mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-06 02:31:35 +03:00
1273 lines
48 KiB
HCL
1273 lines
48 KiB
HCL
locals {
|
|
regcred_input = try(var.common.regcred, {})
|
|
regcred_manual = try(trimspace(local.regcred_input.dockerconfigjson), "")
|
|
regcred_generate = try(local.regcred_input.generate, false)
|
|
|
|
regcred_server = try(local.regcred_input.server, "https://index.docker.io/v1/")
|
|
regcred_username = try(local.regcred_input.username, "")
|
|
regcred_password_input = try(local.regcred_input.password, "")
|
|
regcred_email = try(local.regcred_input.email, "")
|
|
regcred_password = local.regcred_password_input != "" ? local.regcred_password_input : try(random_password.regcred_password[0].result, "")
|
|
regcred_auth = base64encode("${local.regcred_username}:${local.regcred_password}")
|
|
regcred_generated = jsonencode({
|
|
auths = {
|
|
(local.regcred_server) = {
|
|
username = local.regcred_username
|
|
password = local.regcred_password
|
|
email = local.regcred_email
|
|
auth = local.regcred_auth
|
|
}
|
|
}
|
|
})
|
|
regcred_value = local.regcred_manual != "" ? local.regcred_manual : (
|
|
local.regcred_generate ? local.regcred_generated : "CHANGE_ME"
|
|
)
|
|
|
|
smtp_input = merge(try(var.common.smtp_secret, {}), try(var.common.smtp_auth, {}))
|
|
smtp_manual = try(trimspace(local.smtp_input.env_json), "")
|
|
smtp_generate = try(local.smtp_input.generate, false)
|
|
|
|
smtp_password_input = try(local.smtp_input.password, "")
|
|
smtp_password = local.smtp_password_input != "" ? local.smtp_password_input : try(random_password.smtp_password[0].result, "")
|
|
smtp_generated_obj = {
|
|
SMTP_HOST = try(local.smtp_input.host, "smtp.placeholder.local")
|
|
SMTP_PORT = tostring(try(local.smtp_input.port, 587))
|
|
SMTP_USERNAME = try(local.smtp_input.username, "placeholder")
|
|
SMTP_PASSWORD = local.smtp_password
|
|
SMTP_FROM_EMAIL = try(local.smtp_input.from_email, "noreply@example.local")
|
|
SMTP_USE_TLS = tostring(try(local.smtp_input.use_tls, true))
|
|
}
|
|
smtp_generated = jsonencode(local.smtp_generated_obj)
|
|
smtp_value = local.smtp_manual != "" ? local.smtp_manual : (
|
|
local.smtp_generate ? local.smtp_generated : "{}"
|
|
)
|
|
|
|
django_input = try(var.common.django_auth, {})
|
|
django_manual = try(trimspace(local.django_input.token), "")
|
|
django_generate = try(local.django_input.generate, false)
|
|
django_extra = try(local.django_input.extra, {})
|
|
django_token = local.django_manual != "" ? local.django_manual : (
|
|
local.django_generate ? try(random_password.django_token[0].result, "") : "CHANGE_ME"
|
|
)
|
|
django_username_manual = try(trimspace(local.django_input.username), "")
|
|
django_password_manual = try(trimspace(local.django_input.password), "")
|
|
django_token_decoded = can(base64decode(local.django_token)) ? base64decode(local.django_token) : ""
|
|
django_token_parts = local.django_token_decoded != "" ? split(":", local.django_token_decoded) : []
|
|
django_username = local.django_username_manual != "" ? local.django_username_manual : (
|
|
length(local.django_token_parts) > 0 ? local.django_token_parts[0] : ""
|
|
)
|
|
django_password = local.django_password_manual != "" ? local.django_password_manual : (
|
|
length(local.django_token_parts) > 1 ? join(":", slice(local.django_token_parts, 1, length(local.django_token_parts))) : ""
|
|
)
|
|
|
|
rsa_input = try(var.common.rsa_keys, {})
|
|
rsa_generate = try(local.rsa_input.generate, false)
|
|
rsa_bits = try(local.rsa_input.bits, var.default_rsa_bits)
|
|
rsa_public_manual = try(trimspace(local.rsa_input.public_key), "")
|
|
rsa_private_manual = try(trimspace(local.rsa_input.private_key), "")
|
|
rsa_public = local.rsa_public_manual != "" ? local.rsa_public_manual : (
|
|
local.rsa_generate ? try(tls_private_key.rsa_keys[0].public_key_pem, "") : "CHANGE_ME_PUBLIC"
|
|
)
|
|
rsa_private = local.rsa_private_manual != "" ? local.rsa_private_manual : (
|
|
local.rsa_generate ? try(tls_private_key.rsa_keys[0].private_key_pem, "") : "CHANGE_ME_PRIVATE"
|
|
)
|
|
|
|
infra_defaults = {
|
|
postgresql = {
|
|
enabled = true
|
|
admin = {
|
|
enabled = true
|
|
generate = false
|
|
postgres_password = ""
|
|
}
|
|
s3 = {
|
|
enabled = false
|
|
bucket = ""
|
|
endpoint = "https://storage.yandexcloud.net"
|
|
region = "ru-central1"
|
|
access_key = ""
|
|
secret_key = ""
|
|
}
|
|
users = {
|
|
enabled = true
|
|
generate = false
|
|
values = {}
|
|
}
|
|
apps = {}
|
|
role = {
|
|
enabled = true
|
|
name = "postgresql"
|
|
service_account_names = ["postgresql"]
|
|
service_account_namespaces = ["postgresql"]
|
|
token_ttl = "24h"
|
|
}
|
|
}
|
|
rabbitmq = {
|
|
enabled = true
|
|
auth = {
|
|
enabled = true
|
|
generate = false
|
|
username = ""
|
|
password = ""
|
|
}
|
|
apps = {}
|
|
role = {
|
|
enabled = true
|
|
name = "rabbitmq"
|
|
service_account_names = ["rabbitmq"]
|
|
service_account_namespaces = ["rabbitmq"]
|
|
token_ttl = "24h"
|
|
}
|
|
}
|
|
minio = {
|
|
enabled = true
|
|
admin = {
|
|
enabled = true
|
|
generate = false
|
|
root_user = ""
|
|
root_password = ""
|
|
}
|
|
apps = {}
|
|
role = {
|
|
enabled = true
|
|
name = "minio"
|
|
service_account_names = ["minio-sa"]
|
|
service_account_namespaces = ["minio"]
|
|
token_ttl = "24h"
|
|
}
|
|
}
|
|
kafka = {
|
|
enabled = true
|
|
bootstrap = {
|
|
enabled = true
|
|
generate = false
|
|
cluster_id = ""
|
|
controller_password = ""
|
|
inter_broker_password = ""
|
|
}
|
|
apps = {}
|
|
role = {
|
|
enabled = true
|
|
name = "kafka"
|
|
