mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-05 18:31:00 +03:00
++ remove dead yc-only and unused k8s-secrets modules from contour
This commit is contained in:
parent
d08b3e1771
commit
758226e29f
@ -1,21 +0,0 @@
|
|||||||
|
|
||||||
resource "kubernetes_secret" "this" {
|
|
||||||
for_each = {
|
|
||||||
for idx, secret in var.secrets : secret.name => secret
|
|
||||||
}
|
|
||||||
|
|
||||||
metadata {
|
|
||||||
name = each.value.name
|
|
||||||
namespace = each.value.namespace
|
|
||||||
labels = try(each.value.labels, {})
|
|
||||||
annotations = try(each.value.annotations, {})
|
|
||||||
}
|
|
||||||
|
|
||||||
type = each.value.secret_type
|
|
||||||
|
|
||||||
data = each.value.data
|
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
ignore_changes = each.value.ignore_changes ? [data] : []
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,10 +0,0 @@
|
|||||||
output "secrets" {
|
|
||||||
description = "Map созданных секретов"
|
|
||||||
value = {
|
|
||||||
for k, v in kubernetes_secret.this : k => {
|
|
||||||
name = v.metadata[0].name
|
|
||||||
namespace = v.metadata[0].namespace
|
|
||||||
id = v.id
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
variable "secrets" {
|
|
||||||
description = "Список секретов для создания"
|
|
||||||
type = list(object({
|
|
||||||
name = string
|
|
||||||
namespace = string
|
|
||||||
secret_type = string
|
|
||||||
data = map(string)
|
|
||||||
labels = optional(map(string))
|
|
||||||
annotations = optional(map(string))
|
|
||||||
ignore_changes = optional(bool, false)
|
|
||||||
}))
|
|
||||||
}
|
|
||||||
@ -1,164 +0,0 @@
|
|||||||
locals {
|
|
||||||
raw_topics = var.topics
|
|
||||||
|
|
||||||
topics = {
|
|
||||||
for topic in local.raw_topics : topic.name => {
|
|
||||||
name = topic.name
|
|
||||||
owner = topic.owner
|
|
||||||
cluster_ref = topic.clusterRef
|
|
||||||
cluster = var.kafka_cluster_refs[topic.clusterRef]
|
|
||||||
|
|
||||||
partitions = try(
|
|
||||||
tonumber(topic.partitions[var.environment]),
|
|
||||||
try(tonumber(topic.partitions._default), try(tonumber(topic.partitions), var.kafka_cluster_refs[topic.clusterRef].default_partitions))
|
|
||||||
)
|
|
||||||
|
|
||||||
replication_factor = try(
|
|
||||||
tonumber(topic.replicationFactor[var.environment]),
|
|
||||||
try(tonumber(topic.replicationFactor._default), try(tonumber(topic.replicationFactor), var.kafka_cluster_refs[topic.clusterRef].default_replication_factor))
|
|
||||||
)
|
|
||||||
|
|
||||||
config = {
|
|
||||||
for key, value in merge(
|
|
||||||
try(topic.inheritDefaultConfig, true) ? try(var.kafka_cluster_refs[topic.clusterRef].default_topic_config, {}) : {},
|
|
||||||
try(topic.config, {})
|
|
||||||
) : key => try(tostring(value[var.environment]), try(tostring(value._default), tostring(value)))
|
|
||||||
}
|
|
||||||
|
|
||||||
deletion_policy = try(topic.deletionPolicy, "orphan")
|
|
||||||
|
|
||||||
owner_roles = try(topic.ownerRoles, null) == null ? var.default_user_roles : topic.ownerRoles
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
user_grants = flatten([
|
|
||||||
for user in var.users : [
|
|
||||||
for permission in try(user.permissions, []) : [
|
|
||||||
for role in permission.roles : {
|
|
||||||
cluster_ref = user.clusterRef
|
|
||||||
user = user.name
|
|
||||||
topic_name = permission.topic
|
|
||||||
role = role
|
|
||||||
}
|
|
||||||
]
|
|
||||||
]
|
|
||||||
])
|
|
||||||
|
|
||||||
permission_tuples = concat(
|
|
||||||
flatten([
|
|
||||||
for topic in values(local.topics) : [
|
|
||||||
for role in topic.owner_roles : {
|
|
||||||
cluster_ref = topic.cluster_ref
