mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-05 18:31:00 +03:00
++ contour: flat live/ (INFRA_ENV), port vault-platform-secrets module + namespace/vault-secrets units; drop product live/prod
This commit is contained in:
parent
128b7b4451
commit
98d9a29a6e
@ -1,15 +0,0 @@
|
|||||||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
|
||||||
terraform {
|
|
||||||
backend "s3" {
|
|
||||||
access_key = ""
|
|
||||||
bucket = "tfstate-terragrunt-stage"
|
|
||||||
endpoint = "storage.yandexcloud.net"
|
|
||||||
force_path_style = true
|
|
||||||
key = "./terraform.tfstate"
|
|
||||||
region = "ru-central1"
|
|
||||||
secret_key = ""
|
|
||||||
skip_credentials_validation = true
|
|
||||||
skip_metadata_api_check = true
|
|
||||||
skip_region_validation = true
|
|
||||||
}
|
|
||||||
}
|
|
||||||
50
live/namespace/terragrunt.hcl
Normal file
50
live/namespace/terragrunt.hcl
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
include "root" {
|
||||||
|
path = find_in_parent_folders()
|
||||||
|
}
|
||||||
|
|
||||||
|
locals {
|
||||||
|
repo_root = try(get_repo_root(), "${get_terragrunt_dir()}/../..")
|
||||||
|
infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
|
||||||
|
|
||||||
|
env_override = trimspace(get_env("INFRA_ENV", ""))
|
||||||
|
env_from_file = try(trimspace(local.infra_config.current_environment), "")
|
||||||
|
available_envs = sort(keys(try(local.infra_config.environments, {})))
|
||||||
|
env_fallback = try(local.available_envs[0], "")
|
||||||
|
|
||||||
|
env_name = local.env_override != "" ? local.env_override : (
|
||||||
|
local.env_from_file != "" ? local.env_from_file : local.env_fallback
|
||||||
|
)
|
||||||
|
|
||||||
|
env_config = try(local.infra_config.environments[local.env_name], {})
|
||||||
|
}
|
||||||
|
|
||||||
|
remote_state {
|
||||||
|
backend = "s3"
|
||||||
|
generate = {
|
||||||
|
path = "backend.tf"
|
||||||
|
if_exists = "overwrite_terragrunt"
|
||||||
|
}
|
||||||
|
config = {
|
||||||
|
endpoint = get_env("TF_STATE_S3_ENDPOINT", "")
|
||||||
|
bucket = get_env("TF_STATE_S3_BUCKET", "")
|
||||||
|
key = "${local.env_name}/namespace/terraform.tfstate"
|
||||||
|
region = get_env("TF_STATE_S3_REGION", "ru-central1")
|
||||||
|
access_key = get_env("S3_ACCESS_KEY", get_env("AWS_ACCESS_KEY_ID", ""))
|
||||||
|
secret_key = get_env("S3_SECRET_KEY", get_env("AWS_SECRET_ACCESS_KEY", ""))
|
||||||
|
skip_region_validation = true
|
||||||
|
skip_credentials_validation = true
|
||||||
|
skip_metadata_api_check = true
|
||||||
|
skip_bucket_root_access = true
|
||||||
|
force_path_style = true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
terraform {
|
||||||
|
source = "${get_terragrunt_dir()}/../../modules//k8s-namespace"
|
||||||
|
}
|
||||||
|
|
||||||
|
inputs = {
|
||||||
|
namespaces = try(local.env_config.namespaces, [])
|
||||||
|
kubeconfig_path = get_env("KUBECONFIG", "")
|
||||||
|
kube_context = get_env("KUBE_CONTEXT", "")
|
||||||
|
}
|
||||||
@ -1,31 +0,0 @@
|
|||||||
include "root" {
|
|
||||||
path = find_in_parent_folders()
|
|
||||||
}
|
|
||||||
|
|
||||||
include "env" {
|
|
||||||
path = find_in_parent_folders("env.hcl")
|
|
||||||
expose = true
|
|
||||||
merge_strategy = "deep"
|
|
||||||
}
|
|
||||||
|
|
||||||
locals {
|
|
||||||
repo_root = try(get_repo_root(), "${get_terragrunt_dir()}/../../..")
|
|
||||||
infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
|
|
||||||
env_name = basename(dirname(get_terragrunt_dir()))
|
|
||||||
env_config = local.infra_config.environments[local.env_name]
|
|
||||||
}
|
|
||||||
|
|
||||||
terraform {
|
|
||||||
source = "${get_terragrunt_dir()}/../../../modules//yc-database"
|
|
||||||
}
|
|
||||||
|
|
||||||
inputs = {
|
|
||||||
databases = local.env_config.databases
|
|
||||||
|
|
||||||
yc_token = get_env("YC_TOKEN", "")
|
|
||||||
yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
|
|
||||||
yc_cloud_id = get_env("YC_CLOUD_ID", "")
|
|
||||||
yc_folder_id = get_env("YC_PROD_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
|
|
||||||
kubeconfig_path = get_env("KUBECONFIG", "")
|
|
||||||
kube_context = get_env("KUBE_CONTEXT", "")
|
|
||||||
}
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
# Конфигурация для окружения prod
|
|
||||||
locals {
|
|
||||||
environment = "prod"
|
|
||||||
folder_id = get_env("YC_PROD_FOLDER_ID", "")
|
|
||||||
|
|
||||||
# Общие параметры для всех компонентов в prod
|
|
||||||
common_tags = {
|
|
||||||
Environment = "prod"
|
|
||||||
Project = "terraform"
|
|
||||||
ManagedBy = "terraform"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,61 +0,0 @@
|
|||||||
include "root" {
|
|
||||||
path = find_in_parent_folders()
|
|
||||||
}
|
|
||||||
|
|
||||||
include "env" {
|
|
||||||
path = find_in_parent_folders("env.hcl")
|
|
||||||
expose = true
|
|
||||||
merge_strategy = "deep"
|
|
||||||
}
|
|
||||||
|
|
||||||
locals {
|
|
||||||
repo_root = try(get_repo_root(), "${get_terragrunt_dir()}/../../..")
