sarex/terraform-contour-mirror
1
0
Fork 0
mirror of https://gitlab.sarex.io/infra/terraform-contour-mirror.git synced 2026-10-15 21:01:34 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

++ fall back to provider defaults when contour vars are set but empty
Some checks failed
Terraform Terragrunt (contour) / plan (push) Has been cancelled
Details
Terraform Terragrunt (contour) / apply (push) Has been cancelled
Details
Terraform Terragrunt (contour) / validate (push) Has been cancelled
Details

Browse Source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kochetkov S 2026-08-12 12:17:38 +03:00
parent 0d34391acd
commit a64eee3e4f
1 changed files with 26 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
live/terragrunt.hcl
View File

@ -7,6 +7,23 @@
# providers pick them up via get_env, so there is no cross-provider data-source
# ordering dependency on the vault-secrets stack.
# get_env подставляет дефолт только когда переменная НЕ ЗАДАНА. Воркфлоу
# маппит vars.* в env: безусловно, поэтому на контуре, где такая переменная
# в Gitea не заведена, она приходит пустой строкой - дефолт не срабатывает, и
# незакавыченные поля (port, tls_enabled) рендерятся как "port =" с пустой
# правой частью, что валит terraform init на Invalid expression.
locals {
pg_host = get_env("PG_ADMIN_HOST", "") != "" ? get_env("PG_ADMIN_HOST", "") : "postgresql.postgresql.svc.cluster.local"
pg_port = get_env("PG_ADMIN_PORT", "") != "" ? get_env("PG_ADMIN_PORT", "") : "5432"
pg_user = get_env("PG_ADMIN_USER", "") != "" ? get_env("PG_ADMIN_USER", "") : "postgres"
kafka_bootstrap = get_env("KAFKA_BOOTSTRAP", "") != "" ? get_env("KAFKA_BOOTSTRAP", "") : "kafka-kafka-contour-controller-0.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094"
kafka_tls = get_env("KAFKA_TLS_ENABLED", "") != "" ? get_env("KAFKA_TLS_ENABLED", "") : "false"
kafka_mechanism = get_env("KAFKA_SASL_MECHANISM", "") != "" ? get_env("KAFKA_SASL_MECHANISM", "") : "plain"
kafka_user = get_env("KAFKA_ADMIN_USER", "") != "" ? get_env("KAFKA_ADMIN_USER", "") : "inter_broker_user"
vault_k8s_role = get_env("VAULT_K8S_ROLE", "") != "" ? get_env("VAULT_K8S_ROLE", "") : "terraform"
vault_k8s_auth = get_env("VAULT_K8S_AUTH_BACKEND", "") != "" ? get_env("VAULT_K8S_AUTH_BACKEND", "") : "kubernetes"
}
remote_state {
backend = "s3"
generate = {
@ -78,17 +95,17 @@ provider "kubernetes" {
provider "vault" {
%{if get_env("VAULT_TOKEN", "") == ""~}
auth_login_kubernetes {
role = "${get_env("VAULT_K8S_ROLE", "terraform")}"
mount_path = "auth/${get_env("VAULT_K8S_AUTH_BACKEND", "kubernetes")}"
role = "${local.vault_k8s_role}"
mount_path = "auth/${local.vault_k8s_auth}"
}
%{endif~}
}
# In-cluster PostgreSQL (admin). Password injected from Vault secrets/postgresql/admin.
provider "postgresql" {
host = "${get_env("PG_ADMIN_HOST", "postgresql.postgresql.svc.cluster.local")}"
port = ${get_env("PG_ADMIN_PORT", "5432")}
username = "${get_env("PG_ADMIN_USER", "postgres")}"
host = "${local.pg_host}"
port = ${local.pg_port}
username = "${local.pg_user}"
password = "${get_env("PG_ADMIN_PASSWORD", "")}"
sslmode = "disable"
superuser = false
@ -96,16 +113,16 @@ provider "postgresql" {
# In-cluster Kafka (Bitnami). Admin = inter_broker super-user from Vault secrets/kafka/bootstrap.
provider "kafka" {
bootstrap_servers = ["${get_env("KAFKA_BOOTSTRAP", "kafka-kafka-contour-controller-0.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094")}"]
tls_enabled = ${get_env("KAFKA_TLS_ENABLED", "false")}
bootstrap_servers = ["${local.kafka_bootstrap}"]
tls_enabled = ${local.kafka_tls}
%{if get_env("KAFKA_CA_CERT", "") != ""~}
ca_cert = <<-EOT
${get_env("KAFKA_CA_CERT", "")}
EOT
%{endif~}
%{if get_env("KAFKA_ADMIN_PASSWORD", "") != ""~}
sasl_mechanism = "${get_env("KAFKA_SASL_MECHANISM", "plain")}"
sasl_username = "${get_env("KAFKA_ADMIN_USER", "inter_broker_user")}"
sasl_mechanism = "${local.kafka_mechanism}"
sasl_username = "${local.kafka_user}"
sasl_password = "${get_env("KAFKA_ADMIN_PASSWORD", "")}"
%{endif~}
}