service_account_names = ["kafka-kafka-contour"]
|
|
service_account_namespaces = ["kafka"]
|
|
token_ttl = "24h"
|
|
}
|
|
}
|
|
zitadel = {
|
|
enabled = true
|
|
postgresql = {
|
|
enabled = true
|
|
generate = false
|
|
password = ""
|
|
}
|
|
role = {
|
|
enabled = true
|
|
name = "zitadel"
|
|
service_account_names = ["zitadel-idp-contour"]
|
|
service_account_namespaces = ["zitadel"]
|
|
token_ttl = "24h"
|
|
}
|
|
}
|
|
camunda = {
|
|
enabled = true
|
|
identity_components = {
|
|
enabled = true
|
|
generate = false
|
|
values = {}
|
|
}
|
|
identity_firstuser = {
|
|
enabled = true
|
|
generate = false
|
|
identity_firstuser_password = ""
|
|
}
|
|
keycloak_admin = {
|
|
enabled = true
|
|
generate = false
|
|
admin_password = ""
|
|
}
|
|
postgresql = {
|
|
enabled = true
|
|
generate = false
|
|
password = ""
|
|
postgres_password = ""
|
|
}
|
|
role = {
|
|
enabled = true
|
|
name = "camunda"
|
|
service_account_names = ["camunda-connectors", "camunda-identity", "camunda-operate", "camunda-optimize", "camunda-tasklist", "camunda-postgresql", "camunda-keycloak", "camunda-identity-postgresql"]
|
|
service_account_namespaces = ["camunda"]
|
|
token_ttl = "24h"
|
|
}
|
|
}
|
|
keycloak = {
|
|
enabled = false
|
|
admin = {
|
|
enabled = true
|
|
generate = false
|
|
password = ""
|
|
}
|
|
postgresql = {
|
|
enabled = true
|
|
generate = false
|
|
host = ""
|
|
port = ""
|
|
user = ""
|
|
database = ""
|
|
password = ""
|
|
}
|
|
role = {
|
|
enabled = true
|
|
name = "keycloak"
|
|
service_account_names = ["keycloak-keycloak-contour"]
|
|
service_account_namespaces = ["keycloak"]
|
|
token_ttl = "24h"
|
|
}
|
|
}
|
|
}
|
|
|
|
infra = {
|
|
for name, cfg in local.infra_defaults :
|
|
name => merge(cfg, try(var.infra[name], {}))
|
|
}
|
|
|
|
postgresql_cfg = local.infra.postgresql
|
|
rabbitmq_cfg = local.infra.rabbitmq
|
|
minio_cfg = local.infra.minio
|
|
kafka_cfg = local.infra.kafka
|
|
zitadel_cfg = local.infra.zitadel
|
|
camunda_cfg = local.infra.camunda
|
|
keycloak_cfg = local.infra.keycloak
|
|
|
|
postgresql_admin_cfg = merge(try(local.postgresql_cfg.admin, {}), try(var.infra.postgresql.admin, {}))
|
|
postgresql_s3_cfg = merge(try(local.postgresql_cfg.s3, {}), try(var.infra.postgresql.s3, {}))
|
|
postgresql_users_cfg = merge(try(local.postgresql_cfg.users, {}), try(var.infra.postgresql.users, {}))
|
|
postgresql_apps_cfg = try(local.postgresql_cfg.apps, {})
|
|
rabbitmq_auth_cfg = merge(try(local.rabbitmq_cfg.auth, {}), try(var.infra.rabbitmq.auth, {}))
|
|
rabbitmq_apps_cfg = try(local.rabbitmq_cfg.apps, {})
|
|
minio_admin_cfg = merge(try(local.minio_cfg.admin, {}), try(var.infra.minio.admin, {}))
|
|
minio_apps_cfg = try(local.minio_cfg.apps, {})
|
|
kafka_bootstrap_cfg = merge(try(local.kafka_cfg.bootstrap, {}), try(var.infra.kafka.bootstrap, {}))
|
|
kafka_apps_cfg = try(local.kafka_cfg.apps, {})
|
|
zitadel_pg_cfg = merge(try(local.zitadel_cfg.postgresql, {}), try(var.infra.zitadel.postgresql, {}))
|
|
camunda_identity_components_cfg = merge(try(local.camunda_cfg.identity_components, {}), try(var.infra.camunda.identity_components, {}))
|
|
camunda_identity_firstuser_cfg = merge(try(local.camunda_cfg.identity_firstuser, {}), try(var.infra.camunda.identity_firstuser, {}))
|
|
camunda_keycloak_cfg = merge(try(local.camunda_cfg.keycloak_admin, {}), try(var.infra.camunda.keycloak_admin, {}))
|
|
camunda_pg_cfg = merge(try(local.camunda_cfg.postgresql, {}), try(var.infra.camunda.postgresql, {}))
|
|
keycloak_admin_cfg = merge(try(local.keycloak_cfg.admin, {}), try(var.infra.keycloak.admin, {}))
|
|
keycloak_pg_cfg = merge(try(local.keycloak_cfg.postgresql, {}), try(var.infra.keycloak.postgresql, {}))
|
|
|
|
postgresql_admin_password = trimspace(try(local.postgresql_admin_cfg.postgres_password, "")) != "" ? trimspace(local.postgresql_admin_cfg.postgres_password) : (
|
|
try(local.postgresql_admin_cfg.generate, false) ? try(random_password.postgresql_admin_password[0].result, "") : ""
|
|
)
|
|
postgresql_apps = {
|
|
for app, cfg in local.postgresql_apps_cfg :
|
|
app => merge(
|
|
{
|
|
enabled = true
|
|
generate = false
|
|
username = ""
|
|
password = ""
|
|
password_key = ""
|
|
},
|
|
cfg,
|
|
{
|
|
username = trimspace(try(cfg.username, "")) != "" ? trimspace(try(cfg.username, "")) : app
|
|
password_key = trimspace(try(cfg.password_key, "")) != "" ? trimspace(try(cfg.password_key, "")) : app
|
|
password = trimspace(try(cfg.password, "")) != "" ? trimspace(try(cfg.password, "")) : (
|
|
try(cfg.generate, false) ? try(random_password.postgresql_app_password[app].result, "") : ""
|
|
)
|
|
}
|
|
)
|
|
}
|
|
postgresql_app_user_values = {
|
|
for app, cfg in local.postgresql_apps :
|
|
try(cfg.password_key, app) => try(cfg.password, "")
|
|
if try(cfg.enabled, true) && (
|
|
try(local.postgresql_apps_cfg[app].generate, false) ||
|
|
trimspace(try(local.postgresql_apps_cfg[app].password, "")) != ""
|
|
)
|
|
}
|
|
postgresql_users_values = merge(
|
|
try(local.postgresql_users_cfg.values, {}),
|
|
local.postgresql_app_user_values,
|
|
)
|
|
postgresql_users_has_values = (
|
|
length(keys(try(local.postgresql_users_cfg.values, {}))) > 0 ||
|
|
length(keys({
|
|
for app, cfg in local.postgresql_apps_cfg :
|
|
app => cfg
|
|
if try(cfg.enabled, true) && (
|
|
try(cfg.generate, false) ||
|
|
trimspace(try(cfg.password, "")) != ""
|
|
)
|
|
})) > 0
|
|
)
|
|
|
|
rabbitmq_password = trimspace(try(local.rabbitmq_auth_cfg.password, "")) != "" ? trimspace(local.rabbitmq_auth_cfg.password) : (
|
|