|
|
||||||
user = topic.owner
|
|
||||||
topic_name = topic.name
|
|
||||||
role = role
|
|
||||||
}
|
|
||||||
]
|
|
||||||
]),
|
|
||||||
local.user_grants
|
|
||||||
)
|
|
||||||
|
|
||||||
user_clusters = {
|
|
||||||
for item in distinct(concat(
|
|
||||||
[
|
|
||||||
for tuple in local.permission_tuples : "${tuple.cluster_ref}:${tuple.user}"
|
|
||||||
],
|
|
||||||
[
|
|
||||||
for user in var.users : "${user.clusterRef}:${user.name}"
|
|
||||||
]
|
|
||||||
)) : item => {
|
|
||||||
cluster_ref = split(":", item)[0]
|
|
||||||
user = split(":", item)[1]
|
|
||||||
cluster_id = var.kafka_cluster_refs[split(":", item)[0]].cluster_id
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
user_permissions = {
|
|
||||||
for user_key, user in local.user_clusters : user_key => distinct([
|
|
||||||
for tuple in local.permission_tuples : {
|
|
||||||
topic_name = tuple.topic_name
|
|
||||||
role = tuple.role
|
|
||||||
}
|
|
||||||
if "${tuple.cluster_ref}:${tuple.user}" == user_key
|
|
||||||
])
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "random_password" "kafka_user" {
|
|
||||||
for_each = var.create_users ? local.user_clusters : {}
|
|
||||||
|
|
||||||
length = var.user_password_length
|
|
||||||
special = false
|
|
||||||
upper = true
|
|
||||||
lower = true
|
|
||||||
numeric = true
|
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
ignore_changes = all
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_mdb_kafka_topic" "this" {
|
|
||||||
for_each = local.topics
|
|
||||||
|
|
||||||
cluster_id = each.value.cluster.cluster_id
|
|
||||||
name = each.value.name
|
|
||||||
partitions = each.value.partitions
|
|
||||||
replication_factor = each.value.replication_factor
|
|
||||||
|
|
||||||
dynamic "topic_config" {
|
|
||||||
for_each = length(each.value.config) == 0 ? [] : [each.value.config]
|
|
||||||
content {
|
|
||||||
cleanup_policy = (
|
|
||||||
try(topic_config.value["cleanup.policy"], null) == "delete" ? "CLEANUP_POLICY_DELETE" :
|
|
||||||
try(topic_config.value["cleanup.policy"], null) == "compact" ? "CLEANUP_POLICY_COMPACT" :
|
|
||||||
null
|
|
||||||
)
|
|
||||||
compression_type = try(topic_config.value["compression.type"], null)
|
|
||||||
min_insync_replicas = try(
|
|
||||||
tonumber(topic_config.value["min.insync.replicas"]),
|
|
||||||
null
|
|
||||||
)
|
|
||||||
retention_bytes = try(
|
|
||||||
tonumber(topic_config.value["retention.bytes"]),
|
|
||||||
null
|
|
||||||
)
|
|
||||||
retention_ms = try(
|
|
||||||
tonumber(topic_config.value["retention.ms"]),
|
|
||||||
null
|
|
||||||
)
|
|
||||||
segment_bytes = try(
|
|
||||||
tonumber(topic_config.value["segment.bytes"]),
|
|
||||||
null
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
prevent_destroy = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_mdb_kafka_user" "this" {
|
|
||||||
for_each = var.create_users ? local.user_clusters : {}
|
|
||||||
|
|
||||||
cluster_id = each.value.cluster_id
|
|
||||||
name = each.value.user
|
|
||||||
password = random_password.kafka_user[each.key].result
|
|
||||||
|
|
||||||
dynamic "permission" {
|
|
||||||
for_each = try(local.user_permissions[each.key], [])
|
|
||||||
content {
|
|
||||||
topic_name = permission.value.topic_name
|
|
||||||
role = permission.value.role
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
prevent_destroy = true
|
|
||||||
ignore_changes = [password]
|
|
||||||
}
|
|
||||||
|
|
||||||
depends_on = [yandex_mdb_kafka_topic.this]
|
|
||||||
}
|
|
||||||
@ -1,28 +0,0 @@
|
|||||||
output "topic_names" {
|
|
||||||
description = "Kafka topics managed by this service manifest state."