|
|
||||||
infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
|
|
||||||
env_name = basename(dirname(get_terragrunt_dir()))
|
|
||||||
env_config = local.infra_config.environments[local.env_name]
|
|
||||||
|
|
||||||
kafka_topics = try(local.env_config.kafka.topics, [])
|
|
||||||
kafka_users = try(local.env_config.kafka.users, [])
|
|
||||||
|
|
||||||
kafka_cluster_refs = {
|
|
||||||
for ref, cfg in local.env_config.kafka_cluster_refs : ref => merge(cfg, {
|
|
||||||
cluster_id = startswith(tostring(cfg.cluster_id), "env:") ? get_env(trimprefix(tostring(cfg.cluster_id), "env:"), "") : tostring(cfg.cluster_id)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
terraform {
|
|
||||||
source = "${get_terragrunt_dir()}/../../../modules//kafka-topics-yc"
|
|
||||||
}
|
|
||||||
|
|
||||||
generate "import_existing" {
|
|
||||||
path = "import_existing.tf"
|
|
||||||
if_exists = "overwrite"
|
|
||||||
contents = join("\n\n", [
|
|
||||||
for user in local.kafka_users : <<-EOF
|
|
||||||
import {
|
|
||||||
to = yandex_mdb_kafka_user.this["${user.clusterRef}:${user.name}"]
|
|
||||||
id = "${local.kafka_cluster_refs[user.clusterRef].cluster_id}:${user.name}"
|
|
||||||
}
|
|
||||||
EOF
|
|
||||||
if try(user.adopt, false)
|
|
||||||
])
|
|
||||||
}
|
|
||||||
|
|
||||||
inputs = {
|
|
||||||
environment = local.env_name
|
|
||||||
topics = local.kafka_topics
|
|
||||||
users = local.kafka_users
|
|
||||||
kafka_cluster_refs = local.kafka_cluster_refs
|
|
||||||
kafka_policy = local.env_config.kafka_policy
|
|
||||||
create_users = true
|
|
||||||
default_user_roles = ["ACCESS_ROLE_PRODUCER", "ACCESS_ROLE_CONSUMER"]
|
|
||||||
user_password_length = 32
|
|
||||||
|
|
||||||
yc_token = get_env("YC_TOKEN", "")
|
|
||||||
yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
|
|
||||||
yc_cloud_id = get_env("YC_CLOUD_ID", "")
|
|
||||||
yc_folder_id = get_env("YC_PROD_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
|
|
||||||
kubeconfig_path = get_env("KUBECONFIG", "")
|
|
||||||
kube_context = get_env("KUBE_CONTEXT", "")
|
|
||||||
}
|
|
||||||
@ -1,31 +0,0 @@
|
|||||||
include "root" {
|
|
||||||
path = find_in_parent_folders()
|
|
||||||
}
|
|
||||||
|
|
||||||
include "env" {
|
|
||||||
path = find_in_parent_folders("env.hcl")
|
|
||||||
expose = true
|
|
||||||
merge_strategy = "deep"
|
|
||||||
}
|
|
||||||
|
|
||||||
locals {
|
|
||||||
repo_root = try(get_repo_root(), "${get_terragrunt_dir()}/../../..")
|
|
||||||
infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
|
|
||||||
env_name = basename(dirname(get_terragrunt_dir()))
|
|
||||||
env_config = local.infra_config.environments[local.env_name]
|
|
||||||
}
|
|
||||||
|
|
||||||
terraform {
|
|
||||||
source = "${get_terragrunt_dir()}/../../../modules//k8s-namespace"
|
|
||||||
}
|
|
||||||
|
|
||||||
inputs = {
|
|
||||||
namespaces = local.env_config.namespaces
|
|
||||||
|
|
||||||
yc_token = get_env("YC_TOKEN", "")
|
|
||||||
yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
|
|
||||||
yc_cloud_id = get_env("YC_CLOUD_ID", "")
|
|
||||||
yc_folder_id = get_env("YC_PROD_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
|
|
||||||
kubeconfig_path = get_env("KUBECONFIG", "")
|
|
||||||
kube_context = get_env("KUBE_CONTEXT", "")
|
|
||||||
}
|
|
||||||
@ -1,52 +0,0 @@
|
|||||||
include "root" {
|
|
||||||
path = find_in_parent_folders()
|
|
||||||
}
|
|
||||||
|
|
||||||
include "env" {
|
|
||||||
path = find_in_parent_folders("env.hcl")
|
|
||||||
expose = true
|
|
||||||
merge_strategy = "deep"
|
|
||||||
}
|
|
||||||
|
|
||||||
locals {
|
|
||||||
repo_root = try(get_repo_root(), "${get_terragrunt_dir()}/../../..")