try(local.rabbitmq_auth_cfg.generate, false) ? try(random_password.rabbitmq_password[0].result, "") : ""
|
|
)
|
|
rabbitmq_apps = {
|
|
for app, cfg in local.rabbitmq_apps_cfg :
|
|
app => merge(
|
|
{
|
|
enabled = true
|
|
generate = false
|
|
username = ""
|
|
password = ""
|
|
vhost = "/"
|
|
permissions = {
|
|
configure = ".*"
|
|
write = ".*"
|
|
read = ".*"
|
|
}
|
|
vhosts = []
|
|
},
|
|
cfg,
|
|
{
|
|
username = trimspace(try(cfg.username, "")) != "" ? trimspace(try(cfg.username, "")) : app
|
|
password = trimspace(try(cfg.password, "")) != "" ? trimspace(try(cfg.password, "")) : (
|
|
try(cfg.generate, false) ? try(random_password.rabbitmq_app_password[app].result, "") : ""
|
|
)
|
|
vhost = trimspace(try(cfg.vhost, "")) != "" ? trimspace(try(cfg.vhost, "")) : "/"
|
|
permissions = merge(
|
|
{
|
|
configure = ".*"
|
|
write = ".*"
|
|
read = ".*"
|
|
},
|
|
try(cfg.permissions, {})
|
|
)
|
|
vhosts = length(try(cfg.vhosts, [])) > 0 ? [
|
|
for vh in try(cfg.vhosts, []) : {
|
|
name = trimspace(try(vh.name, "")) != "" ? trimspace(try(vh.name, "")) : (trimspace(try(cfg.vhost, "")) != "" ? trimspace(try(cfg.vhost, "")) : "/")
|
|
permissions = merge(
|
|
{
|
|
configure = ".*"
|
|
write = ".*"
|
|
read = ".*"
|
|
},
|
|
try(vh.permissions, {})
|
|
)
|
|
}
|
|
] : []
|
|
}
|
|
)
|
|
}
|
|
|
|
minio_root_user = trimspace(try(local.minio_admin_cfg.root_user, "")) != "" ? trimspace(local.minio_admin_cfg.root_user) : (
|
|
try(local.minio_admin_cfg.generate, false) ? try(random_password.minio_root_user[0].result, "") : ""
|
|
)
|
|
minio_root_password = trimspace(try(local.minio_admin_cfg.root_password, "")) != "" ? trimspace(local.minio_admin_cfg.root_password) : (
|
|
try(local.minio_admin_cfg.generate, false) ? try(random_password.minio_root_password[0].result, "") : ""
|
|
)
|
|
minio_apps = {
|
|
for app, cfg in local.minio_apps_cfg :
|
|
app => merge(
|
|
{
|
|
enabled = true
|
|
generate = false
|
|
username = ""
|
|
password = ""
|
|
access_key = ""
|
|
secret_key = ""
|
|
policy = "readwrite"
|
|
buckets = []
|
|
client = {
|
|
endpoint = "http://minio.minio.svc.cluster.local:9000"
|
|
region = "us-east-1"
|
|
}
|
|
},
|
|
cfg,
|
|
{
|
|
username = trimspace(try(cfg.username, "")) != "" ? trimspace(try(cfg.username, "")) : app
|
|
password = trimspace(try(cfg.password, "")) != "" ? trimspace(try(cfg.password, "")) : (
|
|
try(cfg.generate, false) ? try(random_password.minio_app_password[app].result, "") : ""
|
|
)
|
|
access_key = trimspace(try(cfg.access_key, "")) != "" ? trimspace(try(cfg.access_key, "")) : (
|
|
trimspace(try(cfg.username, "")) != "" ? trimspace(try(cfg.username, "")) : app
|
|
)
|
|
secret_key = trimspace(try(cfg.secret_key, "")) != "" ? trimspace(try(cfg.secret_key, "")) : (
|
|
trimspace(try(cfg.password, "")) != "" ? trimspace(try(cfg.password, "")) : (
|
|
try(cfg.generate, false) ? try(random_password.minio_app_password[app].result, "") : ""
|
|
)
|
|
)
|
|
buckets = [
|
|
for bucket in try(cfg.buckets, []) : (
|
|
can(bucket.name) ? merge(
|
|
{
|
|
name = ""
|
|
policy = "private"
|
|
versioning = false
|
|
},
|
|
bucket
|
|
) : {
|
|
name = tostring(bucket)
|
|
policy = "private"
|
|
versioning = false
|
|
}
|
|
)
|
|
if trimspace(can(bucket.name) ? try(bucket.name, "") : tostring(bucket)) != ""
|
|
]
|
|
client = merge(
|
|
{
|
|
endpoint = "http://minio.minio.svc.cluster.local:9000"
|
|
region = "us-east-1"
|
|
},
|
|
try(cfg.client, {})
|
|
)
|
|
}
|
|
)
|
|
}
|
|
|
|
kafka_cluster_id = trimspace(try(local.kafka_bootstrap_cfg.cluster_id, "")) != "" ? trimspace(local.kafka_bootstrap_cfg.cluster_id) : (
|
|
try(local.kafka_bootstrap_cfg.generate, false) ? try(random_password.kafka_cluster_id[0].result, "") : ""
|
|
)
|
|
kafka_controller_password = trimspace(try(local.kafka_bootstrap_cfg.controller_password, "")) != "" ? trimspace(local.kafka_bootstrap_cfg.controller_password) : (
|
|
try(local.kafka_bootstrap_cfg.generate, false) ? try(random_password.kafka_controller_password[0].result, "") : ""
|
|
)
|
|
kafka_inter_broker_password = trimspace(try(local.kafka_bootstrap_cfg.inter_broker_password, "")) != "" ? trimspace(local.kafka_bootstrap_cfg.inter_broker_password) : (
|
|
try(local.kafka_bootstrap_cfg.generate, false) ? try(random_password.kafka_inter_broker_password[0].result, "") : ""
|
|
)
|
|
kafka_apps = {
|
|
for app, cfg in local.kafka_apps_cfg :
|
|
app => merge(
|
|
{
|
|
enabled = true
|
|
generate = false
|
|
username = ""
|
|
password = ""
|
|
auth = {
|
|
bootstrap_servers = "kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094"
|
|
security_protocol = "SASL_PLAINTEXT"
|
|
sasl_mechanism = "SCRAM-SHA-512"
|
|
}
|
|
topics = []
|
|
},
|
|
cfg,
|
|
{
|
|
username = trimspace(try(cfg.username, "")) != "" ? trimspace(try(cfg.username, "")) : app
|
|
password = trimspace(try(cfg.password, "")) != "" ? trimspace(try(cfg.password, "")) : (
|
|
try(cfg.generate, false) ? try(random_password.kafka_app_password[app].result, "") : ""
|
|
)
|
|
auth = merge(
|
|
{
|
|
bootstrap_servers = "kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094"
|
|
security_protocol = "SASL_PLAINTEXT"
|
|
sasl_mechanism = "SCRAM-SHA-512"
|
|
},
|
|
try(cfg.auth, {})
|
|
)
|
|
topics = [
|
|
for topic in try(cfg.topics, []) : merge(
|
|
{
|
|
name = ""
|
|
partitions = 3
|
|
replication_factor = 1
|
|
configs = {}
|
|
},
|
|
topic
|
|
)
|
|
if trimspace(try(topic.name, "")) != ""
|
|
]
|
|
}
|
|
)
|
|
}
|
|
|
|
zitadel_pg_password = trimspace(try(local.zitadel_pg_cfg.password, "")) != "" ? trimspace(local.zitadel_pg_cfg.password) : (
|
|