|
|
||||||
value = keys(yandex_mdb_kafka_topic.this)
|
|
||||||
}
|
|
||||||
|
|
||||||
output "user_names" {
|
|
||||||
description = "Kafka users managed by this service manifest state."
|
|
||||||
value = [for user in yandex_mdb_kafka_user.this : user.name]
|
|
||||||
}
|
|
||||||
|
|
||||||
output "kafka_outputs_map" {
|
|
||||||
description = "Map for k8s-secret module. Key format: clusterRef:user."
|
|
||||||
value = {
|
|
||||||
for key, item in local.user_clusters : key => {
|
|
||||||
host = try(var.kafka_cluster_refs[item.cluster_ref].host, "")
|
|
||||||
hostname = try(format("%s:%s", var.kafka_cluster_refs[item.cluster_ref].host, tostring(var.kafka_cluster_refs[item.cluster_ref].port)), "")
|
|
||||||
port = tostring(try(var.kafka_cluster_refs[item.cluster_ref].port, 9091))
|
|
||||||
username = item.user
|
|
||||||
password = try(random_password.kafka_user[key].result, "")
|
|
||||||
sasl_mechanism = try(var.kafka_cluster_refs[item.cluster_ref].sasl_mechanism, "SCRAM-SHA-512")
|
|
||||||
security_protocol = try(var.kafka_cluster_refs[item.cluster_ref].security_protocol, "SASL_SSL")
|
|
||||||
bootstrap_server = try(format("%s:%s", var.kafka_cluster_refs[item.cluster_ref].host, tostring(var.kafka_cluster_refs[item.cluster_ref].port)), "")
|
|
||||||
bootstrap_servers = try(format("%s:%s", var.kafka_cluster_refs[item.cluster_ref].host, tostring(var.kafka_cluster_refs[item.cluster_ref].port)), "")
|
|
||||||
bootstrap_servers_json = try(jsonencode([format("%s:%s", var.kafka_cluster_refs[item.cluster_ref].host, tostring(var.kafka_cluster_refs[item.cluster_ref].port))]), "[]")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
@ -1,78 +0,0 @@
|
|||||||
variable "environment" {
|
|
||||||
description = "Target environment name, for example stage/preprod/prod."
|
|
||||||
type = string
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "topics" {
|
|
||||||
description = "Kafka topics declared in infrastructure.yaml under environments.<env>.kafka.topics."
|
|
||||||
type = list(object({
|
|
||||||
name = string
|
|
||||||
owner = string
|
|
||||||
clusterRef = string
|
|
||||||
partitions = any
|
|
||||||
replicationFactor = any
|
|
||||||
config = optional(any, {})
|
|
||||||
inheritDefaultConfig = optional(bool, true)
|
|
||||||
deletionPolicy = optional(string, "orphan")
|
|
||||||
ownerRoles = optional(list(string))
|
|
||||||
}))
|
|
||||||
default = []
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "users" {
|
|
||||||
description = "User-centric Kafka access declarations from infrastructure.yaml under environments.<env>.kafka.users."
|
|
||||||
type = list(object({
|
|
||||||
name = string
|
|
||||||
clusterRef = string
|
|
||||||
adopt = optional(bool, false)
|
|
||||||
permissions = optional(list(object({
|
|
||||||
topic = string
|
|
||||||
roles = list(string)
|
|
||||||
})), [])
|
|
||||||
}))
|
|
||||||
default = []
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "kafka_cluster_refs" {
|
|
||||||
description = "Environment clusterRef mapping from infrastructure.yaml."
