mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-05 18:31:00 +03:00
253 lines
10 KiB
HCL
253 lines
10 KiB
HCL
include "root" {
|
||
path = find_in_parent_folders()
|
||
}
|
||
|
||
include "env" {
|
||
path = find_in_parent_folders("env.hcl")
|
||
expose = true
|
||
merge_strategy = "deep"
|
||
}
|
||
|
||
dependency "namespace" {
|
||
config_path = "../namespace"
|
||
mock_outputs = {
|
||
namespaces = {}
|
||
names = []
|
||
}
|
||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
||
}
|
||
|
||
dependency "s3" {
|
||
config_path = "../s3"
|
||
mock_outputs = {
|
||
bucket_name = "mock-bucket"
|
||
access_key = "mock-access-key"
|
||
secret_key = "mock-secret-key"
|
||
buckets = {}
|
||
service_accounts = {}
|
||
}
|
||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
||
}
|
||
|
||
dependency "database" {
|
||
config_path = "../database"
|
||
mock_outputs = {
|
||
database_outputs_map = {}
|
||
}
|
||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
||
}
|
||
|
||
dependency "rabbitmq" {
|
||
config_path = "../rabbitmq"
|
||
mock_outputs = {
|
||
rabbitmq_outputs_map = {}
|
||
}
|
||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
||
}
|
||
|
||
dependency "kafka_topics" {
|
||
config_path = "../kafka-topics"
|
||
mock_outputs = {
|
||
kafka_outputs_map = {}
|
||
}
|
||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
||
}
|
||
|
||
dependency "valkey_users" {
|
||
config_path = "../valkey-users"
|
||
mock_outputs = {
|
||
valkey_outputs_map = {}
|
||
}
|
||
mock_outputs_allowed_terraform_commands = ["init", "validate", "plan"]
|
||
skip_outputs = get_env("TG_SKIP_DEPENDENCY_OUTPUTS", "false") == "true"
|
||
}
|
||
|
||
locals {
|
||
yc_postgresql_ca_cert = <<-EOT
|
||
-----BEGIN CERTIFICATE-----
|
||
MIIE3TCCAsWgAwIBAgIKPxb5sAAAAAAAFzANBgkqhkiG9w0BAQ0FADAfMR0wGwYD
|
||
VQQDExRZYW5kZXhJbnRlcm5hbFJvb3RDQTAeFw0xNzA2MjAxNjQ0MzdaFw0yNzA2
|
||
MjAxNjU0MzdaMFUxEjAQBgoJkiaJk/IsZAEZFgJydTEWMBQGCgmSJomT8ixkARkW
|
||
BnlhbmRleDESMBAGCgmSJomT8ixkARkWAmxkMRMwEQYDVQQDEwpZYW5kZXhDTENB
|
||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqgNnjk0JKPcbsk1+KG2t
|
||
eM1AfMnEe5RkAJuBBuwVV49snhcvO1jhKBx/pCnjr6biICc1/oAFDVgU8yVYYPwp
|
||
WZ2vH3ZtscjJ/RAT/NS9OKKG7kKknhFhVYxua5xhoIQmm6usBNYYiTcWoFm1eHC8
|
||
I9oddOLSscZYbh3unVRvt+3V+drVmUx9oSUKpqMgfysiv1MN6zB3vq9TFkbhz53E
|
||
k0tEcV+W2NnDaeFhLKy284FDKLvOdTDj1EDsSAihxl7sNEKpupNuhgyy2siOqUb+
|
||
d5mO/CRfaAKGg3E6hDM3pEi48E506dJdjPXWfHKSvuguMLRlb2RWdVocRZuyWxOh
|
||
0QIDAQABo4HkMIHhMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRMU5uItjx+
|
||
TOicX1+ovC1Xq2PSnzAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8E