trimspace(try(local.postgresql_users_values["zitadel"], "")) != "" ? trimspace(try(local.postgresql_users_values["zitadel"], "")) : (
|
|
try(local.zitadel_pg_cfg.generate, false) ? try(random_password.zitadel_pg_password[0].result, "") : ""
|
|
)
|
|
)
|
|
|
|
camunda_keycloak_admin_password = trimspace(try(local.camunda_keycloak_cfg.admin_password, "")) != "" ? trimspace(local.camunda_keycloak_cfg.admin_password) : (
|
|
try(local.camunda_keycloak_cfg.generate, false) ? try(random_password.camunda_keycloak_admin_password[0].result, "") : ""
|
|
)
|
|
|
|
camunda_identity_components = {
|
|
"connectors-secret" = try(local.camunda_identity_components_cfg.values["connectors-secret"], "") != "" ? local.camunda_identity_components_cfg.values["connectors-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_connectors_secret[0].result, "") : "")
|
|
"console-secret" = try(local.camunda_identity_components_cfg.values["console-secret"], "") != "" ? local.camunda_identity_components_cfg.values["console-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_console_secret[0].result, "") : "")
|
|
"keycloak-secret" = try(local.camunda_identity_components_cfg.values["keycloak-secret"], "") != "" ? local.camunda_identity_components_cfg.values["keycloak-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_keycloak_secret[0].result, "") : "")
|
|
"operate-secret" = try(local.camunda_identity_components_cfg.values["operate-secret"], "") != "" ? local.camunda_identity_components_cfg.values["operate-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_operate_secret[0].result, "") : "")
|
|
"optimize-secret" = try(local.camunda_identity_components_cfg.values["optimize-secret"], "") != "" ? local.camunda_identity_components_cfg.values["optimize-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_optimize_secret[0].result, "") : "")
|
|
"tasklist-secret" = try(local.camunda_identity_components_cfg.values["tasklist-secret"], "") != "" ? local.camunda_identity_components_cfg.values["tasklist-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_tasklist_secret[0].result, "") : "")
|
|
"zeebe-secret" = try(local.camunda_identity_components_cfg.values["zeebe-secret"], "") != "" ? local.camunda_identity_components_cfg.values["zeebe-secret"] : (try(local.camunda_identity_components_cfg.generate, false) ? try(random_password.camunda_zeebe_secret[0].result, "") : "")
|
|
}
|
|
|
|
camunda_identity_firstuser_password = trimspace(try(local.camunda_identity_firstuser_cfg.identity_firstuser_password, "")) != "" ? trimspace(local.camunda_identity_firstuser_cfg.identity_firstuser_password) : (
|
|
try(local.camunda_identity_firstuser_cfg.generate, false) ? try(random_password.camunda_identity_firstuser_password[0].result, "") : ""
|
|
)
|
|
|
|
camunda_pg_password = trimspace(try(local.camunda_pg_cfg.password, "")) != "" ? trimspace(local.camunda_pg_cfg.password) : (
|
|
try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_password[0].result, "") : ""
|
|
)
|
|
camunda_pg_postgres_password = trimspace(try(local.camunda_pg_cfg.postgres_password, "")) != "" ? trimspace(local.camunda_pg_cfg.postgres_password) : (
|
|
try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_postgres_password[0].result, "") : ""
|
|
)
|
|
|
|
keycloak_admin_password = trimspace(try(local.keycloak_admin_cfg.password, "")) != "" ? trimspace(local.keycloak_admin_cfg.password) : (
|
|
try(local.keycloak_admin_cfg.generate, false) ? try(random_password.keycloak_admin_password[0].result, "") : ""
|
|
)
|
|
keycloak_pg_password = trimspace(try(local.keycloak_pg_cfg.password, "")) != "" ? trimspace(local.keycloak_pg_cfg.password) : (
|
|
trimspace(try(local.postgresql_users_values["keycloak"], "")) != "" ? trimspace(try(local.postgresql_users_values["keycloak"], "")) : (
|
|
try(local.keycloak_pg_cfg.generate, false) ? try(random_password.keycloak_pg_password[0].result, "") : ""
|
|
)
|
|
)
|
|
|
|
policy_docs = {
|
|
postgresql = <<-EOT
|
|
path "${var.vault_kv_mount}/data/postgresql/admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/postgresql/admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/data/postgresql/users" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/postgresql/users" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/data/postgresql/s3" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/postgresql/s3" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
rabbitmq = <<-EOT
|
|
path "${var.vault_kv_mount}/data/rabbitmq/auth" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/rabbitmq/auth" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/data/rabbitmq/apps/*" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/rabbitmq/apps" {
|
|
capabilities = ["list", "read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/rabbitmq/apps/*" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
minio = <<-EOT
|
|
path "${var.vault_kv_mount}/data/minio/admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/minio/admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/data/minio/apps/*" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/minio/apps" {
|
|
capabilities = ["list", "read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/minio/apps/*" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
kafka = <<-EOT
|
|
path "${var.vault_kv_mount}/data/kafka/bootstrap" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/kafka/bootstrap" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/data/kafka/apps/*" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/kafka/apps" {