|
|
||||||
type = map(object({
|
|
||||||
cluster_id = string
|
|
||||||
host = optional(string, "")
|
|
||||||
port = optional(number, 9091)
|
|
||||||
sasl_mechanism = optional(string, "SCRAM-SHA-512")
|
|
||||||
security_protocol = optional(string, "SASL_SSL")
|
|
||||||
default_partitions = optional(number, 3)
|
|
||||||
default_replication_factor = optional(number, 1)
|
|
||||||
max_replication_factor = optional(number, 1)
|
|
||||||
default_topic_config = optional(map(string), {})
|
|
||||||
}))
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "kafka_policy" {
|
|
||||||
description = "Platform policy for service-owned Kafka declarations."
|
|
||||||
type = object({
|
|
||||||
allow_create = optional(bool, true)
|
|
||||||
allow_delete = optional(bool, false)
|
|
||||||
allow_partition_increase = optional(bool, true)
|
|
||||||
allow_partition_decrease = optional(bool, false)
|
|
||||||
})
|
|
||||||
default = {}
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "create_users" {
|
|
||||||
description = "Create one Kafka user per topic owner."
|
|
||||||
type = bool
|
|
||||||
default = true
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "default_user_roles" {
|
|
||||||
description = "Kafka roles granted to generated owner users on their topics."
|
|
||||||
type = list(string)
|
|
||||||
default = ["ACCESS_ROLE_PRODUCER", "ACCESS_ROLE_CONSUMER"]
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "user_password_length" {
|
|
||||||
description = "Generated Kafka user password length."
|
|
||||||
type = number
|
|
||||||
default = 32
|
|
||||||
}
|
|
||||||
@ -1,3 +0,0 @@
|
|||||||
terraform {
|
|
||||||
required_version = ">= 1.5.0"
|
|
||||||
}
|
|
||||||
@ -1,59 +0,0 @@
|
|||||||
locals {
|
|
||||||
databases_map = { for db in var.databases : "${db.cluster_id}:${db.database.name}:${db.user.name}" => db }
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "random_password" "user_password" {
|
|
||||||
for_each = local.databases_map
|
|
||||||
|
|
||||||
length = try(each.value.user.password_length, 32)
|
|
||||||
special = try(each.value.user.password_special, false)
|
|
||||||
upper = true
|
|
||||||
lower = true
|
|
||||||
numeric = true
|
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
ignore_changes = all
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_mdb_postgresql_user" "this" {
|
|
||||||
for_each = local.databases_map
|
|
||||||
|
|
||||||
cluster_id = each.value.cluster_id
|
|
||||||
name = each.value.user.name
|
|
||||||
password = random_password.user_password[each.key].result
|
|
||||||
conn_limit = try(each.value.user.conn_limit, 10)
|
|
||||||
|
|
||||||
# Permissions только на ДРУГИЕ существующие БД
|
|
||||||
# Permission на свою БД НЕ добавляем - owner получает доступ автоматически
|
|
||||||
# и БД ещё не существует на момент создания user
|
|
||||||
dynamic "permission" {
|
|
||||||
for_each = distinct(compact(try(each.value.user.permissions, [])))
|
|
||||||
content {
|
|
||||||
database_name = permission.value
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
ignore_changes = [password, permission, generate_password]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_mdb_postgresql_database" "this" {
|
|
||||||
for_each = local.databases_map
|
|
||||||
|
|
||||||
cluster_id = each.value.cluster_id
|
|
||||||
name = each.value.database.name
|
|
||||||
owner = yandex_mdb_postgresql_user.this[each.key].name
|
|
||||||
lc_collate = try(each.value.database.lc_collate, "en_US.UTF-8")
|
|
||||||
lc_type = try(each.value.database.lc_type, "en_US.UTF-8")
|
|
||||||
|
|
||||||
