alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(secrets): replace config maps with secrets for sensitive configurations in multiple modules

Browse Source
This commit is contained in:
Alexandre Pires
2025-05-11 20:17:35 +02:00
parent 457f2bd810
commit 19f599e502
5 changed files with 69 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
terraform/modules/apps/m3uproxy/main.tf
+38 -16
View File
@@ -32,7 +32,7 @@ resource "kubernetes_service_account" "m3uproxy_service_account" {
automount_service_account_token = false
}
resource "kubernetes_config_map" "m3uproxy_config" {
resource "kubernetes_secret" "m3uproxy_config" {
metadata {
name = "m3uproxy-config"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
@@ -40,8 +40,21 @@ resource "kubernetes_config_map" "m3uproxy_config" {
data = {
"m3uproxy.json" = local.m3uproxy_config
"playlist.json" = local.m3uproxy_playlist
}
type = "Opaque"
}
resource "kubernetes_config_map" "m3uproxy_playlist" {
metadata {
name = "m3uproxy-playlist"
namespace = kubernetes_namespace.m3uproxy.metadata[0].name
}
data = {
"playlist.m3u8" = local.m3uproxy_playlist
}
}
resource "kubernetes_deployment" "m3uproxy" {
@@ -73,16 +86,12 @@ resource "kubernetes_deployment" "m3uproxy" {
"checksum/playlist" = local.m3uproxy_playlist_checksum
}
}
spec {
service_account_name = kubernetes_service_account.m3uproxy_service_account.metadata[0].name
container {
name = "m3uproxy"
image = "a13labs/m3uproxy:${local.m3uproxy_version}"
image_pull_policy = "Always"
resources {
requests = {
memory = "256Mi"
@@ -93,7 +102,6 @@ resource "kubernetes_deployment" "m3uproxy" {
container_port = 8080
name = "http"
}
readiness_probe {
http_get {
path = "/health"
@@ -103,7 +111,6 @@ resource "kubernetes_deployment" "m3uproxy" {
period_seconds = 10
failure_threshold = 10
}
env {
name = "USERNAME"
value_from {
@@ -113,7 +120,6 @@ resource "kubernetes_deployment" "m3uproxy" {
}
}
}
env {
name = "PASSWORD"
value_from {
@@ -123,35 +129,51 @@ resource "kubernetes_deployment" "m3uproxy" {
}
}
}
security_context {
allow_privilege_escalation = false
run_as_user = 1000
run_as_group = 1000
}
volume_mount {
name = "m3uproxy-config"
mount_path = "/app/conf"
mount_path = "/app/conf/m3uproxy.json"
sub_path = "m3uproxy.json"
read_only = true
}
volume_mount {
name = "m3uproxy-playlist"
mount_path = "/app/conf/playlist.m3u8"
sub_path = "playlist.m3u8"
read_only = true
}
volume_mount {
name = "m3uproxy-app-cache"
mount_path = "/app/cache"
}
volume_mount {
name = "geoip-db"
mount_path = "/app/GeoIP"
read_only = true
}
}
volume {
name = "m3uproxy-config"
secret {
secret_name = kubernetes_secret.m3uproxy_config.metadata[0].name
items {
key = "m3uproxy.json"
path = "m3uproxy.json"
}
}
}
volume {
name = "m3uproxy-playlist"
config_map {
name = kubernetes_config_map.m3uproxy_config.metadata[0].name
name = kubernetes_config_map.m3uproxy_playlist.metadata[0].name
items {
key = "playlist.m3u8"
path = "playlist.m3u8"
}
}
}