|
|
capabilities = ["list", "read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/kafka/apps/*" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
zitadel = <<-EOT
|
|
path "${var.vault_kv_mount}/data/zitadel/postgresql" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/zitadel/postgresql" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
camunda = <<-EOT
|
|
path "${var.vault_kv_mount}/data/camunda/identity-components" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/camunda/identity-components" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/data/camunda/identity-firstuser" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/camunda/identity-firstuser" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/data/camunda/keycloak-admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/camunda/keycloak-admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/data/camunda/postgresql" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/camunda/postgresql" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
keycloak = <<-EOT
|
|
path "${var.vault_kv_mount}/data/keycloak/admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/keycloak/admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/data/keycloak/postgresql" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/keycloak/postgresql" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
policy_enabled = {
|
|
postgresql = try(local.postgresql_cfg.enabled, true)
|
|
rabbitmq = try(local.rabbitmq_cfg.enabled, true)
|
|
minio = try(local.minio_cfg.enabled, true)
|
|
kafka = try(local.kafka_cfg.enabled, true)
|
|
zitadel = try(local.zitadel_cfg.enabled, true)
|
|
camunda = try(local.camunda_cfg.enabled, true)
|
|
keycloak = try(local.keycloak_cfg.enabled, true)
|
|
}
|
|
|
|
role_cfgs = {
|
|
postgresql = merge(try(local.postgresql_cfg.role, {}), try(var.infra.postgresql.role, {}))
|
|
rabbitmq = merge(try(local.rabbitmq_cfg.role, {}), try(var.infra.rabbitmq.role, {}))
|
|
minio = merge(try(local.minio_cfg.role, {}), try(var.infra.minio.role, {}))
|
|
kafka = merge(try(local.kafka_cfg.role, {}), try(var.infra.kafka.role, {}))
|
|
zitadel = merge(try(local.zitadel_cfg.role, {}), try(var.infra.zitadel.role, {}))
|
|
camunda = merge(try(local.camunda_cfg.role, {}), try(var.infra.camunda.role, {}))
|
|
keycloak = merge(try(local.keycloak_cfg.role, {}), try(var.infra.keycloak.role, {}))
|
|
}
|
|
|
|
app_cfgs = {
|
|
for app, cfg in try(var.applications, {}) :
|
|
app => merge(
|
|
{
|
|
enabled = true
|
|
policy_name = app
|
|
role_name = app
|
|
service_account_names = [app]
|
|
service_account_namespaces = [app]
|
|
token_ttl = "24h"
|
|
read_paths = []
|
|
secret_path = ""
|
|
secret_data = {}
|
|
},
|
|
cfg,
|
|
{
|
|
secret_path = trimspace(try(cfg.secret_path, ""))
|
|
secret_data = try(cfg.secret_data, {})
|
|
read_paths = distinct(compact(concat(
|
|
[for path in try(cfg.read_paths, []) : trimspace(path)],
|
|
trimspace(try(cfg.secret_path, "")) != "" ? [trimspace(try(cfg.secret_path, ""))] : []
|
|
)))
|
|
}
|
|
)
|
|
if try(cfg.enabled, true)
|
|
}
|
|
|
|
app_policy_docs = {
|
|
for app, cfg in local.app_cfgs :
|
|
app => trimspace(join("\n\n", [
|
|
for path in cfg.read_paths : <<-EOT
|
|
path "${var.vault_kv_mount}/data/${path}" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "${var.vault_kv_mount}/metadata/${path}" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
]))
|
|
}
|
|
}
|
|
|
|
resource "random_password" "regcred_password" {
|
|
count = var.create_regcred && local.regcred_generate && local.regcred_password_input == "" ? 1 : 0
|
|
|
|
length = 40
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "smtp_password" {
|
|
count = var.create_smtp_auth && local.smtp_generate && local.smtp_password_input == "" ? 1 : 0
|
|
|
|
length = 40
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "django_token" {
|
|
count = var.create_django_auth && local.django_generate && local.django_manual == "" ? 1 : 0
|
|
|
|
length = 40
|
|
special = false
|
|
}
|
|
|
|
resource "tls_private_key" "rsa_keys" {
|
|
count = var.create_rsa_keys && local.rsa_generate && local.rsa_public_manual == "" && local.rsa_private_manual == "" ? 1 : 0
|
|
|
|
algorithm = "RSA"
|
|
rsa_bits = local.rsa_bits
|
|
}
|
|
|
|
resource "random_password" "postgresql_admin_password" {
|
|
count = var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(local.postgresql_admin_cfg.enabled, true) && try(local.postgresql_admin_cfg.generate, false) && trimspace(try(local.postgresql_admin_cfg.postgres_password, "")) == "" ? 1 : 0
|
|
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "postgresql_app_password" {
|
|
for_each = {
|
|
for app, cfg in local.postgresql_apps_cfg :
|
|
app => cfg if var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(cfg.enabled, true) && try(cfg.generate, false) && trimspace(try(cfg.password, "")) == ""
|
|
}
|
|
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "rabbitmq_password" {
|
|
count = var.create_infra_secrets && try(local.rabbitmq_cfg.enabled, true) && try(local.rabbitmq_auth_cfg.enabled, true) && try(local.rabbitmq_auth_cfg.generate, false) && trimspace(try(local.rabbitmq_auth_cfg.password, "")) == "" ? 1 : 0
|
|
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "rabbitmq_app_password" {
|
|
for_each = {
|
|
for app, cfg in local.rabbitmq_apps_cfg :
|
|
app => cfg if var.create_infra_secrets && try(local.rabbitmq_cfg.enabled, true) && try(cfg.enabled, true) && try(cfg.generate, false) && trimspace(try(cfg.password, "")) == ""
|
|
}
