sarex/terraform-contour-mirror
1
0
Fork 0
mirror of https://gitlab.sarex.io/infra/terraform-contour-mirror.git synced 2026-08-05 18:31:00 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add BIM ClickHouse secret to prod

Browse Source
This commit is contained in:
Kochetkov S 2026-05-25 11:44:48 +03:00
parent 2dca6d1c78
commit 69c93d2ed9
5 changed files with 46 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
infrastructure.yaml
View File

@ -275,6 +275,35 @@ environments:
lifecycle:
ignore_changes: true
- name: bim-yc-clickhouse-secret
namespace: platform
type: opaque
custom_keys:
CLICKHOUSE_SSL: "true"
constant_keys:
CLICKHOUSE_CERT: postgres_ca
random_keys:
CLICKHOUSE_HOST:
length: 32
special: false
CLICKHOUSE_PORT:
length: 5
special: false
CLICKHOUSE_HOSTNAME:
length: 32
special: false
CLICKHOUSE_DATABASE:
length: 32
special: false
CLICKHOUSE_USER:
length: 32
special: false
CLICKHOUSE_PASSWORD:
length: 32
special: false
lifecycle:
ignore_changes: true
# # Пример секрета для другой базы данных (test_db/test)
# - name: test-db-secret
# namespace: pulse

4
live/prod/env.hcl
View File

@ -1,8 +1,8 @@
# Конфигурация для окружения prod
locals {
environment = "prod"
folder_id = get_env("YC_PROD_FOLDER_ID", "")
folder_id = get_env("YC_PROD_FOLDER_ID", "")
# Общие параметры для всех компонентов в prod
common_tags = {
Environment = "prod"

7
live/prod/secrets/terragrunt.hcl
View File

@ -15,7 +15,7 @@ dependency "namespace" {
names = []
}
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
}
dependency "s3" {
@ -28,7 +28,7 @@ dependency "s3" {
service_accounts = {}
}
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
}
dependency "database" {
@ -37,7 +37,7 @@ dependency "database" {
database_outputs_map = {}
}
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
}
locals {
@ -123,6 +123,7 @@ inputs = {
dependencies = try(secret.dependencies, {})
yc_sa_key_names = try(secret.yc_sa_key_names, {})
custom_keys = try(secret.custom_keys, {})
constant_keys = try(secret.constant_keys, {})
random_keys = try(secret.random_keys, {})
labels = try(secret.labels, {})
annotations = try(secret.annotations, {})

9
modules/k8s-secret/main.tf
View File

@ -80,6 +80,9 @@ locals {
endpoint = "https://storage.yandexcloud.net"
},
try(secret.custom_keys, {}),
{
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
}
@ -95,12 +98,18 @@ locals {
},
# Кастомные статические поля
try(secret.custom_keys, {}),
{
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
# Рандомные поля
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
}
) : merge(
try(secret.custom_keys, {}),
{
for key, constant_name in try(secret.constant_keys, {}) : key => try(var.constants[constant_name], "")
},
{
for key, config in try(secret.random_keys, {}) : key => random_password.secrets["${name}:${key}"].result
}

3
modules/k8s-secret/variables.tf
View File

@ -17,7 +17,8 @@ variable "secrets" {
secret_key = optional(string, "secret_key")
service_account_id = optional(string, "service_account_id")
}), {})
custom_keys = optional(map(string), {})
custom_keys = optional(map(string), {})
constant_keys = optional(map(string), {})
random_keys = optional(map(object({
length = optional(number, 32)
special = optional(bool, false)