depends_on = [yandex_mdb_postgresql_user.this]
|
|
||||||
|
|
||||||
dynamic "extension" {
|
|
||||||
for_each = try(each.value.database.extensions, [])
|
|
||||||
content {
|
|
||||||
name = extension.value
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,27 +0,0 @@
|
|||||||
output "databases" {
|
|
||||||
description = "Map of created databases (cluster_id:db_name:user_name => data)"
|
|
||||||
value = {
|
|
||||||
for key, db in local.databases_map : key => {
|
|
||||||
cluster_id = db.cluster_id
|
|
||||||
host = try(db.database.host, "")
|
|
||||||
port = 6432
|
|
||||||
database_name = yandex_mdb_postgresql_database.this[key].name
|
|
||||||
user_name = yandex_mdb_postgresql_user.this[key].name
|
|
||||||
password = random_password.user_password[key].result
|
|
||||||
}
|
|
||||||
}
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
|
|
||||||
output "database_outputs_map" {
|
|
||||||
description = "Map for secrets module (cluster_id:db_name:user_name => credentials)"
|
|
||||||
value = {
|
|
||||||
for key, db in local.databases_map : key => {
|
|
||||||
host = try(db.database.host, "")
|
|
||||||
database_name = yandex_mdb_postgresql_database.this[key].name
|
|
||||||
user_name = yandex_mdb_postgresql_user.this[key].name
|
|
||||||
password = random_password.user_password[key].result
|
|
||||||
}
|
|
||||||
}
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
@ -1,20 +0,0 @@
|
|||||||
variable "databases" {
|
|
||||||
description = "List of databases to create"
|
|
||||||
type = list(object({
|
|
||||||
cluster_id = string
|
|
||||||
database = object({
|
|
||||||
name = string
|
|
||||||
host = optional(string, "")
|
|
||||||
lc_collate = optional(string, "en_US.UTF-8")
|
|
||||||
lc_type = optional(string, "en_US.UTF-8")
|
|
||||||
extensions = optional(list(string), [])
|
|
||||||
})
|
|
||||||
user = object({
|
|
||||||
name = string
|
|
||||||
password_length = optional(number, 32)
|
|
||||||
password_special = optional(bool, false)
|
|
||||||
conn_limit = optional(number, 10)
|
|
||||||
permissions = optional(list(string), [])
|
|
||||||
})
|
|
||||||
}))
|
|
||||||
}
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
|
|
||||||
terraform {
|
|
||||||
required_version = ">= 1.0"
|
|
||||||
}
|
|
||||||
@ -1,93 +0,0 @@
|
|||||||
locals {
|
|
||||||
buckets_map = { for bucket in var.buckets : bucket.name => bucket }
|
|
||||||
yc_service_accounts_map = { for sa in var.yc_service_accounts : sa.name => sa }
|
|
||||||
|
|
||||||
yc_service_account_folder_roles = length(local.yc_service_accounts_map) > 0 ? merge([
|
|
||||||
for sa_name, sa in local.yc_service_accounts_map : {
|
|
||||||
for role in try(sa.folder_roles, []) : "${sa_name}:${role}" => {
|
|
||||||
sa_name = sa_name
|
|
||||||
role = role
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]...) : {}
|
|
||||||
|
|
||||||
yc_service_accounts_with_static_key = {
|
|
||||||
for sa_name, sa in local.yc_service_accounts_map : sa_name => sa
|
|
||||||
if try(sa.create_static_access_key, true)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_iam_service_account" "sa" {
|
|
||||||
for_each = local.buckets_map
|
|
||||||
|
|
||||||
name = "${each.key}-sa"
|
|
||||||
description = "Service account for ${each.key} bucket"
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_iam_service_account_static_access_key" "sa_key" {
|
|
||||||
for_each = local.buckets_map
|
|
||||||
|
|
||||||
service_account_id = yandex_iam_service_account.sa[each.key].id
|
|
||||||
description = "Static access key for ${each.key} bucket"
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_storage_bucket" "this" {