|
|
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "minio_root_user" {
|
|
count = var.create_infra_secrets && try(local.minio_cfg.enabled, true) && try(local.minio_admin_cfg.enabled, true) && try(local.minio_admin_cfg.generate, false) && trimspace(try(local.minio_admin_cfg.root_user, "")) == "" ? 1 : 0
|
|
|
|
length = 20
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "minio_root_password" {
|
|
count = var.create_infra_secrets && try(local.minio_cfg.enabled, true) && try(local.minio_admin_cfg.enabled, true) && try(local.minio_admin_cfg.generate, false) && trimspace(try(local.minio_admin_cfg.root_password, "")) == "" ? 1 : 0
|
|
|
|
length = 40
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "minio_app_password" {
|
|
for_each = {
|
|
for app, cfg in local.minio_apps_cfg :
|
|
app => cfg if var.create_infra_secrets && try(local.minio_cfg.enabled, true) && try(cfg.enabled, true) && try(cfg.generate, false) && trimspace(try(cfg.password, "")) == ""
|
|
}
|
|
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "kafka_cluster_id" {
|
|
count = var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.generate, false) && trimspace(try(local.kafka_bootstrap_cfg.cluster_id, "")) == "" ? 1 : 0
|
|
|
|
length = 22
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "kafka_controller_password" {
|
|
count = var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.generate, false) && trimspace(try(local.kafka_bootstrap_cfg.controller_password, "")) == "" ? 1 : 0
|
|
|
|
length = 20
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "kafka_inter_broker_password" {
|
|
count = var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.generate, false) && trimspace(try(local.kafka_bootstrap_cfg.inter_broker_password, "")) == "" ? 1 : 0
|
|
|
|
length = 20
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "kafka_app_password" {
|
|
for_each = {
|
|
for app, cfg in local.kafka_apps_cfg :
|
|
app => cfg if var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(cfg.enabled, true) && try(cfg.generate, false) && trimspace(try(cfg.password, "")) == ""
|
|
}
|
|
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "zitadel_pg_password" {
|
|
count = var.create_infra_secrets && try(local.zitadel_cfg.enabled, true) && try(local.zitadel_pg_cfg.enabled, true) && try(local.zitadel_pg_cfg.generate, false) && trimspace(try(local.zitadel_pg_cfg.password, "")) == "" ? 1 : 0
|
|
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "camunda_keycloak_admin_password" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_keycloak_cfg.enabled, true) && try(local.camunda_keycloak_cfg.generate, false) && trimspace(try(local.camunda_keycloak_cfg.admin_password, "")) == "" ? 1 : 0
|
|
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "camunda_connectors_secret" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["connectors-secret"], "") == "" ? 1 : 0
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "camunda_console_secret" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["console-secret"], "") == "" ? 1 : 0
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "camunda_keycloak_secret" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["keycloak-secret"], "") == "" ? 1 : 0
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "camunda_operate_secret" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["operate-secret"], "") == "" ? 1 : 0
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "camunda_optimize_secret" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["optimize-secret"], "") == "" ? 1 : 0
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "camunda_tasklist_secret" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["tasklist-secret"], "") == "" ? 1 : 0
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "camunda_zeebe_secret" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) && try(local.camunda_identity_components_cfg.generate, false) && try(local.camunda_identity_components_cfg.values["zeebe-secret"], "") == "" ? 1 : 0
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "camunda_identity_firstuser_password" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_firstuser_cfg.enabled, true) && try(local.camunda_identity_firstuser_cfg.generate, false) && trimspace(try(local.camunda_identity_firstuser_cfg.identity_firstuser_password, "")) == "" ? 1 : 0
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "camunda_pg_password" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) && try(local.camunda_pg_cfg.generate, false) && trimspace(try(local.camunda_pg_cfg.password, "")) == "" ? 1 : 0
|
|
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "camunda_pg_postgres_password" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) && try(local.camunda_pg_cfg.generate, false) && trimspace(try(local.camunda_pg_cfg.postgres_password, "")) == "" ? 1 : 0
|
|
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "keycloak_admin_password" {
|
|
count = var.create_infra_secrets && try(local.keycloak_cfg.enabled, true) && try(local.keycloak_admin_cfg.enabled, true) && try(local.keycloak_admin_cfg.generate, false) && trimspace(try(local.keycloak_admin_cfg.password, "")) == "" ? 1 : 0
|
|
|
|
length = 20
|
|
special = false
|
|
}
|
|
|
|
resource "random_password" "keycloak_pg_password" {
|
|
count = var.create_infra_secrets && try(local.keycloak_cfg.enabled, true) && try(local.keycloak_pg_cfg.enabled, true) && trimspace(try(local.keycloak_pg_cfg.password, "")) == "" && try(local.keycloak_pg_cfg.generate, false) ? 1 : 0
|
|
|
|
length = 32