|
|
||||||
infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
|
|
||||||
env_name = basename(dirname(get_terragrunt_dir()))
|
|
||||||
env_var_prefix = upper(replace(local.env_name, "-", "_"))
|
|
||||||
env_config = local.infra_config.environments[local.env_name]
|
|
||||||
rabbitmq_config = try(local.env_config.rabbitmq, {})
|
|
||||||
}
|
|
||||||
|
|
||||||
terraform {
|
|
||||||
source = "${get_terragrunt_dir()}/../../../modules//rabbitmq"
|
|
||||||
}
|
|
||||||
|
|
||||||
inputs = {
|
|
||||||
environment = local.env_name
|
|
||||||
|
|
||||||
management_endpoint = get_env("RABBITMQ_${local.env_var_prefix}_MANAGEMENT_ENDPOINT", try(local.rabbitmq_config.management_endpoint, ""))
|
|
||||||
management_username = get_env("RABBITMQ_${local.env_var_prefix}_MANAGEMENT_USERNAME", "")
|
|
||||||
management_password = get_env("RABBITMQ_${local.env_var_prefix}_MANAGEMENT_PASSWORD", "")
|
|
||||||
|
|
||||||
amqp_host = get_env("RABBITMQ_${local.env_var_prefix}_AMQP_HOST", try(local.rabbitmq_config.amqp_host, "rabbitmq.rabbitmq.svc.cluster.local"))
|
|
||||||
amqp_port = tonumber(get_env("RABBITMQ_${local.env_var_prefix}_AMQP_PORT", tostring(try(local.rabbitmq_config.amqp_port, 5672))))
|
|
||||||
|
|
||||||
rabbitmq_policy = try(local.rabbitmq_config.policy, {})
|
|
||||||
vhosts = try(local.rabbitmq_config.vhosts, [])
|
|
||||||
users = try(local.rabbitmq_config.users, [])
|
|
||||||
permissions = try(local.rabbitmq_config.permissions, [])
|
|
||||||
topic_permissions = try(local.rabbitmq_config.topic_permissions, [])
|
|
||||||
exchanges = try(local.rabbitmq_config.exchanges, [])
|
|
||||||
queues = try(local.rabbitmq_config.queues, [])
|
|
||||||
bindings = try(local.rabbitmq_config.bindings, [])
|
|
||||||
policies = try(local.rabbitmq_config.policies, [])
|
|
||||||
unmanaged_output_users = try(local.rabbitmq_config.unmanaged_output_users, [])
|
|
||||||
unmanaged_output_permissions = try(local.rabbitmq_config.unmanaged_output_permissions, [])
|
|
||||||
|
|
||||||
yc_token = get_env("YC_TOKEN", "")
|
|
||||||
yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
|
|
||||||
yc_cloud_id = get_env("YC_CLOUD_ID", "")
|
|
||||||
yc_folder_id = get_env("YC_PROD_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
|
|
||||||
kubeconfig_path = get_env("KUBECONFIG", "")
|
|
||||||
kube_context = get_env("KUBE_CONTEXT", "")
|
|
||||||
}
|
|
||||||
@ -1,33 +0,0 @@
|
|||||||
include "root" {
|
|
||||||
path = find_in_parent_folders()
|
|
||||||
}
|
|
||||||
|
|
||||||
include "env" {
|
|
||||||
path = find_in_parent_folders("env.hcl")
|
|
||||||
expose = true
|
|
||||||
merge_strategy = "deep"
|
|
||||||
}
|
|
||||||
|
|
||||||
locals {
|
|
||||||
repo_root = try(get_repo_root(), "${get_terragrunt_dir()}/../../..")
|
|
||||||
infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
|
|
||||||
env_name = basename(dirname(get_terragrunt_dir()))
|
|
||||||
env_config = local.infra_config.environments[local.env_name]
|
|
||||||
}
|
|
||||||
|
|
||||||
terraform {
|
|
||||||
source = "${get_terragrunt_dir()}/../../../modules//yc-s3"
|
|
||||||
}
|
|
||||||
|
|
||||||
inputs = {
|
|
||||||
buckets = local.env_config.buckets
|
|
||||||
yc_service_accounts = try(local.env_config.yc_service_accounts, [])
|
|
||||||
folder_id = get_env("YC_PROD_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
|
|
||||||
|
|
||||||
yc_token = get_env("YC_TOKEN", "")
|
|
||||||
yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
|
|
||||||
yc_cloud_id = get_env("YC_CLOUD_ID", "")
|
|
||||||
yc_folder_id = get_env("YC_PROD_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
|
|
||||||
kubeconfig_path = get_env("KUBECONFIG", "")
|
|
||||||
kube_context = get_env("KUBE_CONTEXT", "")
|
|
||||||
}
|
|
||||||
@ -1,224 +0,0 @@
|
|||||||
include "root" {
|
|
||||||