|
||
BAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBSrucX/oe/mUx0zOSKE
|
||
0XbUN04tajBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vY3Jscy55YW5kZXgucnUv
|
||
WWFuZGV4SW50ZXJuYWxSb290Q0EvWWFuZGV4SW50ZXJuYWxSb290Q0EuY3JsMA0G
|
||
CSqGSIb3DQEBDQUAA4ICAQAsR5Lb4Pv2FD0Kk+4oc1GEOnehxKLsQtdV81nrU+IV
|
||
l9pr2oNMdi8lwIolvHZRllLM4Ba5AcRH6YJ5fe7AjKm+5EdSkhqVWo2UOllRCbtS
|
||
wmL50+erOAkxstSlRkO6b8x1L0MOBKv54E5YcQ/Wwt27ldSb6RkEmJBGvmxObAaf
|
||
5zc51pqSqao9tnldYaCblEQ/Zmy43FliIpa2eUJoh8DqK8bVo2gcI3wbQ32tWs9u
|
||
wvKk8fo4lAdhCwhv+QHuqau1VAY9hPU106bsFIDUmijTMxjAobKBi6CkIX6EbNHU
|
||
Jv4DzYVLlDd2y0CADdn2F6I70xpCBn5cquSGuvFbqZjQDmIHwb7WQSxadkiGRWfc
|
||
zVTnmiHjJONJJIpE2t+FOV3hc+8o98OzOtNaH2QQ9j6dnKvtIGKGFeNSDp0vXPOi
|
||
QhHiIyuB7eWx+g2whktQ74UCpGDSXYnEW3s8w5wezVWIEmouq7q4rCEkTNvJ7Ico
|
||
43AgUdPzAFS2zYktw1C+cbUALM8smvXbXrXOBzMmscjIhtXvLMrpPeh23VfdJfQB
|
||
0rN2BmRCLUE8JOV+o0k98XMm83oN+lGkL1l+hyoj3ok1uI3JrsWOcDyjOds3ptcN
|
||
KimJLm27ndjcxDNo/iA6gefMJuCxFRaqI+eF4P0jSkMgnnQqZkvLGFuHCw8eRDhm
|
||
bw==
|
||
-----END CERTIFICATE-----
|
||
-----BEGIN CERTIFICATE-----
|
||
MIIFGTCCAwGgAwIBAgIQJMM7ZIy2SYxCBgK7WcFwnjANBgkqhkiG9w0BAQ0FADAf
|
||
MR0wGwYDVQQDExRZYW5kZXhJbnRlcm5hbFJvb3RDQTAeFw0xMzAyMTExMzQxNDNa
|
||
Fw0zMzAyMTExMzUxNDJaMB8xHTAbBgNVBAMTFFlhbmRleEludGVybmFsUm9vdENB
|
||
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgb4xoQjBQ7oEFk8EHVGy
|
||
1pDEmPWw0Wgw5nX9RM7LL2xQWyUuEq+Lf9Dgh+O725aZ9+SO2oEs47DHHt81/fne
|
||
5N6xOftRrCpy8hGtUR/A3bvjnQgjs+zdXvcO9cTuuzzPTFSts/iZATZsAruiepMx
|
||
SGj9S1fGwvYws/yiXWNoNBz4Tu1Tlp0g+5fp/ADjnxc6DqNk6w01mJRDbx+6rlBO
|
||
aIH2tQmJXDVoFdrhmBK9qOfjxWlIYGy83TnrvdXwi5mKTMtpEREMgyNLX75UjpvO
|
||
NkZgBvEXPQq+g91wBGsWIE2sYlguXiBniQgAJOyRuSdTxcJoG8tZkLDPRi5RouWY
|
||
gxXr13edn1TRDGco2hkdtSUBlajBMSvAq+H0hkslzWD/R+BXkn9dh0/DFnxVt4XU
|
||
5JbFyd/sKV/rF4Vygfw9ssh1ZIWdqkfZ2QXOZ2gH4AEeoN/9vEfUPwqPVzL0XEZK
|
||
r4s2WjU9mE5tHrVsQOZ80wnvYHYi2JHbl0hr5ghs4RIyJwx6LEEnj2tzMFec4f7o
|
||
dQeSsZpgRJmpvpAfRTxhIRjZBrKxnMytedAkUPguBQwjVCn7+EaKiJfpu42JG8Mm
|
||
+/dHi+Q9Tc+0tX5pKOIpQMlMxMHw8MfPmUjC3AAd9lsmCtuybYoeN2IRdbzzchJ8
|
||
l1ZuoI3gH7pcIeElfVSqSBkCAwEAAaNRME8wCwYDVR0PBAQDAgGGMA8GA1UdEwEB
|
||
/wQFMAMBAf8wHQYDVR0OBBYEFKu5xf+h7+ZTHTM5IoTRdtQ3Ti1qMBAGCSsGAQQB
|
||
gjcVAQQDAgEAMA0GCSqGSIb3DQEBDQUAA4ICAQAVpyJ1qLjqRLC34F1UXkC3vxpO
|
||
nV6WgzpzA+DUNog4Y6RhTnh0Bsir+I+FTl0zFCm7JpT/3NP9VjfEitMkHehmHhQK
|
||
c7cIBZSF62K477OTvLz+9ku2O/bGTtYv9fAvR4BmzFfyPDoAKOjJSghD1p/7El+1
|
||
eSjvcUBzLnBUtxO/iYXRNo7B3+1qo4F5Hz7rPRLI0UWW/0UAfVCO2fFtyF6C1iEY
|
||
/q0Ldbf3YIaMkf2WgGhnX9yH/8OiIij2r0LVNHS811apyycjep8y/NkG4q1Z9jEi
|
||
VEX3P6NEL8dWtXQlvlNGMcfDT3lmB+tS32CPEUwce/Ble646rukbERRwFfxXojpf