|
|
special = false
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "common_regcred" {
|
|
count = var.create_regcred ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "${var.path_prefix}/common/regcred"
|
|
|
|
data_json = jsonencode({
|
|
type = "kubernetes.io/dockerconfigjson"
|
|
".dockerconfigjson" = local.regcred_value
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "common_smtp_auth" {
|
|
count = var.create_smtp_auth ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "${var.path_prefix}/common/smtp_auth"
|
|
|
|
data_json = jsonencode({
|
|
"env.json" = local.smtp_value
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "common_django_auth" {
|
|
count = var.create_django_auth ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "${var.path_prefix}/common/django_auth"
|
|
|
|
data_json = jsonencode(merge(
|
|
{
|
|
"django-auth.json" = jsonencode({
|
|
token = local.django_token
|
|
})
|
|
key = local.django_token
|
|
username = local.django_username
|
|
password = local.django_password
|
|
},
|
|
local.django_extra
|
|
))
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "common_rsa_keys" {
|
|
count = var.create_rsa_keys ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "${var.path_prefix}/common/rsa_keys"
|
|
|
|
data_json = jsonencode({
|
|
public_key = local.rsa_public
|
|
private_key = local.rsa_private
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "postgresql_admin" {
|
|
count = var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(local.postgresql_admin_cfg.enabled, true) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "postgresql/admin"
|
|
|
|
data_json = jsonencode({
|
|
"postgres-password" = local.postgresql_admin_password
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "postgresql_users" {
|
|
count = var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(local.postgresql_users_cfg.enabled, true) && local.postgresql_users_has_values ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "postgresql/users"
|
|
|
|
data_json = jsonencode(local.postgresql_users_values)
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "postgresql_s3" {
|
|
count = var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(local.postgresql_s3_cfg.enabled, false) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "postgresql/s3"
|
|
|
|
data_json = jsonencode({
|
|
bucket = trimspace(try(local.postgresql_s3_cfg.bucket, ""))
|
|
endpoint = trimspace(try(local.postgresql_s3_cfg.endpoint, "https://storage.yandexcloud.net"))
|
|
region = trimspace(try(local.postgresql_s3_cfg.region, "ru-central1"))
|
|
access_key = trimspace(try(local.postgresql_s3_cfg.access_key, ""))
|
|
secret_key = trimspace(try(local.postgresql_s3_cfg.secret_key, ""))
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "postgresql_apps" {
|
|
for_each = {
|
|
for app, cfg in local.postgresql_apps :
|
|
app => cfg if var.create_infra_secrets && try(local.postgresql_cfg.enabled, true) && try(cfg.enabled, true)
|
|
}
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "postgresql/apps/${each.key}"
|
|
|
|
data_json = jsonencode({
|
|
username = try(each.value.username, each.key)
|
|
password = try(each.value.password, "")
|
|
password_key = try(each.value.password_key, each.key)
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "rabbitmq_auth" {
|
|
count = var.create_infra_secrets && try(local.rabbitmq_cfg.enabled, true) && try(local.rabbitmq_auth_cfg.enabled, true) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "rabbitmq/auth"
|
|
|
|
data_json = jsonencode({
|
|
username = try(local.rabbitmq_auth_cfg.username, "")
|
|
password = local.rabbitmq_password
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "rabbitmq_apps" {
|
|
for_each = {
|
|
for app, cfg in local.rabbitmq_apps :
|
|
app => cfg if var.create_infra_secrets && try(local.rabbitmq_cfg.enabled, true) && try(cfg.enabled, true)
|
|
}
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "rabbitmq/apps/${each.key}"
|
|
|
|
data_json = jsonencode({
|
|
username = try(each.value.username, each.key)
|
|
password = try(each.value.password, "")
|
|
vhost = try(each.value.vhost, "/")
|
|
permissions = try(each.value.permissions, { configure = ".*", write = ".*", read = ".*" })
|
|
vhosts = try(each.value.vhosts, [])
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "minio_admin" {
|
|
count = var.create_infra_secrets && try(local.minio_cfg.enabled, true) && try(local.minio_admin_cfg.enabled, true) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "minio/admin"
|
|
|
|
data_json = jsonencode({
|
|
rootUser = local.minio_root_user
|
|
rootPassword = local.minio_root_password
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "minio_apps" {
|
|
for_each = {
|
|
for app, cfg in local.minio_apps :
|
|
app => cfg if var.create_infra_secrets && try(local.minio_cfg.enabled, true) && try(cfg.enabled, true)
|
|
}
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "minio/apps/${each.key}"
|
|
|
|
data_json = jsonencode({
|
|
username = try(each.value.username, each.key)
|
|
password = try(each.value.password, "")
|
|
access_key = try(each.value.access_key, try(each.value.username, each.key))
|
|
secret_key = try(each.value.secret_key, try(each.value.password, ""))
|
|
policy = try(each.value.policy, "readwrite")
|
|
buckets = try(each.value.buckets, [])
|
|
client = try(each.value.client, {})
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "kafka_bootstrap" {
|
|
count = var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(local.kafka_bootstrap_cfg.enabled, true) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "kafka/bootstrap"