path = find_in_parent_folders()
|
|
||||||
}
|
|
||||||
|
|
||||||
include "env" {
|
|
||||||
path = find_in_parent_folders("env.hcl")
|
|
||||||
expose = true
|
|
||||||
merge_strategy = "deep"
|
|
||||||
}
|
|
||||||
|
|
||||||
dependency "namespace" {
|
|
||||||
config_path = "../namespace"
|
|
||||||
mock_outputs = {
|
|
||||||
namespaces = {}
|
|
||||||
names = []
|
|
||||||
}
|
|
||||||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
|
||||||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
|
||||||
}
|
|
||||||
|
|
||||||
dependency "s3" {
|
|
||||||
config_path = "../s3"
|
|
||||||
mock_outputs = {
|
|
||||||
bucket_name = "mock-bucket"
|
|
||||||
access_key = "mock-access-key"
|
|
||||||
secret_key = "mock-secret-key"
|
|
||||||
buckets = {}
|
|
||||||
service_accounts = {}
|
|
||||||
}
|
|
||||||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
|
||||||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
|
||||||
}
|
|
||||||
|
|
||||||
dependency "database" {
|
|
||||||
config_path = "../database"
|
|
||||||
mock_outputs = {
|
|
||||||
database_outputs_map = {}
|
|
||||||
}
|
|
||||||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
|
||||||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
|
||||||
}
|
|
||||||
|
|
||||||
dependency "rabbitmq" {
|
|
||||||
config_path = "../rabbitmq"
|
|
||||||
mock_outputs = {
|
|
||||||
rabbitmq_outputs_map = {}
|
|
||||||
}
|
|
||||||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
|
||||||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
|
||||||
}
|
|
||||||
|
|
||||||
dependency "kafka_topics" {
|
|
||||||
config_path = "../kafka-topics"
|
|
||||||
mock_outputs = {
|
|
||||||
kafka_outputs_map = {}
|
|
||||||
}
|
|
||||||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
|
||||||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
|
||||||
}
|
|
||||||
|
|
||||||
dependency "valkey_users" {
|
|
||||||
config_path = "../valkey-users"
|
|
||||||
mock_outputs = {
|
|
||||||
valkey_outputs_map = {}
|
|
||||||
}
|
|
||||||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
|
||||||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
|
||||||
}
|
|
||||||
|
|
||||||
locals {
|
|
||||||
yc_postgresql_ca_cert = <<-EOT
|
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIE3TCCAsWgAwIBAgIKPxb5sAAAAAAAFzANBgkqhkiG9w0BAQ0FADAfMR0wGwYD
|
|
||||||
VQQDExRZYW5kZXhJbnRlcm5hbFJvb3RDQTAeFw0xNzA2MjAxNjQ0MzdaFw0yNzA2
|
|
||||||
MjAxNjU0MzdaMFUxEjAQBgoJkiaJk/IsZAEZFgJydTEWMBQGCgmSJomT8ixkARkW
|
|
||||||
BnlhbmRleDESMBAGCgmSJomT8ixkARkWAmxkMRMwEQYDVQQDEwpZYW5kZXhDTENB
|
|
||||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqgNnjk0JKPcbsk1+KG2t
|
|
||||||
eM1AfMnEe5RkAJuBBuwVV49snhcvO1jhKBx/pCnjr6biICc1/oAFDVgU8yVYYPwp
|
|
||||||
WZ2vH3ZtscjJ/RAT/NS9OKKG7kKknhFhVYxua5xhoIQmm6usBNYYiTcWoFm1eHC8
|
|
||||||
I9oddOLSscZYbh3unVRvt+3V+drVmUx9oSUKpqMgfysiv1MN6zB3vq9TFkbhz53E
|
|
||||||
k0tEcV+W2NnDaeFhLKy284FDKLvOdTDj1EDsSAihxl7sNEKpupNuhgyy2siOqUb+
|
|
||||||
d5mO/CRfaAKGg3E6hDM3pEi48E506dJdjPXWfHKSvuguMLRlb2RWdVocRZuyWxOh
|
|
||||||
0QIDAQABo4HkMIHhMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRMU5uItjx+
|
|
||||||
TOicX1+ovC1Xq2PSnzAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8E
|
|
||||||
BAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBSrucX/oe/mUx0zOSKE
|
|
||||||
0XbUN04tajBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vY3Jscy55YW5kZXgucnUv
|
|
||||||
WWFuZGV4SW50ZXJuYWxSb290Q0EvWWFuZGV4SW50ZXJuYWxSb290Q0EuY3JsMA0G
|
|
||||||
CSqGSIb3DQEBDQUAA4ICAQAsR5Lb4Pv2FD0Kk+4oc1GEOnehxKLsQtdV81nrU+IV
|
|
||||||
l9pr2oNMdi8lwIolvHZRllLM4Ba5AcRH6YJ5fe7AjKm+5EdSkhqVWo2UOllRCbtS
|
|
||||||
wmL50+erOAkxstSlRkO6b8x1L0MOBKv54E5YcQ/Wwt27ldSb6RkEmJBGvmxObAaf
|
|
||||||
5zc51pqSqao9tnldYaCblEQ/Zmy43FliIpa2eUJoh8DqK8bVo2gcI3wbQ32tWs9u
|
|
||||||
wvKk8fo4lAdhCwhv+QHuqau1VAY9hPU106bsFIDUmijTMxjAobKBi6CkIX6EbNHU