|
|
||||||
for_each = local.buckets_map
|
|
||||||
|
|
||||||
bucket = each.key
|
|
||||||
acl = each.value.acl
|
|
||||||
folder_id = var.folder_id
|
|
||||||
|
|
||||||
dynamic "versioning" {
|
|
||||||
for_each = try(each.value.versioning.enabled, false) ? [1] : []
|
|
||||||
content {
|
|
||||||
enabled = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
dynamic "cors_rule" {
|
|
||||||
for_each = try(each.value.cors.enabled, false) ? [1] : []
|
|
||||||
content {
|
|
||||||
allowed_headers = try(each.value.cors.allowed_headers, [])
|
|
||||||
allowed_methods = try(each.value.cors.allowed_methods, [])
|
|
||||||
allowed_origins = try(each.value.cors.allowed_origins, [])
|
|
||||||
expose_headers = try(each.value.cors.expose_headers, [])
|
|
||||||
max_age_seconds = try(each.value.cors.max_age_seconds, 3600)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_storage_bucket_iam_binding" "uploader" {
|
|
||||||
for_each = local.buckets_map
|
|
||||||
|
|
||||||
bucket = yandex_storage_bucket.this[each.key].bucket
|
|
||||||
role = coalesce(each.value.role, var.default_bucket_role)
|
|
||||||
|
|
||||||
members = [
|
|
||||||
"serviceAccount:${yandex_iam_service_account.sa[each.key].id}"
|
|
||||||
]
|
|
||||||
|
|
||||||
depends_on = [yandex_storage_bucket.this]
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_iam_service_account" "custom_sa" {
|
|
||||||
for_each = local.yc_service_accounts_map
|
|
||||||
|
|
||||||
name = each.value.name
|
|
||||||
description = try(each.value.description, "")
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_resourcemanager_folder_iam_member" "custom_sa_role" {
|
|
||||||
for_each = local.yc_service_account_folder_roles
|
|
||||||
|
|
||||||
folder_id = var.folder_id
|
|
||||||
role = each.value.role
|
|
||||||
member = "serviceAccount:${yandex_iam_service_account.custom_sa[each.value.sa_name].id}"
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_iam_service_account_static_access_key" "custom_sa_key" {
|
|
||||||
for_each = local.yc_service_accounts_with_static_key
|
|
||||||
|
|
||||||
service_account_id = yandex_iam_service_account.custom_sa[each.key].id
|
|
||||||
description = "Static access key for ${each.key}"
|
|
||||||
}
|
|
||||||
@ -1,42 +0,0 @@
|
|||||||
output "bucket_name" {
|
|
||||||
description = "Name of the first bucket (for backward compatibility)"
|
|
||||||
value = length(var.buckets) > 0 ? yandex_storage_bucket.this[var.buckets[0].name].bucket : ""
|
|
||||||
}
|
|
||||||
|
|
||||||
output "access_key" {
|
|
||||||
description = "Access key for the first bucket (for backward compatibility)"
|
|
||||||
value = length(var.buckets) > 0 ? yandex_iam_service_account_static_access_key.sa_key[var.buckets[0].name].access_key : ""
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
|
|
||||||
output "secret_key" {
|
|
||||||
description = "Secret key for the first bucket (for backward compatibility)"
|
|
||||||
value = length(var.buckets) > 0 ? yandex_iam_service_account_static_access_key.sa_key[var.buckets[0].name].secret_key : ""
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
|
|
||||||
output "buckets" {
|
|
||||||
description = "Map of all buckets (name => data)"
|
|
||||||
value = {
|
|
||||||
for name, bucket in yandex_storage_bucket.this : name => {
|
|
||||||
bucket_name = bucket.bucket
|
|
||||||
access_key = yandex_iam_service_account_static_access_key.sa_key[name].access_key
|
|
||||||
secret_key = yandex_iam_service_account_static_access_key.sa_key[name].secret_key
|
|
||||||
service_account_id = yandex_iam_service_account.sa[name].id
|
|
