diff --git a/.cz.yaml b/.cz.yaml index 012238e..e152a43 100644 --- a/.cz.yaml +++ b/.cz.yaml @@ -1,10 +1,11 @@ --- commitizen: - name: cz_conventional_commits - tag_format: v$version - version: 0.1.0 - version_files: - - version.tf:module_version bump_message: "bump: version $current_version → $new_version" changelog_incremental: true + major_version_zero: true + name: cz_gitmoji + tag_format: $version update_changelog_on_bump: true + version_files: + - version.tf:module_version + version_provider: scm diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 7ef969f..eb969a4 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -47,7 +47,7 @@ repos: # Terraform Hooks - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.98.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases + rev: v1.99.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases hooks: - id: terraform_fmt args: diff --git a/README.md b/README.md index a133e48..a366d18 100644 --- a/README.md +++ b/README.md @@ -76,8 +76,8 @@ Common issues and solutions: | Name | Version | |------|---------| -| [aws](#provider\_aws) | 5.95.0 | -| [aws.eecr](#provider\_aws.eecr) | 5.95.0 | +| [aws](#provider\_aws) | 5.96.0 | +| [aws.eecr](#provider\_aws.eecr) | 5.96.0 | | [helm](#provider\_helm) | 2.17.0 | | [kubernetes](#provider\_kubernetes) | 2.36.0 | | [null](#provider\_null) | 3.2.4 | @@ -89,9 +89,7 @@ Common issues and solutions: |------|--------|---------| | [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade | | [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | n/a | -| [keycloak\_db\_config](#module\_keycloak\_db\_config) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | | [post\_install](#module\_post\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | -| [pre\_install](#module\_pre\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a | | [service\_account](#module\_service\_account) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account | n/a | ## Resources @@ -101,11 +99,12 @@ Common issues and solutions: | [helm_release.keycloak](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | | [helm_release.keycloak-db](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | | [kubernetes_namespace.keycloak](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource | +| [kubernetes_secret.keycloak_secrets](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource | | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | +| [random_password.passwords](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | | [random_uuid.user_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource | | [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | | [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source | -| [kubernetes_secret.db-secrets](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/secret) | data source | ## Inputs @@ -118,10 +117,9 @@ Common issues and solutions: | [default\_realm](#input\_default\_realm) | The default realm to use to configure the environment. | `string` | `"cluster-user"` | no | | [eecr\_info](#input\_eecr\_info) | Enterprise ECR source information |
object({
account_id = string
alias = string
profile = string
region = string
})
|
{
"account_id": "269222635945",
"alias": "lab-gov-shared-nonprod",
"profile": "269222635945-lab-gov-shared-nonprod",
"region": "us-gov-east-1"
}
| no | | [keycloak\_chart\_version](#input\_keycloak\_chart\_version) | The version of the helm chart to install | `string` | `"7.0.1"` | no | -| [keycloak\_hostname](#input\_keycloak\_hostname) | The hostname used to access the keycloak service. | `string` | `"keycloak"` | no | -| [keycloak\_namespace](#input\_keycloak\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no | | [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"26.0.7"` | no | | [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"keycloak"` | no | +| [namespace](#input\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no | | [postgres\_exporter\_tag](#input\_postgres\_exporter\_tag) | The tag of the postgres exporter image to use. | `string` | `"17.4.0"` | no | | [postgresql\_chart\_version](#input\_postgresql\_chart\_version) | The helm chart version of postgresql to use. | `string` | `"17.4.0"` | no | | [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no | diff --git a/charts/keycloakx/examples/postgresql/keycloak-server-values.yaml b/charts/keycloakx/examples/postgresql/keycloak-server-values.yaml index 3b03e6a..98f9f1f 100644 --- a/charts/keycloakx/examples/postgresql/keycloak-server-values.yaml +++ b/charts/keycloakx/examples/postgresql/keycloak-server-values.yaml @@ -33,8 +33,10 @@ database: vendor: postgres hostname: keycloak-db-postgresql port: 5432 - username: dbusername - password: dbpassword + username: keycloak + password: keycloak + existingSecret: ${secret_name} + existingSecretKey: ${database_password_key} database: keycloak secrets: diff --git a/config_job.tf b/config_job.tf new file mode 100644 index 0000000..2b5d677 --- /dev/null +++ b/config_job.tf @@ -0,0 +1,23 @@ +locals { + config_job_script = <- @@ -34,8 +40,12 @@ extraEnv: | -Djava.awt.headless=true -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless -# dbchecker: -# enabled: true +# Requires utilities +dbchecker: + enabled: true + image: + repository: ${db_checker_image_repo} + tag: ${db_checker_tag} resources: requests: cpu: 500m @@ -48,11 +58,17 @@ database: vendor: postgres hostname: ${database_hostname} port: 5432 - username: ${database_username} - # password: dbpassword - existingSecret: keycloak-db-creds - existingSecretKey: password database: ${database_name} + existingSecret: ${secret_name} + secretKeys: + adminPasswordKey: ${database_password_key} + userPasswordKey: ${postgres_password_key} + replicationPasswordKey: ${replication_password_key} + # username: keycloak + # password: keycloak + # password: dbpassword + # existingSecret: ${secret_name} + # existingSecretKey: ${database_password_key} http: relativePath: "/" diff --git a/main.tf b/main.tf index 56c4fae..7858abc 100644 --- a/main.tf +++ b/main.tf @@ -1,66 +1,68 @@ -# main.tf -resource "random_uuid" "user_secret" {} - locals { - public_port_number = "80" - admin_internal_port_number = "9000" + public_port_number = "80" + user_client_id = "sso.user" + user_secret = "user-sso" + k8s_secrets = { + "keycloak-db-creds" = { + data = { + username = "keycloak" + password = random_password.passwords["db"].result + "postgres-password" = random_password.passwords["postgres"].result + "replication-password" = random_password.passwords["replication"].result + } + }, + "keycloak-user-creds" = { + data = { + username = "user" + password = random_password.passwords["keycloak"].result + } + }, + (local.user_secret) = { + data = { + client_id = local.user_client_id + client_secret = random_uuid.user_secret.result + } + } + } + required_passwords = { + db = { + description = "Database user password" + length = 32 + }, + postgres = { + description = "Postgres admin password" + length = 32 + }, + replication = { + description = "Database replication password" + length = 32 + }, + keycloak = { + description = "Keycloak user password" + length = 24 + } + } - user_client_id = "sso.user" - user_secret = "user-sso" - - secrets_job_script = < /tmp/db_config.sql <