|
|
||||||
Jv4DzYVLlDd2y0CADdn2F6I70xpCBn5cquSGuvFbqZjQDmIHwb7WQSxadkiGRWfc
|
|
||||||
zVTnmiHjJONJJIpE2t+FOV3hc+8o98OzOtNaH2QQ9j6dnKvtIGKGFeNSDp0vXPOi
|
|
||||||
QhHiIyuB7eWx+g2whktQ74UCpGDSXYnEW3s8w5wezVWIEmouq7q4rCEkTNvJ7Ico
|
|
||||||
43AgUdPzAFS2zYktw1C+cbUALM8smvXbXrXOBzMmscjIhtXvLMrpPeh23VfdJfQB
|
|
||||||
0rN2BmRCLUE8JOV+o0k98XMm83oN+lGkL1l+hyoj3ok1uI3JrsWOcDyjOds3ptcN
|
|
||||||
KimJLm27ndjcxDNo/iA6gefMJuCxFRaqI+eF4P0jSkMgnnQqZkvLGFuHCw8eRDhm
|
|
||||||
bw==
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
-----BEGIN CERTIFICATE-----
|
|
||||||
MIIFGTCCAwGgAwIBAgIQJMM7ZIy2SYxCBgK7WcFwnjANBgkqhkiG9w0BAQ0FADAf
|
|
||||||
MR0wGwYDVQQDExRZYW5kZXhJbnRlcm5hbFJvb3RDQTAeFw0xMzAyMTExMzQxNDNa
|
|
||||||
Fw0zMzAyMTExMzUxNDJaMB8xHTAbBgNVBAMTFFlhbmRleEludGVybmFsUm9vdENB
|
|
||||||
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgb4xoQjBQ7oEFk8EHVGy
|
|
||||||
1pDEmPWw0Wgw5nX9RM7LL2xQWyUuEq+Lf9Dgh+O725aZ9+SO2oEs47DHHt81/fne
|
|
||||||
5N6xOftRrCpy8hGtUR/A3bvjnQgjs+zdXvcO9cTuuzzPTFSts/iZATZsAruiepMx
|
|
||||||
SGj9S1fGwvYws/yiXWNoNBz4Tu1Tlp0g+5fp/ADjnxc6DqNk6w01mJRDbx+6rlBO
|
|
||||||
aIH2tQmJXDVoFdrhmBK9qOfjxWlIYGy83TnrvdXwi5mKTMtpEREMgyNLX75UjpvO
|
|
||||||
NkZgBvEXPQq+g91wBGsWIE2sYlguXiBniQgAJOyRuSdTxcJoG8tZkLDPRi5RouWY
|
|
||||||
gxXr13edn1TRDGco2hkdtSUBlajBMSvAq+H0hkslzWD/R+BXkn9dh0/DFnxVt4XU
|
|
||||||
5JbFyd/sKV/rF4Vygfw9ssh1ZIWdqkfZ2QXOZ2gH4AEeoN/9vEfUPwqPVzL0XEZK
|
|
||||||
r4s2WjU9mE5tHrVsQOZ80wnvYHYi2JHbl0hr5ghs4RIyJwx6LEEnj2tzMFec4f7o
|
|
||||||
dQeSsZpgRJmpvpAfRTxhIRjZBrKxnMytedAkUPguBQwjVCn7+EaKiJfpu42JG8Mm
|
|
||||||
+/dHi+Q9Tc+0tX5pKOIpQMlMxMHw8MfPmUjC3AAd9lsmCtuybYoeN2IRdbzzchJ8
|
|
||||||
l1ZuoI3gH7pcIeElfVSqSBkCAwEAAaNRME8wCwYDVR0PBAQDAgGGMA8GA1UdEwEB
|
|
||||||
/wQFMAMBAf8wHQYDVR0OBBYEFKu5xf+h7+ZTHTM5IoTRdtQ3Ti1qMBAGCSsGAQQB
|
|
||||||
gjcVAQQDAgEAMA0GCSqGSIb3DQEBDQUAA4ICAQAVpyJ1qLjqRLC34F1UXkC3vxpO
|
|
||||||
nV6WgzpzA+DUNog4Y6RhTnh0Bsir+I+FTl0zFCm7JpT/3NP9VjfEitMkHehmHhQK
|
|
||||||
c7cIBZSF62K477OTvLz+9ku2O/bGTtYv9fAvR4BmzFfyPDoAKOjJSghD1p/7El+1
|
|
||||||
eSjvcUBzLnBUtxO/iYXRNo7B3+1qo4F5Hz7rPRLI0UWW/0UAfVCO2fFtyF6C1iEY
|
|
||||||
/q0Ldbf3YIaMkf2WgGhnX9yH/8OiIij2r0LVNHS811apyycjep8y/NkG4q1Z9jEi
|
|
||||||
VEX3P6NEL8dWtXQlvlNGMcfDT3lmB+tS32CPEUwce/Ble646rukbERRwFfxXojpf
|
|
||||||
C6ium+LtJc7qnK6ygnYF4D6mz4H+3WaxJd1S1hGQxOb/3WVw63tZFnN62F6/nc5g
|
|
||||||
6T44Yb7ND6y3nVcygLpbQsws6HsjX65CoSjrrPn0YhKxNBscF7M7tLTW/5LK9uhk
|
|
||||||
yjRCkJ0YagpeLxfV1l1ZJZaTPZvY9+ylHnWHhzlq0FzcrooSSsp4i44DB2K7O2ID
|
|
||||||
87leymZkKUY6PMDa4GkDJx0dG4UXDhRETMf+NkYgtLJ+UIzMNskwVDcxO4kVL+Hi
|
|
||||||
Pj78bnC5yCw8P5YylR45LdxLzLO68unoXOyFz1etGXzszw8lJI9LNubYxk77mK8H
|
|
||||||
LpuQKbSbIERsmR+QqQ==
|
|
||||||
-----END CERTIFICATE-----
|
|
||||||
EOT
|
|
||||||
|
|
||||||
repo_root = try(get_repo_root(), "${get_terragrunt_dir()}/../../..")
|
|
||||||
env_name = basename(dirname(get_terragrunt_dir()))
|
|
||||||
|
|
||||||
# Единый декларативный источник: форма + данные секретов в одном sops-файле
|
|
||||||
# infrastructure-secrets.yaml (шифруется только data). В CI файл расшифровывается
|
|
||||||
# заранее и путь передаётся через INFRA_SECRET_VALUES_FILE; локально - fallback
|
|
||||||
# на прямую расшифровку через sops_decrypt_file. Значения передаются в модуль
|
|
||||||
# только через inputs (эфемерно), чтобы расшифрованные данные не оседали на диске.
|
|
||||||
secret_values_env_file = get_env("INFRA_SECRET_VALUES_FILE", "")
|
|
||||||
secret_values_raw = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : try(sops_decrypt_file("${local.repo_root}/infrastructure-secrets.yaml"), "")
|
|
||||||
secret_values_config = try(yamldecode(local.secret_values_raw), {})
|
|
||||||
secret_values_env = try(local.secret_values_config.environments[local.env_name], {})
|
|
||||||
|
|
||||||
secrets = try(local.secret_values_env.secrets, [])