|
||
C6ium+LtJc7qnK6ygnYF4D6mz4H+3WaxJd1S1hGQxOb/3WVw63tZFnN62F6/nc5g
|
||
6T44Yb7ND6y3nVcygLpbQsws6HsjX65CoSjrrPn0YhKxNBscF7M7tLTW/5LK9uhk
|
||
yjRCkJ0YagpeLxfV1l1ZJZaTPZvY9+ylHnWHhzlq0FzcrooSSsp4i44DB2K7O2ID
|
||
87leymZkKUY6PMDa4GkDJx0dG4UXDhRETMf+NkYgtLJ+UIzMNskwVDcxO4kVL+Hi
|
||
Pj78bnC5yCw8P5YylR45LdxLzLO68unoXOyFz1etGXzszw8lJI9LNubYxk77mK8H
|
||
LpuQKbSbIERsmR+QqQ==
|
||
-----END CERTIFICATE-----
|
||
EOT
|
||
|
||
repo_root = try(get_repo_root(), "${get_terragrunt_dir()}/../../..")
|
||
infra_config = yamldecode(file("${local.repo_root}/infrastructure.yaml"))
|
||
env_name = basename(dirname(get_terragrunt_dir()))
|
||
env_config = local.infra_config.environments[local.env_name]
|
||
|
||
# Live-значения adopt-секретов (переезд 1:1) из sops-файла infrastructure-secrets.yaml.
|
||
# В CI расшифровывается заранее (INFRA_SECRET_VALUES_FILE), локально - sops_decrypt_file.
|
||
secret_values_env_file = get_env("INFRA_SECRET_VALUES_FILE", "")
|
||
secret_values_raw = local.secret_values_env_file != "" ? file(local.secret_values_env_file) : try(sops_decrypt_file("${local.repo_root}/infrastructure-secrets.yaml"), "")
|
||
secret_values_config = try(yamldecode(local.secret_values_raw), {})
|
||
secret_values_map = try(local.secret_values_config.environments[local.env_name].secret_values, {})
|
||
}
|
||
|
||
terraform {
|
||
source = "${get_terragrunt_dir()}/../../../modules//k8s-secret"
|
||
|
||
extra_arguments "infrastructure_tfvars" {
|
||
commands = get_terraform_commands_that_need_vars()
|
||
arguments = ["-var-file=terragrunt.auto.tfvars.json"]
|
||
}
|
||
}
|
||
|
||
generate "import_existing" {
|
||
path = "import_existing.tf"
|
||
if_exists = "overwrite"
|
||
contents = join("\n\n", [
|
||
for secret in local.env_config.secrets : <<-EOF
|
||
import {
|
||
to = kubernetes_secret.without_ignore["${try(secret.resource_key, "") != "" ? secret.resource_key : secret.name}"]
|
||
id = "${secret.namespace}/${secret.name}"
|
||
}
|
||
EOF
|
||
if try(secret.adopt, false)
|
||
])
|
||
}
|
||
|
||
generate "tfvars" {
|
||
path = "terragrunt.auto.tfvars.json"
|
||
if_exists = "overwrite"
|
||
disable_signature = true
|
||
contents = jsonencode({
|
||
secrets = [
|
||
for secret in local.env_config.secrets : {
|
||
resource_key = try(secret.resource_key, "")
|
||
name = secret.name
|
||
namespace = secret.namespace
|
||
secret_type = secret.type
|
||
registry_url = try(secret.registry_url, "")
|
||
dependencies = try(secret.dependencies, {})
|
||
yc_sa_key_names = try(secret.yc_sa_key_names, {})
|
||
custom_keys = try(secret.custom_keys, {})
|
||
constant_keys = try(secret.constant_keys, {})
