mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-05 18:31:00 +03:00
96 lines
3.4 KiB
HCL
96 lines
3.4 KiB
HCL
# Entity contract for the in-cluster Kafka implementation.
|
|
#
|
|
# The entity-level variables (topics, users, kafka_policy, create_users,
|
|
# default_user_roles, user_password_length) are BYTE-IDENTICAL to
|
|
# modules/kafka-topics-yc so that a single declaration in infrastructure.yaml
|
|
# drives both the Yandex MDB and the in-cluster (Bitnami/Strimzi) backends.
|
|
#
|
|
# Only `kafka_cluster_refs` differs: instead of a Yandex MDB cluster_id it
|
|
# carries the in-cluster bootstrap endpoint and SASL/TLS parameters. Admin
|
|
# SASL credentials are supplied by the root unit from Vault, never hardcoded.
|
|
|
|
variable "environment" {
|
|
description = "Target environment name, for example stage/preprod/<contour>."
|
|
type = string
|
|
}
|
|
|
|
variable "topics" {
|
|
description = "Kafka topics declared in infrastructure.yaml under environments.<env>.kafka.topics."
|
|
type = list(object({
|
|
name = string
|
|
owner = string
|
|
clusterRef = string
|
|
partitions = any
|
|
replicationFactor = any
|
|
config = optional(any, {})
|
|
inheritDefaultConfig = optional(bool, true)
|
|
deletionPolicy = optional(string, "orphan")
|
|
ownerRoles = optional(list(string))
|
|
}))
|
|
default = []
|
|
}
|
|
|
|
variable "users" {
|
|
description = "User-centric Kafka access declarations from infrastructure.yaml under environments.<env>.kafka.users. Each user lists the topics it may access and the roles it holds."
|
|
type = list(object({
|
|
name = string
|
|
clusterRef = string
|
|
permissions = optional(list(object({
|
|
topic = string
|
|
roles = list(string)
|
|
})), [])
|
|
}))
|
|
default = []
|
|
}
|
|
|
|
variable "kafka_cluster_refs" {
|
|
description = "Environment clusterRef mapping. In-cluster shape: bootstrap endpoint + SASL/TLS, no Yandex cluster_id."
|
|
type = map(object({
|
|
bootstrap_servers = string
|
|
host = optional(string, "")
|
|
port = optional(number, 9092)
|
|
sasl_mechanism = optional(string, "SCRAM-SHA-512")
|
|
security_protocol = optional(string, "SASL_PLAINTEXT")
|
|
tls_enabled = optional(bool, false)
|
|
default_partitions = optional(number, 3)
|
|
default_replication_factor = optional(number, 1)
|
|
max_replication_factor = optional(number, 1)
|
|
default_topic_config = optional(map(string), {})
|
|
}))
|
|
}
|
|
|
|
variable "kafka_policy" {
|
|
description = "Platform policy for service-owned Kafka declarations."
|
|
type = object({
|
|
allow_create = optional(bool, true)
|
|
allow_delete = optional(bool, false)
|
|
allow_partition_increase = optional(bool, true)
|
|
allow_partition_decrease = optional(bool, false)
|
|
})
|
|
default = {}
|
|
}
|
|
|
|
variable "create_users" {
|
|
description = "Create one Kafka user per topic owner."
|
|
type = bool
|
|
default = true
|
|
}
|
|
|
|
variable "create_acls" {
|
|
description = "Create ACL entries. Some brokers run without an authorizer configured (authorizer.class.name unset) and reject any ACL write with \"Security features are disabled\" — set false on those contours."
|
|
type = bool
|
|
default = true
|
|
}
|
|
|
|
variable "default_user_roles" {
|
|
description = "Kafka roles granted to generated owner users on their topics."
|
|
type = list(string)
|
|
default = ["ACCESS_ROLE_PRODUCER", "ACCESS_ROLE_CONSUMER"]
|
|
}
|
|
|
|
variable "user_password_length" {
|
|
description = "Generated Kafka user (SCRAM) password length."
|
|
type = number
|
|
default = 32
|
|
}
|