[READ-ONLY] Mirror of https://github.com/tiborpilz/infrastructure. Personal Infrastructure managed via terraform & k8s
fix weave
Tibor Pilz
(Sep 11, 2021, 8:50 PM +0200)
e52fdbd2
b9705b60
+125
-110
+11
applications/main.tf
+11
applications/main.tf
···
12
12
}
13
13
14
14
provider "kubernetes" {
15
+
alias = "dev"
16
+
15
17
experiments {
16
18
manifest_resource = true
17
19
}
···
23
25
client_key = var.cluster_connection.client_key
24
26
cluster_ca_certificate = var.cluster_connection.ca_crt
25
27
}
28
+
29
+
provider "kubernetes" {
30
+
host = var.cluster_connection.api_server_url
31
+
username = var.cluster_connection.kube_admin_user
32
+
33
+
client_certificate = var.cluster_connection.client_cert
34
+
client_key = var.cluster_connection.client_key
35
+
cluster_ca_certificate = var.cluster_connection.ca_crt
36
+
}
+1
-1
applications/manifests/weave-scope/application.yaml
+1
-1
applications/manifests/weave-scope/application.yaml
+113
-109
applications/oauth2-proxy.tf
+113
-109
applications/oauth2-proxy.tf
···
1
1
resource "kubernetes_manifest" "keycloakclient_oauth_proxy" {
2
+
provider = kubernetes.dev
3
+
2
4
manifest = {
3
5
apiVersion = "keycloak.org/v1alpha1"
4
6
kind = "KeycloakClient"
···
44
46
}
45
47
46
48
data "kubernetes_secret" "keycloak-client-secret-oauth-proxy" {
47
-
depends_on = [kubernetes_manifest.keycloakclient_oauth_proxy]
49
+
depends_on = [time_sleep.wait_5_seconds]
48
50
metadata {
49
51
name = "keycloak-client-secret-oauth-proxy"
50
52
namespace = "keycloak"
51
53
}
52
-
binary_data = {
53
-
CLIENT_ID = ""
54
-
CLIENT_SECRET = ""
55
-
}
54
+
# binary_data = {
55
+
# CLIENT_ID = ""
56
+
# CLIENT_SECRET = ""
57
+
# }
56
58
}
57
59
58
-
output "oauth_proxy_id" {
59
-
description = "ID of oauth2 proxy keycloak client"
60
-
value = data.kubernetes_secret.keycloak-client-secret-oauth-proxy.data
61
-
sensitive = true
60
+
resource "time_sleep" "wait_10_seconds" {
61
+
depends_on = [data.kubernetes_secret.keycloak-client-secret-oauth-proxy]
62
+
create_duration = "10s"
62
63
}
63
64
64
-
# resource "kubernetes_manifest" "oauth2-proxy-application" {
65
-
# manifest = {
66
-
# apiVersion = "argoproj.io/v1alpha1"
67
-
# kind = "Application"
68
-
# metadata = {
69
-
# finalizers = [
70
-
# "resources-finalizer.argocd.argoproj.io",
71
-
# ]
72
-
# name = "oauth2-proxy"
73
-
# namespace = "argocd"
74
-
# }
75
-
# spec = {
76
-
# destination = {
77
-
# name = "in-cluster"
78
-
# namespace = "oauth2-proxy"
79
-
# server = ""
80
-
# }
81
-
# project = "default"
82
-
# source = {
83
-
# chart = "oauth2-proxy"
84
-
# helm = {
85
-
# values = yamlencode({
86
-
# extraArgs = {
87
-
# ssl-upstream-insecure-skip-verify = true
88
-
# keycloak-group = "/basic_user"
89
-
# }
90
-
# # extraEnv = [
91
-
# # {
92
-
# # name: "OAUTH2_PROXY_COOKIE_SECURE"
93
-
# # value: false
94
-
# # }
95
-
# # ]
96
-
# config = {
97
-
# clientID = data.kubernetes_secret.keycloak-client-secret-oauth-proxy.data.CLIENT_ID
98
-
# clientSecret = data.kubernetes_secret.keycloak-client-secret-oauth-proxy.data.CLIENT_SECRET
99
-
# configFile = <<-EOT
100
-
# # Provider
101
-
# provider = "oidc"
102
-
# provider_display_name = "Keycloak"
103
-
# oidc_issuer_url = "https://keycloak.${var.domain}/auth/realms/master"
104
-
# email_domains = ["*"]
105
-
# scope = "openid profile email"
106
-
# cookie_domains = [".${var.domain}"]
107
-
# whitelist_domains = [".${var.domain}"]
108
-
# pass_authorization_header = true
109
-
# pass_access_token = true
110
-
# pass_user_headers = true
111
-
# set_authorization_header = true
112
-
# set_xauthrequest = true
113
-
# cookie_refresh = "1m"
114
-
# cookie_expire = "30m"
115
-
# # cookie_secure = "false"
116
-
# # skip_auth_routes=["/health.*"]
117