|
|
||||||
|
|
||||||
# Нормализованный список для модуля. Ключ ресурса теперь namespace/name,
|
|
||||||
# resource_key больше не используется.
|
|
||||||
secrets_input = [
|
|
||||||
for secret in local.secrets : {
|
|
||||||
name = secret.name
|
|
||||||
namespace = secret.namespace
|
|
||||||
type = try(secret.type, "opaque")
|
|
||||||
registry_url = try(secret.registry_url, "")
|
|
||||||
data = try(secret.data, {})
|
|
||||||
depends_on = try(secret.depends_on, {})
|
|
||||||
yc_sa_key_names = try(secret.yc_sa_key_names, {})
|
|
||||||
custom_keys = try(secret.custom_keys, {})
|
|
||||||
constant_keys = try(secret.constant_keys, {})
|
|
||||||
random_keys = try(secret.random_keys, {})
|
|
||||||
credential_keys = try(secret.credential_keys, {})
|
|
||||||
labels = try(secret.labels, {})
|
|
||||||
annotations = try(secret.annotations, {})
|
|
||||||
ignore_changes = try(secret.lifecycle.ignore_changes, false)
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
||||||
generate "import_existing" {
|
|
||||||
path = "import_existing.tf"
|
|
||||||
if_exists = "overwrite"
|
|
||||||
contents = join("\n\n", [
|
|
||||||
for secret in local.secrets : <<-EOF
|
|
||||||
import {
|
|
||||||
to = kubernetes_secret.without_ignore["${secret.namespace}/${secret.name}"]
|
|
||||||
id = "${secret.namespace}/${secret.name}"
|
|
||||||
}
|
|
||||||
EOF
|
|
||||||
if try(secret.adopt, false) && try(secret.lifecycle.ignore_changes, false) == false
|
|
||||||
])
|
|
||||||
}
|
|
||||||
|
|
||||||
terraform {
|
|
||||||
source = "${get_terragrunt_dir()}/../../../modules//k8s-secret"
|
|
||||||
}
|
|
||||||
|
|
||||||
inputs = {
|
|
||||||
secrets = local.secrets_input
|
|
||||||
|
|
||||||
s3_outputs = {
|
|
||||||
bucket_name = dependency.s3.outputs.bucket_name
|
|
||||||
access_key = dependency.s3.outputs.access_key
|
|
||||||
secret_key = dependency.s3.outputs.secret_key
|
|
||||||
}
|
|
||||||
|
|
||||||
s3_buckets_map = dependency.s3.outputs.buckets
|
|
||||||
yc_service_accounts_map = try(dependency.s3.outputs.service_accounts, {})
|
|
||||||
|
|
||||||
database_outputs_map = dependency.database.outputs.database_outputs_map
|
|
||||||
rabbitmq_outputs_map = try(dependency.rabbitmq.outputs.rabbitmq_outputs_map, {})
|
|
||||||
kafka_outputs_map = try(dependency.kafka_topics.outputs.kafka_outputs_map, {})
|
|
||||||
valkey_outputs_map = dependency.valkey_users.outputs.valkey_outputs_map
|
|
||||||
|
|
||||||
constants = {
|
|
||||||
s3_endpoint = "https://storage.yandexcloud.net"
|
|
||||||
postgres_port = "6432"
|
|
||||||
postgres_ca = local.yc_postgresql_ca_cert
|
|
||||||
valkey_port = "6380"
|
|
||||||
valkey_ca = local.yc_postgresql_ca_cert
|
|
||||||
}
|
|
||||||
|
|
||||||
env_vars = {
|
|
||||||
DOCKER_REGISTRY_USERNAME = get_env("DOCKER_REGISTRY_USERNAME", "")
|
|
||||||
DOCKER_REGISTRY_PASSWORD = get_env("DOCKER_REGISTRY_PASSWORD", "")
|
|
||||||
}
|
|
||||||
|
|
||||||
yc_token = get_env("YC_TOKEN", "")
|
|
||||||
yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
|
|
||||||
yc_cloud_id = get_env("YC_CLOUD_ID", "")
|
|
||||||
yc_folder_id = get_env("YC_PROD_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
|
|
||||||
kubeconfig_path = get_env("KUBECONFIG", "")
|
|
||||||
kube_context = get_env("KUBE_CONTEXT", "")
|
|
||||||
}
|
|
||||||
@ -1,31 +0,0 @@
|
|||||||
include "root" {
|
|
||||||
path = find_in_parent_folders()
|
|
||||||
}
|
|
||||||
|
|
||||||
include "env" {
|
|
||||||
path = find_in_parent_folders("env.hcl")
|
|
||||||
expose = true
|
|
||||||
merge_strategy = "deep"
|
|
||||||
}
|
|
||||||
|
|
||||||
locals {
|
|
||||||
repo_root = try(get_repo_root(), "${get_terragrunt_dir()}/../../..")
|
|
||||||
infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
|
|
||||||
env_name = basename(dirname(get_terragrunt_dir()))
|
|
||||||
env_config = local.infra_config.environments[local.env_name]
|
|
||||||
}
|
|
||||||
|
|
||||||
terraform {
|
|
||||||
source = "${get_terragrunt_dir()}/../../../modules//yc-valkey-user"
|
|
||||||
}
|
|
||||||
|
|
||||||
inputs = {
|
|
||||||
valkey_users = try(local.env_config.valkey_users, [])
|
|
||||||
|
|
||||||
yc_token = get_env("YC_TOKEN", "")
|
|
||||||
yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
|
|
||||||
yc_cloud_id = get_env("YC_CLOUD_ID", "")
|
|
||||||
yc_folder_id = get_env("YC_PROD_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
|
|
||||||
kubeconfig_path = get_env("KUBECONFIG", "")
|
|
||||||
kube_context = get_env("KUBE_CONTEXT", "")
|
|
||||||
}
|
|
||||||
@ -1,63 +0,0 @@
|
|||||||
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
|
||||||
terraform {
|
|
||||||
required_version = ">= 1.0"
|
|
||||||
|
|
||||||
required_providers {
|
|
||||||
yandex = {
|
|
||||||
source = "yandex-cloud/yandex"
|
|
||||||
version = "~> 0.100"
|
|
||||||
}
|
|
||||||
kubernetes = {
|
|
||||||
source = "hashicorp/kubernetes"
|
|
||||||
version = "~> 2.23"
|
|
||||||
}
|
|
||||||
random = {
|
|
||||||
source = "hashicorp/random"
|
|
||||||
version = "~> 3.1"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
provider "yandex" {
|
|
||||||
token = var.yc_token != "" ? var.yc_token : null
|
|
||||||
cloud_id = var.yc_cloud_id != "" ? var.yc_cloud_id : null
|
|
||||||
folder_id = var.yc_folder_id != "" ? var.yc_folder_id : null
|
|
||||||
zone = "ru-central1-a"
|
|
||||||
}
|
|
||||||
|
|
||||||
provider "kubernetes" {
|
|
||||||
# Если kubeconfig_path не указан, провайдер использует дефолтный путь ~/.kube/config
|
|
||||||
# Если указан, берем только первый путь (KUBECONFIG может содержать несколько путей через :)
|
|
||||||