|
||
random_keys = try(secret.random_keys, {})
|
||
credential_keys = try(secret.credential_keys, {})
|
||
labels = try(secret.labels, {})
|
||
annotations = try(secret.annotations, {})
|
||
ignore_changes = try(secret.lifecycle.ignore_changes, false)
|
||
}
|
||
]
|
||
})
|
||
}
|
||
|
||
inputs = {
|
||
secrets = [
|
||
for secret in local.env_config.secrets : {
|
||
resource_key = try(secret.resource_key, "")
|
||
name = secret.name
|
||
namespace = secret.namespace
|
||
secret_type = secret.type
|
||
registry_url = try(secret.registry_url, "")
|
||
dependencies = try(secret.dependencies, {})
|
||
yc_sa_key_names = try(secret.yc_sa_key_names, {})
|
||
custom_keys = try(secret.custom_keys, {})
|
||
constant_keys = try(secret.constant_keys, {})
|
||
random_keys = try(secret.random_keys, {})
|
||
credential_keys = try(secret.credential_keys, {})
|
||
labels = try(secret.labels, {})
|
||
annotations = try(secret.annotations, {})
|
||
ignore_changes = try(secret.lifecycle.ignore_changes, false)
|
||
}
|
||
]
|
||
|
||
# Live-значения adopt-секретов (1:1) из расшифрованного sops secret-values.
|
||
secret_values = local.secret_values_map
|
||
|
||
s3_outputs = {
|
||
bucket_name = dependency.s3.outputs.bucket_name
|
||
access_key = dependency.s3.outputs.access_key
|
||
secret_key = dependency.s3.outputs.secret_key
|
||
}
|
||
|
||
s3_buckets_map = dependency.s3.outputs.buckets
|
||
yc_service_accounts_map = try(dependency.s3.outputs.service_accounts, {})
|
||
|
||
database_outputs_map = dependency.database.outputs.database_outputs_map
|
||
rabbitmq_outputs_map = try(dependency.rabbitmq.outputs.rabbitmq_outputs_map, {})
|
||
kafka_outputs_map = try(dependency.kafka_topics.outputs.kafka_outputs_map, {})
|
||
valkey_outputs_map = dependency.valkey_users.outputs.valkey_outputs_map
|
||
|
||
constants = {
|
||
s3_endpoint = "https://storage.yandexcloud.net"
|
||
postgres_port = "6432"
|
||
postgres_ca = local.yc_postgresql_ca_cert
|
||
kafka_ca = local.yc_postgresql_ca_cert
|
||
valkey_port = "6380"
|
||
valkey_ca = local.yc_postgresql_ca_cert
|
||
}
|
||
|
||
env_vars = {
|
||
DOCKER_REGISTRY_USERNAME = get_env("DOCKER_REGISTRY_USERNAME", "")
|
||
DOCKER_REGISTRY_PASSWORD = get_env("DOCKER_REGISTRY_PASSWORD", "")
|
||
}
|
||
|
||
yc_token = get_env("YC_TOKEN", "")
|
||
yc_service_account_key_file = get_env("YC_SERVICE_ACCOUNT_KEY_FILE", "")
|
||
yc_cloud_id = get_env("YC_CLOUD_ID", "")
|
||
yc_folder_id = get_env("YC_PROD_FOLDER_ID", get_env("YC_FOLDER_ID", ""))
|
||
kubeconfig_path = get_env("KUBECONFIG", "")
|
||
kube_context = get_env("KUBE_CONTEXT", "")
|
||
}
|