assets_broadcast
roles: [ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_CONSUMER]
@ -895,6 +902,7 @@ environments:
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
- name: sarex-backend-prod - name: sarex-backend-prod
clusterRef: prod clusterRef: prod
adopt: true
permissions: permissions:
- topic: ams-sync - topic: ams-sync
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
@ -904,7 +912,7 @@ environments:
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
- name: srx-broadcast - name: srx-broadcast
clusterRef: prod clusterRef: prod
adoptExisting: true adopt: true
permissions: permissions:
- topic: assets_broadcast - topic: assets_broadcast
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
@ -924,6 +932,7 @@ environments:
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]
- name: system_log_user - name: system_log_user
clusterRef: prod clusterRef: prod
adopt: true
permissions: permissions:
- topic: bru.cde.folders.prod - topic: bru.cde.folders.prod
roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER] roles: [ACCESS_ROLE_PRODUCER, ACCESS_ROLE_CONSUMER]

14
live/prod/kafka-topics/terragrunt.hcl
View File

@ -28,6 +28,20 @@ terraform {
source = "${get_terragrunt_dir()}/../../../modules//kafka-topics-yc" source = "${get_terragrunt_dir()}/../../../modules//kafka-topics-yc"
} }
generate "import_existing" {
path = "import_existing.tf"
if_exists = "overwrite"
contents = join("\n\n", [
for user in local.kafka_users : <<-EOF
import {
to = yandex_mdb_kafka_user.this["${user.clusterRef}:${user.name}"]
id = "${local.kafka_cluster_refs[user.clusterRef].cluster_id}:${user.name}"
}
EOF
if try(user.adopt, false)
])
}
inputs = { inputs = {
environment = local.env_name environment = local.env_name
topics = local.kafka_topics topics = local.kafka_topics

6
modules/kafka-topics-yc/variables.tf
View File

@ -22,9 +22,9 @@ variable "topics" {
variable "users" { variable "users" {
description = "User-centric Kafka access declarations from infrastructure.yaml under environments.<env>.kafka.users." description = "User-centric Kafka access declarations from infrastructure.yaml under environments.<env>.kafka.users."
type = list(object({ type = list(object({
name = string name = string
clusterRef = string clusterRef = string
adoptExisting = optional(bool, false) adopt = optional(bool, false)
permissions = optional(list(object({ permissions = optional(list(object({
topic = string topic = string
roles = list(string) roles = list(string)