config_path = var.kubeconfig_path != "" ? split(":", var.kubeconfig_path)[0] : null
|
|
||||||
config_context = var.kube_context != "" ? var.kube_context : null
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "yc_token" {
|
|
||||||
type = string
|
|
||||||
default = ""
|
|
||||||
description = "Yandex Cloud token"
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "yc_cloud_id" {
|
|
||||||
type = string
|
|
||||||
default = ""
|
|
||||||
description = "Yandex Cloud ID"
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "yc_folder_id" {
|
|
||||||
type = string
|
|
||||||
default = ""
|
|
||||||
description = "Yandex Cloud folder ID"
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "kubeconfig_path" {
|
|
||||||
type = string
|
|
||||||
default = ""
|
|
||||||
description = "Path to kubeconfig file"
|
|
||||||
}
|
|
||||||
|
|
||||||
variable "kube_context" {
|
|
||||||
type = string
|
|
||||||
default = ""
|
|
||||||
description = "Kubernetes context"
|
|
||||||
}
|
|
||||||
69
live/vault-secrets/terragrunt.hcl
Normal file
69
live/vault-secrets/terragrunt.hcl
Normal file
@ -0,0 +1,69 @@
|
|||||||
|
include "root" {
|
||||||
|
path = find_in_parent_folders()
|
||||||
|
}
|
||||||
|
|
||||||
|
locals {
|
||||||
|
repo_root = try(get_repo_root(), "${get_terragrunt_dir()}/../..")
|
||||||
|
infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
|
||||||
|
secrets_file = "${local.repo_root}/infrastructure-secrets.yaml"
|
||||||
|
|
||||||
|
secrets_config = try(yamldecode(sops_decrypt_file(local.secrets_file)), {})
|
||||||
|
|
||||||
|
env_override = trimspace(get_env("INFRA_ENV", ""))
|
||||||
|
env_from_file = try(trimspace(local.infra_config.current_environment), "")
|
||||||
|
available_envs = sort(keys(try(local.secrets_config.environments, {})))
|
||||||
|
env_fallback = try(local.available_envs[0], "")
|
||||||
|
|
||||||
|
env_name = local.env_override != "" ? local.env_override : (
|
||||||
|
local.env_from_file != "" ? local.env_from_file : local.env_fallback
|
||||||
|
)
|
||||||
|
|
||||||
|
env_config = try(local.secrets_config.environments[local.env_name], {})
|
||||||
|
vault_config = try(local.env_config.vault, {})
|
||||||
|
vault_enabled = try(local.vault_config.enabled, false)
|
||||||
|
}
|
||||||
|
|
||||||
|
remote_state {
|
||||||
|
backend = "s3"
|
||||||
|
generate = {
|
||||||
|
path = "backend.tf"
|
||||||
|
if_exists = "overwrite_terragrunt"
|
||||||
|
}
|
||||||
|
config = {
|
||||||
|
endpoint = get_env("TF_STATE_S3_ENDPOINT", "")
|
||||||
|
bucket = get_env("TF_STATE_S3_BUCKET", "")
|
||||||
|
key = "${local.env_name}/vault-secrets/terraform.tfstate"
|
||||||
|
region = get_env("TF_STATE_S3_REGION", "ru-central1")
|
||||||
|
access_key = get_env("S3_ACCESS_KEY", get_env("AWS_ACCESS_KEY_ID", ""))
|
||||||
|
secret_key = get_env("S3_SECRET_KEY", get_env("AWS_SECRET_ACCESS_KEY", ""))
|
||||||
|
skip_region_validation = true
|
||||||
|
skip_credentials_validation = true
|
||||||
|
skip_metadata_api_check = true
|
||||||
|
skip_bucket_root_access = true
|
||||||
|
force_path_style = true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
terraform {
|
||||||
|
source = "${get_terragrunt_dir()}/../../modules//vault-platform-secrets"
|
||||||
|
}
|
||||||
|
|
||||||
|
inputs = {
|
||||||
|
vault_kv_mount = try(local.vault_config.kv_mount, "secrets")
|
||||||
|
path_prefix = try(local.vault_config.path_prefix, "vault")
|
||||||
|
common = try(local.vault_config.common, {})
|
||||||
|
infra = try(local.vault_config.infrastructure, {})
|
||||||
|
applications = try(local.vault_config.applications, {})
|
||||||
|
default_rsa_bits = try(local.vault_config.default_rsa_bits, 4096)
|
||||||
|
kubernetes_auth_backend = try(local.vault_config.kubernetes_auth_backend, "kubernetes")
|
||||||
|
|
||||||
|
create_regcred = local.vault_enabled && try(local.vault_config.features.create_regcred, true)
|
||||||
|
create_smtp_auth = local.vault_enabled && try(local.vault_config.features.create_smtp_auth, true)
|
||||||
|
create_django_auth = local.vault_enabled && try(local.vault_config.features.create_django_auth, true)
|
||||||
|
create_rsa_keys = local.vault_enabled && try(local.vault_config.features.create_rsa_keys, true)
|
||||||
|
create_infra_secrets = local.vault_enabled && try(local.vault_config.features.create_infra_secrets, true)
|
||||||
|
create_infra_policies = local.vault_enabled && try(local.vault_config.features.create_infra_policies, true)
|
||||||
|
create_infra_roles = local.vault_enabled && try(local.vault_config.features.create_infra_roles, true)
|
||||||
|
create_app_policies = local.vault_enabled && try(local.vault_config.features.create_app_policies, true)
|
||||||
|
create_app_roles = local.vault_enabled && try(local.vault_config.features.create_app_roles, true)
|
||||||
|
}
|
||||||
1272
modules/vault-platform-secrets/main.tf
Normal file
1272
modules/vault-platform-secrets/main.tf
Normal file
File diff suppressed because it is too large
Load Diff
54
modules/vault-platform-secrets/outputs.tf
Normal file
54
modules/vault-platform-secrets/outputs.tf
Normal file
@ -0,0 +1,54 @@
|
|||||||
|
output "common_secret_paths" {
|
||||||
|
description = "Paths of created common Vault secrets"
|
||||||
|
value = compact([
|
||||||
|
try(vault_kv_secret_v2.common_regcred[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.common_smtp_auth[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.common_django_auth[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.common_rsa_keys[0].name, "")
|
||||||
|
])
|
||||||
|
}
|
||||||
|
|
||||||
|
output "infra_secret_paths" {
|