-
# # skip_provider_button="true"
118
-
# ssl_insecure_skip_verify = "true"
119
-
# EOT
120
-
# cookieSecret = "SEVuTitJTGFFRnREcmt4bGxYdk1DZEM0QUNHbm1JSHc="
121
-
# }
122
-
# ingress = {
123
-
# annotations = {
124
-
# "cert-manager.io/cluster-issuer" = "letsencrypt-clusterissuer"
125
-
# "nginx.ingress.kubernetes.io/proxy-buffer-size" = "16k"
126
-
# }
127
-
# enabled = true
128
-
# hosts = [
129
-
# "oauth.${var.domain}",
130
-
# ]
131
-
# path = "/"
132
-
# tls = [
133
-
# {
134
-
# hosts = [
135
-
# "oauth.${var.domain}",
136
-
# ]
137
-
# secretName = "oauth.tls"
138
-
# },
139
-
# ]
140
-
# }
141
-
# })
142
-
# }
143
-
# path = ""
144
-
# repoURL = "https://oauth2-proxy.github.io/manifests"
145
-
# targetRevision = "4.2.0"
146
-
# }
147
-
# syncPolicy = {
148
-
# automated = {
149
-
# prune = true
150
-
# selfHeal = true
151
-
# }
152
-
# syncOptions = [
153
-
# "CreateNamespace=true"
154
-
# ]
155
-
# }
156
-
# }
157
-
# }
158
-
# wait_for = {
159
-
# fields = {
160
-
# "status.health.status" = "Healthy"
161
-
# }
162
-
# }
163
-
# }
65
+
resource "kubernetes_manifest" "oauth2-proxy-application" {
66
+
provider = kubernetes.dev
67
+
68
+
depends_on = [time_sleep.wait_10_seconds]
69
+
manifest = {
70
+
apiVersion = "argoproj.io/v1alpha1"
71
+
kind = "Application"
72
+
metadata = {
73
+
finalizers = [
74
+
"resources-finalizer.argocd.argoproj.io",
75
+
]
76
+
name = "oauth2-proxy"
77
+
namespace = "argocd"
78
+
}
79
+
spec = {
80
+
destination = {
81
+
name = "in-cluster"
82
+
namespace = "oauth2-proxy"
83
+
server = ""
84
+
}
85
+
project = "default"
86
+
source = {
87
+
chart = "oauth2-proxy"
88
+
helm = {
89
+
values = yamlencode({
90
+
extraArgs = {
91
+
ssl-upstream-insecure-skip-verify = true
92
+
keycloak-group = "/basic_user"
93
+
}
94
+
# extraEnv = [
95
+
# {
96
+
# name: "OAUTH2_PROXY_COOKIE_SECURE"
97
+
# value: false
98
+
# }
99
+
# ]
100
+
config = {
101
+
clientID = data.kubernetes_secret.keycloak-client-secret-oauth-proxy.data.CLIENT_ID
102
+
clientSecret = data.kubernetes_secret.keycloak-client-secret-oauth-proxy.data.CLIENT_SECRET
103
+
configFile = <<-EOT
104
+
# Provider
105
+
provider = "oidc"
106
+
provider_display_name = "Keycloak"
107
+
oidc_issuer_url = "https://keycloak.${var.domain}/auth/realms/master"
108
+
email_domains = ["*"]
109
+
scope = "openid profile email"
110
+
cookie_domains = [".${var.domain}"]
111
+
whitelist_domains = [".${var.domain}"]
112
+
pass_authorization_header = true
113
+
pass_access_token = true
114
+
pass_user_headers = true
115
+
set_authorization_header = true
116
+
set_xauthrequest = true
117
+
cookie_refresh = "1m"
118
+
cookie_expire = "30m"
119
+
# cookie_secure = "false"
120
+
# skip_auth_routes=["/health.*"]
121
+
# skip_provider_button="true"
122
+
ssl_insecure_skip_verify = "true"
123
+
EOT
124
+
cookieSecret = "SEVuTitJTGFFRnREcmt4bGxYdk1DZEM0QUNHbm1JSHc="
125
+
}
126
+
ingress = {
127
+
annotations = {
128
+
"cert-manager.io/cluster-issuer" = "letsencrypt-clusterissuer"
129
+
"nginx.ingress.kubernetes.io/proxy-buffer-size" = "16k"
130
+
}
131
+
enabled = true
132
+
hosts = [
133
+
"oauth.${var.domain}",
134
+
]
135
+
path = "/"
136
+
tls = [
137
+
{
138
+
hosts = [
139
+
"oauth.${var.domain}",
140
+
]
141
+
secretName = "oauth.tls"
142
+
},
143
+
]
144
+
}
145
+
})
146
+
}
147
+
path = ""
148
+
repoURL = "https://oauth2-proxy.github.io/manifests"
149
+
targetRevision = "4.2.0"
150
+
}
151
+
syncPolicy = {
152
+
automated = {
153
+
prune = true
154
+
selfHeal = true
155
+
}
156
+
syncOptions = [
157
+
"CreateNamespace=true"
158
+
]
159
+
}
160
+
}
161
+
}
162
+
wait_for = {
163
+
fields = {
164
+
"status.health.status" = "Healthy"
165
+
}
166
+
}
167
+
}