||||||
}
|
|
||||||
}
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
|
|
||||||
output "service_accounts" {
|
|
||||||
description = "Map of additional YC service accounts (name => data)"
|
|
||||||
value = {
|
|
||||||
for name, sa in yandex_iam_service_account.custom_sa : name => {
|
|
||||||
service_account_id = sa.id
|
|
||||||
access_key = try(yandex_iam_service_account_static_access_key.custom_sa_key[name].access_key, "")
|
|
||||||
secret_key = try(yandex_iam_service_account_static_access_key.custom_sa_key[name].secret_key, "")
|
|
||||||
folder_roles = try(local.yc_service_accounts_map[name].folder_roles, [])
|
|
||||||
}
|
|
||||||
}
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
@ -1,41 +0,0 @@
|
|||||||
variable "buckets" {
|
|
||||||
description = "List of S3 buckets to create"
|
|
||||||
type = list(object({
|
|
||||||
name = string
|
|
||||||
acl = optional(string, "private")
|
|
||||||
role = optional(string, null)
|
|
||||||
versioning = optional(object({
|
|
||||||
enabled = bool
|
|
||||||
}), { enabled = false })
|
|
||||||
cors = optional(object({
|
|
||||||
enabled = optional(bool, false)
|
|
||||||
allowed_headers = optional(list(string), [])
|
|
||||||
allowed_methods = optional(list(string), [])
|
|
||||||
allowed_origins = optional(list(string), [])
|
|
||||||
expose_headers = optional(list(string), [])
|
|
||||||
max_age_seconds = optional(number, 3600)
|
|
||||||
}), { enabled = false })
|
|
||||||
}))
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "yc_service_accounts" {
|
|
||||||
description = "Additional Yandex Cloud service accounts with optional folder roles and static keys"
|
|
||||||
type = list(object({
|
|
||||||
name = string
|
|
||||||
description = optional(string, "")
|
|
||||||
folder_roles = optional(list(string), [])
|
|
||||||
create_static_access_key = optional(bool, true)
|
|
||||||
}))
|
|
||||||
default = []
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "folder_id" {
|
|
||||||
description = "Yandex Cloud folder ID"
|
|
||||||
type = string
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "default_bucket_role" {
|
|
||||||
description = "Default role for SA on bucket level (storage.uploader, storage.viewer, storage.editor)"
|
|
||||||
type = string
|
|
||||||
default = "storage.uploader"
|
|
||||||
}
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
|
|
||||||
terraform {
|
|
||||||
required_version = ">= 1.0"
|
|
||||||
}
|
|
||||||
@ -1,56 +0,0 @@
|
|||||||
locals {
|
|
||||||
valkey_users_map = {
|
|
||||||
for valkey_user in var.valkey_users : "${valkey_user.cluster_id}:${valkey_user.user.name}" => valkey_user
|
|
||||||
}
|
|
||||||
|
|
||||||
valkey_user_permissions = {
|
|
||||||
for key, valkey_user in local.valkey_users_map : key => merge(
|
|
||||||
try(valkey_user.permissions.commands, null) != null ? {
|
|
||||||
commands = valkey_user.permissions.commands
|
|
||||||
} : {},
|
|
||||||
try(valkey_user.permissions.categories, null) != null ? {
|
|
||||||
categories = valkey_user.permissions.categories
|
|
||||||
} : {},
|
|
||||||
try(valkey_user.permissions.patterns, null) != null ? {
|
|
||||||
patterns = valkey_user.permissions.patterns
|
|
||||||
} : {},
|
|
||||||
try(valkey_user.permissions.pub_sub_channels, try(valkey_user.permissions.pubSubChannels, null)) != null ? {
|
|
||||||
pub_sub_channels = try(valkey_user.permissions.pub_sub_channels, valkey_user.permissions.pubSubChannels)
|
|
||||||
} : {},
|
|
||||||
try(valkey_user.permissions.sanitize_payload, try(valkey_user.permissions.sanitizePayload, null)) != null ? {
|
|
||||||
