a13labs.infra/terraform/modules/apps/open-webui/webui.tf

resource "kubernetes_service_account" "openwebui" {

  metadata {
    name      = "openwebui-sa"
    namespace = kubernetes_namespace.openwebui.metadata[0].name
  }

  automount_service_account_token = false
}


resource "kubernetes_secret" "openwebui" {
  metadata {
    name      = "openwebui-secret"
    namespace = kubernetes_namespace.openwebui.metadata[0].name
  }

  data = {
    "WEBUI_SECRET_KEY" = base64encode(var.secret_key)
  }

  type = "Opaque"

}
resource "kubernetes_deployment" "openwebui" {
  metadata {
    name      = "openwebui"
    namespace = kubernetes_namespace.openwebui.metadata[0].name
    labels = {
      app = "openwebui"
    }
  }

  spec {
    replicas = 1

    selector {
      match_labels = {
        app = "openwebui"
      }
    }

    strategy {
      type = "RollingUpdate"
    }

    template {
      metadata {
        labels = {
          app = "openwebui"
        }
      }

      spec {
        service_account_name            = kubernetes_service_account.openwebui.metadata[0].name
        automount_service_account_token = false

        # We need an init container rsync the /app/backend from the original image to the hostPath volume, so that we don't overwrite user data on restarts
        # also fix permissions
        init_container {
          name    = "startup"
          image   = "ghcr.io/open-webui/open-webui:${var.tag}"
          command = ["sh", "-c", "apt-get update && apt-get install -y --no-install-recommends rsync && rm -rf /target_app/* && rsync -avz --delete /app/backend/* /target_app/ --exclude data && chown -R 1000:1000 /target_app /target_data"]
          security_context {
            run_as_user  = 0
            run_as_group = 0
          }

          volume_mount {
            name       = "openwebui-app"
            mount_path = "/target_app"
          }

          volume_mount {
            name       = "openwebui-data"
            mount_path = "/target_data"
          }
        }

        container {
          name              = "app"
          image             = "ghcr.io/open-webui/open-webui:${var.tag}"
          image_pull_policy = "Always"

          security_context {
            allow_privilege_escalation = false
            run_as_non_root            = true
            run_as_user                = 1000
            run_as_group               = 1000
          }

          port {
            name           = "http"
            container_port = 8080
          }

          env {
            name = "WEBUI_SECRET_KEY"
            value_from {
              secret_key_ref {
                name = kubernetes_secret.openwebui.metadata[0].name
                key  = "WEBUI_SECRET_KEY"
              }
            }
          }

          env {
            name  = "JWT_EXPIRES_IN"
            value = var.jwt_expires_in
          }

          env {
            name  = "GLOBAL_LOG_LEVEL"
            value = var.log_level
          }

          env {
            name  = "AIOHTTP_CLIENT_TIMEOUT"
            value = var.aiohttp_client_timeout
          }

          readiness_probe {
            tcp_socket {
              port = 8080
            }
            initial_delay_seconds = 5
            period_seconds        = 10
            failure_threshold     = 10
          }

          volume_mount {
            name       = "openwebui-app"
            mount_path = "/app/backend"
          }

          volume_mount {
            name       = "openwebui-data"
            mount_path = "/app/backend/data"
          }

        }

        volume {
          name = "openwebui-app"
          host_path {
            path = local.openwebui_app
          }
        }

        volume {
          name = "openwebui-data"
          host_path {
            path = local.openwebui_data
          }
        }
      }
    }
  }
}

resource "kubernetes_service" "openwebui" {
  metadata {
    name      = "http"
    namespace = kubernetes_namespace.openwebui.metadata[0].name
  }

  spec {
    selector = {
      app = "openwebui"
    }

    port {
      name        = "http"
      port        = 8080
      target_port = 8080
    }

    type       = "ClusterIP"
    cluster_ip = "None"
  }

  lifecycle {
    ignore_changes = [
      metadata[0].annotations
    ]
  }
}