|
|
|
|
data_json = jsonencode({
|
|
clusterId = local.kafka_cluster_id
|
|
controllerPassword = local.kafka_controller_password
|
|
interBrokerPassword = local.kafka_inter_broker_password
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "kafka_apps" {
|
|
for_each = {
|
|
for app, cfg in local.kafka_apps :
|
|
app => cfg if var.create_infra_secrets && try(local.kafka_cfg.enabled, true) && try(cfg.enabled, true)
|
|
}
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "kafka/apps/${each.key}"
|
|
|
|
data_json = jsonencode({
|
|
username = try(each.value.username, each.key)
|
|
password = try(each.value.password, "")
|
|
auth = try(each.value.auth, {})
|
|
topics = try(each.value.topics, [])
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "zitadel_postgresql" {
|
|
count = var.create_infra_secrets && try(local.zitadel_cfg.enabled, true) && try(local.zitadel_pg_cfg.enabled, true) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "zitadel/postgresql"
|
|
|
|
data_json = jsonencode({
|
|
password = local.zitadel_pg_password
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "camunda_keycloak_admin" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_keycloak_cfg.enabled, true) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "camunda/keycloak-admin"
|
|
|
|
data_json = jsonencode({
|
|
"admin-password" = local.camunda_keycloak_admin_password
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "camunda_identity_components" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_components_cfg.enabled, true) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "camunda/identity-components"
|
|
|
|
data_json = jsonencode(local.camunda_identity_components)
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "camunda_identity_firstuser" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_identity_firstuser_cfg.enabled, true) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "camunda/identity-firstuser"
|
|
|
|
data_json = jsonencode({
|
|
"identity-firstuser-password" = local.camunda_identity_firstuser_password
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "camunda_postgresql" {
|
|
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "camunda/postgresql"
|
|
|
|
data_json = jsonencode({
|
|
password = local.camunda_pg_password
|
|
"postgres-password" = local.camunda_pg_postgres_password
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "keycloak_admin" {
|
|
count = var.create_infra_secrets && try(local.keycloak_cfg.enabled, true) && try(local.keycloak_admin_cfg.enabled, true) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "keycloak/admin"
|
|
|
|
data_json = jsonencode({
|
|
password = local.keycloak_admin_password
|
|
})
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "keycloak_postgresql" {
|
|
count = var.create_infra_secrets && try(local.keycloak_cfg.enabled, true) && try(local.keycloak_pg_cfg.enabled, true) ? 1 : 0
|
|
|
|
mount = var.vault_kv_mount
|
|
name = "keycloak/postgresql"
|
|
|
|
data_json = jsonencode({
|
|
host = try(local.keycloak_pg_cfg.host, "")
|
|
port = tostring(try(local.keycloak_pg_cfg.port, ""))
|
|
user = try(local.keycloak_pg_cfg.user, "")
|
|
database = try(local.keycloak_pg_cfg.database, "")
|
|
password = local.keycloak_pg_password
|
|
})
|
|
}
|
|
|
|
resource "vault_policy" "infra" {
|
|
for_each = {
|
|
for name, enabled in local.policy_enabled :
|
|
name => name if var.create_infra_policies && enabled
|
|
}
|
|
|
|
name = each.value
|
|
policy = local.policy_docs[each.value]
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "infra" {
|
|
for_each = {
|
|
for name, role in local.role_cfgs :
|
|
name => role if var.create_infra_roles && try(local.policy_enabled[name], true) && try(role.enabled, true)
|
|
}
|
|
|
|
backend = var.kubernetes_auth_backend
|
|
role_name = try(each.value.name, each.key)
|
|
bound_service_account_names = try(each.value.service_account_names, [])
|
|
bound_service_account_namespaces = try(each.value.service_account_namespaces, [])
|
|
token_ttl = can(tonumber(try(each.value.token_ttl, ""))) ? tonumber(each.value.token_ttl) : 86400
|
|
token_policies = [try(each.value.name, each.key)]
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "application" {
|
|
for_each = {
|
|
for app, cfg in local.app_cfgs :
|
|
app => cfg if(var.create_app_policies || var.create_app_roles) && trimspace(try(cfg.secret_path, "")) != "" && length(keys(try(cfg.secret_data, {}))) > 0
|
|
}
|
|
|
|
mount = var.vault_kv_mount
|
|
name = each.value.secret_path
|
|
|
|
data_json = jsonencode(each.value.secret_data)
|
|
}
|
|
|
|
resource "vault_policy" "app" {
|
|
for_each = {
|
|
for app, cfg in local.app_cfgs :
|
|
app => cfg if var.create_app_policies && length(cfg.read_paths) > 0
|
|
}
|
|
|
|
name = try(each.value.policy_name, each.key)
|
|
policy = local.app_policy_docs[each.key]
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "app" {
|
|
for_each = {
|
|
for app, cfg in local.app_cfgs :
|
|
app => cfg if var.create_app_roles && length(cfg.read_paths) > 0
|
|
}
|
|
|
|
backend = var.kubernetes_auth_backend
|
|
role_name = try(each.value.role_name, each.key)
|
|
bound_service_account_names = try(each.value.service_account_names, [])
|
|
bound_service_account_namespaces = try(each.value.service_account_namespaces, [])
|
|
token_ttl = can(tonumber(try(each.value.token_ttl, ""))) ? tonumber(each.value.token_ttl) : 86400
|
|
token_policies = [try(each.value.policy_name, each.key)]
|
|
}
|