sanitize_payload = try(valkey_user.permissions.sanitize_payload, valkey_user.permissions.sanitizePayload)
|
|
||||||
} : {},
|
|
||||||
try(valkey_user.permissions.databases, null) != null ? {
|
|
||||||
databases = valkey_user.permissions.databases
|
|
||||||
} : {}
|
|
||||||
)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "random_password" "user_password" {
|
|
||||||
for_each = local.valkey_users_map
|
|
||||||
|
|
||||||
length = try(each.value.user.password_length, 32)
|
|
||||||
special = try(each.value.user.password_special, false)
|
|
||||||
upper = true
|
|
||||||
lower = true
|
|
||||||
numeric = true
|
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
ignore_changes = all
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
resource "yandex_mdb_redis_user" "this" {
|
|
||||||
for_each = local.valkey_users_map
|
|
||||||
|
|
||||||
cluster_id = each.value.cluster_id
|
|
||||||
name = each.value.user.name
|
|
||||||
passwords = [random_password.user_password[each.key].result]
|
|
||||||
enabled = try(each.value.user.enabled, true)
|
|
||||||
permissions = local.valkey_user_permissions[each.key]
|
|
||||||
|
|
||||||
lifecycle {
|
|
||||||
ignore_changes = [passwords]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,29 +0,0 @@
|
|||||||
output "valkey_users" {
|
|
||||||
description = "Map of created Valkey/Redis users (cluster_id:user_name => data)"
|
|
||||||
value = {
|
|
||||||
for key, valkey_user in local.valkey_users_map : key => {
|
|
||||||
cluster_id = valkey_user.cluster_id
|
|
||||||
host = try(valkey_user.host, "")
|
|
||||||
port = tostring(try(valkey_user.port, "6380"))
|
|
||||||
user_name = yandex_mdb_redis_user.this[key].name
|
|
||||||
password = random_password.user_password[key].result
|
|
||||||
permissions = local.valkey_user_permissions[key]
|
|
||||||
user_enabled = try(valkey_user.user.enabled, true)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
|
|
||||||
output "valkey_outputs_map" {
|
|
||||||
description = "Map for secrets module (cluster_id:user_name => credentials)"
|
|
||||||
value = {
|
|
||||||
for key, valkey_user in local.valkey_users_map : key => {
|
|
||||||
cluster_id = valkey_user.cluster_id
|
|
||||||
host = try(valkey_user.host, "")
|
|
||||||
port = tostring(try(valkey_user.port, "6380"))
|
|
||||||
user_name = yandex_mdb_redis_user.this[key].name
|
|
||||||
password = random_password.user_password[key].result
|
|
||||||
}
|
|
||||||
}
|
|
||||||
sensitive = true
|
|
||||||
}
|
|
||||||
@ -1,25 +0,0 @@
|
|||||||
variable "valkey_users" {
|
|
||||||
description = "List of Valkey/Redis users to create"
|
|
||||||
type = list(object({
|
|
||||||
cluster_id = string
|
|
||||||
host = optional(string, "")
|
|
||||||
port = optional(string, "6380")
|
|
||||||
user = object({
|
|
||||||
name = string
|
|
||||||
password_length = optional(number, 32)
|
|
||||||
password_special = optional(bool, false)
|
|
||||||
enabled = optional(bool, true)
|
|
||||||
})
|
|
||||||
permissions = optional(object({
|
|
||||||
commands = optional(string)
|
|
||||||
categories = optional(string)
|
|
||||||
patterns = optional(string)
|
|
||||||
pub_sub_channels = optional(string)
|
|
||||||
pubSubChannels = optional(string)
|
|
||||||
sanitize_payload = optional(string)
|
|
||||||
sanitizePayload = optional(string)
|
|
||||||
databases = optional(list(number))
|
|
||||||
}), {})
|
|
||||||
}))
|
|
||||||
default = []
|
|
||||||
}
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
|
|
||||||
terraform {
|
|
||||||
required_version = ">= 1.0"
|
|
||||||
}
|
|
||||||
Loading…
Reference in New Issue
Block a user