sarex/terraform-contour-mirror
1
0
Fork 0
mirror of https://gitlab.sarex.io/infra/terraform-contour-mirror.git synced 2026-08-05 18:31:00 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

++ isolate random secret dependencies

Browse Source
This commit is contained in:
Kochetkov S 2026-07-20 14:12:13 +03:00
parent 38ad66d383
commit 26f474bae0
1 changed files with 17 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
modules/k8s-secret/main.tf
View File

@ -183,9 +183,6 @@ locals {
try(secret.custom_keys, {}),
{
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
}
) : secret.type == "database" && local.database_outputs_by_secret[name] != null ? merge(
# Базовые поля из database outputs
@ -201,10 +198,6 @@ locals {
try(secret.custom_keys, {}),
{
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
# Рандомные поля
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
}
) : secret.type == "database_url" && local.database_outputs_by_secret[name] != null ? merge(
{
@ -220,9 +213,6 @@ locals {
try(secret.custom_keys, {}),
{
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
}
) : secret.type == "valkey" && local.valkey_outputs_by_secret[name] != null ? merge(
{
@ -236,35 +226,23 @@ locals {
try(secret.custom_keys, {}),
{
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
}
) : secret.type == "rabbitmq" && local.rabbitmq_outputs_by_secret[name] != null ? merge(
local.rabbitmq_credentials_by_secret[name],
try(secret.custom_keys, {}),
{
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
}
) : secret.type == "kafka" && local.kafka_outputs_by_secret[name] != null ? merge(
local.kafka_credentials_by_secret[name],
try(secret.custom_keys, {}),
{
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
}
) : merge(
try(secret.custom_keys, {}),
{
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
}
)
}
@ -291,6 +269,8 @@ locals {
sink = try(secret.sink, "k8s")
vault_path = try(secret.vault_path, "") != "" ? secret.vault_path : "${var.vault_path_prefix}/${secret.name}"
data = try(local.secrets_data[name], {})
# Явный data имеет приоритет над вычисляемыми, включая случайные ключи.
random_keys = contains(keys(local.secrets_data_override), name) ? {} : try(secret.random_keys, {})
}
}
@ -337,7 +317,11 @@ resource "kubernetes_secret" "with_ignore" {
type = each.value.k8s_type
data = each.value.data
# Ссылка на random_password остаётся на уровне конкретного секрета. Поэтому
# новый случайный ключ не делает data неизвестным у всех остальных секретов.
data = merge(each.value.data, {
for key, config in each.value.random_keys : key => random_password.secrets["${each.key}:${key}"].result
})
lifecycle {
# Игнорируем data, type и metadata чтобы не было phantom updates
@ -357,7 +341,11 @@ resource "kubernetes_secret" "without_ignore" {
type = each.value.k8s_type
data = each.value.data
# Ссылка на random_password остаётся на уровне конкретного секрета. Поэтому
# новый случайный ключ не делает data неизвестным у всех остальных секретов.
data = merge(each.value.data, {
for key, config in each.value.random_keys : key => random_password.secrets["${each.key}:${key}"].result
})
lifecycle {
# type и metadata игнорируем чтобы не было phantom updates
@ -372,5 +360,7 @@ resource "vault_kv_secret_v2" "this" {
mount = var.vault_kv_mount
name = each.value.vault_path
data_json = jsonencode(each.value.data)
data_json = jsonencode(merge(each.value.data, {
for key, config in each.value.random_keys : key => random_password.secrets["${each.key}:${key}"].result
}))
}