||||||
|
description = "Paths of created infrastructure Vault secrets"
|
||||||
|
value = concat(
|
||||||
|
compact([
|
||||||
|
try(vault_kv_secret_v2.postgresql_admin[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.postgresql_s3[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.postgresql_users[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.rabbitmq_auth[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.minio_admin[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.kafka_bootstrap[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.zitadel_postgresql[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.camunda_identity_components[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.camunda_identity_firstuser[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.camunda_keycloak_admin[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.camunda_postgresql[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.keycloak_admin[0].name, ""),
|
||||||
|
try(vault_kv_secret_v2.keycloak_postgresql[0].name, "")
|
||||||
|
]),
|
||||||
|
[for s in values(vault_kv_secret_v2.postgresql_apps) : s.name],
|
||||||
|
[for s in values(vault_kv_secret_v2.rabbitmq_apps) : s.name],
|
||||||
|
[for s in values(vault_kv_secret_v2.minio_apps) : s.name],
|
||||||
|
[for s in values(vault_kv_secret_v2.kafka_apps) : s.name]
|
||||||
|
)
|
||||||
|
}
|
||||||
|
|
||||||
|
output "infra_policy_names" {
|
||||||
|
description = "Created infrastructure Vault policy names"
|
||||||
|
value = keys(vault_policy.infra)
|
||||||
|
}
|
||||||
|
|
||||||
|
output "infra_role_names" {
|
||||||
|
description = "Created infrastructure Vault kubernetes auth role names"
|
||||||
|
value = [for r in values(vault_kubernetes_auth_backend_role.infra) : r.role_name]
|
||||||
|
}
|
||||||
|
|
||||||
|
output "app_policy_names" {
|
||||||
|
description = "Created application Vault policy names"
|
||||||
|
value = keys(vault_policy.app)
|
||||||
|
}
|
||||||
|
|
||||||
|
output "app_role_names" {
|
||||||
|
description = "Created application Vault kubernetes auth role names"
|
||||||
|
value = [for r in values(vault_kubernetes_auth_backend_role.app) : r.role_name]
|
||||||
|
}
|
||||||
95
modules/vault-platform-secrets/variables.tf
Normal file
95
modules/vault-platform-secrets/variables.tf
Normal file
@ -0,0 +1,95 @@
|
|||||||
|
variable "vault_kv_mount" {
|
||||||
|
description = "Vault KV v2 mount"
|
||||||
|
type = string
|
||||||
|
default = "secrets"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "path_prefix" {
|
||||||
|
description = "Path prefix inside Vault mount"
|
||||||
|
type = string
|
||||||
|
default = "platform"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "common" {
|
||||||
|
description = "Common platform secret configuration"
|
||||||
|
type = any
|
||||||
|
default = {}
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "infra" {
|
||||||
|
description = "Infrastructure services secret/policy/role configuration"
|
||||||
|
type = any
|
||||||
|
default = {}
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "applications" {
|
||||||
|
description = "Application Vault access roles/policies configuration"
|
||||||
|
type = any
|
||||||
|
default = {}
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "create_regcred" {
|
||||||
|
description = "Create common dockerhub regcred secret"
|
||||||
|
type = bool
|
||||||
|
default = true
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "create_smtp_auth" {
|
||||||
|
description = "Create common SMTP auth secret"
|
||||||
|
type = bool
|
||||||
|
default = true
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "create_django_auth" {
|
||||||
|
description = "Create common django-auth secret"
|
||||||
|
type = bool
|
||||||
|
default = true
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "create_rsa_keys" {
|
||||||
|
description = "Create common RSA key pair secret"
|
||||||
|
type = bool
|
||||||
|
default = true
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "create_infra_secrets" {
|
||||||
|
description = "Create infrastructure service secrets"
|
||||||
|
type = bool
|
||||||
|
default = true
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "create_infra_policies" {
|
||||||
|
description = "Create infrastructure Vault policies"
|
||||||
|
type = bool
|
||||||
|
default = true
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "create_infra_roles" {
|
||||||
|
description = "Create infrastructure Vault kubernetes auth roles"
|
||||||
|
type = bool
|
||||||
|
default = true
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "create_app_policies" {
|
||||||
|
description = "Create application Vault policies"
|
||||||
|
type = bool
|
||||||
|
default = true
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "create_app_roles" {
|
||||||
|
description = "Create application Vault kubernetes auth roles"
|
||||||
|
type = bool
|
||||||
|
default = true
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "kubernetes_auth_backend" {
|
||||||
|
description = "Vault kubernetes auth backend path"
|
||||||
|
type = string
|
||||||
|
default = "kubernetes"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "default_rsa_bits" {
|
||||||
|
description = "Default RSA key size"
|
||||||
|
type = number
|
||||||
|
default = 4096
|
||||||
|
}
|
||||||
3
modules/vault-platform-secrets/versions.tf
Normal file
3
modules/vault-platform-secrets/versions.tf
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
terraform {
|
||||||
|
required_version = ">= 1.5.0"
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue
Block a user