sarex/terraform-contour-mirror
1
0
Fork 0
mirror of https://gitlab.sarex.io/infra/terraform-contour-mirror.git synced 2026-08-05 18:31:00 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

++ isolate random secret dependencies

Browse Source
This commit is contained in:
Kochetkov S 2026-07-20 14:12:13 +03:00
parent 38ad66d383
commit 26f474bae0
1 changed files with 17 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
modules/k8s-secret/main.tf
View File

@ -183,9 +183,6 @@ locals {
try(secret.custom_keys, {}), try(secret.custom_keys, {}),
{ {
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "") for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
} }
) : secret.type == "database" && local.database_outputs_by_secret[name] != null ? merge( ) : secret.type == "database" && local.database_outputs_by_secret[name] != null ? merge(
# Базовые поля из database outputs # Базовые поля из database outputs
@ -201,10 +198,6 @@ locals {
try(secret.custom_keys, {}), try(secret.custom_keys, {}),
{ {
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "") for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
# Рандомные поля
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
} }
) : secret.type == "database_url" && local.database_outputs_by_secret[name] != null ? merge( ) : secret.type == "database_url" && local.database_outputs_by_secret[name] != null ? merge(
{ {
@ -220,9 +213,6 @@ locals {
try(secret.custom_keys, {}), try(secret.custom_keys, {}),
{ {
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "") for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
} }
) : secret.type == "valkey" && local.valkey_outputs_by_secret[name] != null ? merge( ) : secret.type == "valkey" && local.valkey_outputs_by_secret[name] != null ? merge(
{ {
@ -236,35 +226,23 @@ locals {
try(secret.custom_keys, {}), try(secret.custom_keys, {}),
{ {
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "") for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
} }
) : secret.type == "rabbitmq" && local.rabbitmq_outputs_by_secret[name] != null ? merge( ) : secret.type == "rabbitmq" && local.rabbitmq_outputs_by_secret[name] != null ? merge(
local.rabbitmq_credentials_by_secret[name], local.rabbitmq_credentials_by_secret[name],
try(secret.custom_keys, {}), try(secret.custom_keys, {}),
{ {
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "") for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
} }
) : secret.type == "kafka" && local.kafka_outputs_by_secret[name] != null ? merge( ) : secret.type == "kafka" && local.kafka_outputs_by_secret[name] != null ? merge(
local.kafka_credentials_by_secret[name], local.kafka_credentials_by_secret[name],
try(secret.custom_keys, {}), try(secret.custom_keys, {}),
{ {
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "") for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
} }
) : merge( ) : merge(
try(secret.custom_keys, {}), try(secret.custom_keys, {}),
{ {
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "") for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
} }
) )
} }
@ -291,6 +269,8 @@ locals {
sink = try(secret.sink, "k8s") sink = try(secret.sink, "k8s")
vault_path = try(secret.vault_path, "") != "" ? secret.vault_path : "${var.vault_path_prefix}/${secret.name}" vault_path = try(secret.vault_path, "") != "" ? secret.vault_path : "${var.vault_path_prefix}/${secret.name}"
data = try(local.secrets_data[name], {}) data = try(local.secrets_data[name], {})
# Явный data имеет приоритет над вычисляемыми, включая случайные ключи.
random_keys = contains(keys(local.secrets_data_override), name) ? {} : try(secret.random_keys, {})
} }
} }
@ -337,7 +317,11 @@ resource "kubernetes_secret" "with_ignore" {
type = each.value.k8s_type type = each.value.k8s_type
data = each.value.data # Ссылка на random_password остаётся на уровне конкретного секрета. Поэтому
# новый случайный ключ не делает data неизвестным у всех остальных секретов.
data = merge(each.value.data, {
for key, config in each.value.random_keys : key => random_password.secrets["${each.key}:${key}"].result
})
lifecycle { lifecycle {
# Игнорируем data, type и metadata чтобы не было phantom updates # Игнорируем data, type и metadata чтобы не было phantom updates
@ -357,7 +341,11 @@ resource "kubernetes_secret" "without_ignore" {
type = each.value.k8s_type type = each.value.k8s_type
data = each.value.data # Ссылка на random_password остаётся на уровне конкретного секрета. Поэтому
# новый случайный ключ не делает data неизвестным у всех остальных секретов.
data = merge(each.value.data, {
for key, config in each.value.random_keys : key => random_password.secrets["${each.key}:${key}"].result
})
lifecycle { lifecycle {
# type и metadata игнорируем чтобы не было phantom updates # type и metadata игнорируем чтобы не было phantom updates
@ -370,7 +358,9 @@ resource "kubernetes_secret" "without_ignore" {
resource "vault_kv_secret_v2" "this" { resource "vault_kv_secret_v2" "this" {
for_each = local.secrets_vault for_each = local.secrets_vault
mount = var.vault_kv_mount mount = var.vault_kv_mount
name = each.value.vault_path name = each.value.vault_path
data_json = jsonencode(each.value.data) data_json = jsonencode(merge(each.value.data, {
for key, config in each.value.random_keys : key => random_password.secrets["${each.key}:${key}"].result
}))
} }