Major changes

terraform/apps/dev-01/apps.tf

@@ -0,0 +1,6 @@
+module "open-webui" {
+  source = "../../modules/apps/open-webui"
+
+  persistent_folder = local.persistent_folder
+  fqdn              = local.open_webui_fqdn
+}

terraform/apps/dev-01/backend.tf

@@ -0,0 +1,7 @@
+terraform {
+  backend "s3" {
+    bucket = "a13labs.infra.eu"
+    key    = "apps.dev-01.core.infra.tfstate"
+    region = "eu-west-1"
+  }
+}

terraform/apps/dev-01/config.tf

@@ -0,0 +1,9 @@
+locals {
+
+  # storage
+  persistent_folder = "/srv"
+
+  primary_domain  = "alexpires.me"
+  open_webui_fqdn = "ai.${local.primary_domain}"
+  internal_issuer = "internal-ca"
+}

terraform/apps/dev-01/issuer.tf

@@ -0,0 +1,56 @@
+resource "tls_private_key" "tls" {
+  algorithm = "ED25519"
+}
+
+resource "tls_self_signed_cert" "tls" {
+  private_key_pem = tls_private_key.tls.private_key_pem
+
+  subject {
+    common_name  = "kube-ca"
+    organization = "Alexandre Pires, Portugal"
+  }
+
+  validity_period_hours = 87600
+  is_ca_certificate     = true
+
+  allowed_uses = [
+    "cert_signing",
+    "key_encipherment",
+    "digital_signature",
+    "crl_signing"
+  ]
+}
+
+resource "kubernetes_secret" "root_ca" {
+  metadata {
+    name      = "root-ca"
+    namespace = "cert-manager"
+  }
+  data = {
+    "tls.crt" = tls_self_signed_cert.tls.cert_pem
+    "tls.key" = tls_private_key.tls.private_key_pem
+  }
+
+  type = "kubernetes.io/tls"
+}
+
+resource "kubernetes_manifest" "cluster_issuer" {
+
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "ClusterIssuer"
+    metadata = {
+      name = local.internal_issuer
+      annotations = {
+        "cert-manager.io/issuer-group" = "cert-manager.io"
+        "cert-manager.io/issuer-kind"  = "Issuer"
+        "cert-manager.io/issuer-name"  = local.internal_issuer
+      }
+    }
+    spec = {
+      ca = {
+        secretName = "root-ca"
+      }
+    }
+  }
+}

terraform/apps/dev-01/operator.tf

@@ -0,0 +1,129 @@
+resource "kubernetes_service_account" "operator_service_account" {
+  metadata {
+    name      = "operator"
+    namespace = "default"
+  }
+}
+
+resource "kubernetes_cluster_role" "operator_maintenance_role" {
+  metadata {
+    name = "operator-maintenance-role"
+  }
+
+  # Allow managing Pods (create, delete, exec, restart)
+  rule {
+    api_groups = [""]
+    resources  = ["pods"]
+    verbs      = ["get", "list", "watch", "create", "delete", "patch", "update", "exec"]
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["replicationcontrollers"]
+    verbs      = ["get", "list"]
+  }
+
+  rule {
+    api_groups = ["autoscaling"]
+    resources  = ["horizontalpodautoscalers"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["apps"]
+    resources  = ["deployments", "replicasets", "statefulsets", "daemonsets"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["batch"]
+    resources  = ["cronjobs"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  rule {
+    api_groups = ["batch"]
+    resources  = ["jobs"]
+    verbs      = ["get", "list", "watch", "create", "delete", "patch", "update"]
+  }
+
+  # Allow reading Pod logs
+  rule {
+    api_groups = [""]
+    resources  = ["pods/log"]
+    verbs      = ["get", "list"]
+  }
+
+  # Allow managing Pod eviction for draining nodes, etc.
+  rule {
+    api_groups = ["policy"]
+    resources  = ["pods/eviction"]
+    verbs      = ["create"]
+  }
+
+  # Allow reading Namespaces (usually required for multi-namespace tools)
+  rule {
+    api_groups = [""]
+    resources  = ["namespaces"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  # Allow reading and managing PodDisruptionBudgets (useful for draining nodes)
+  rule {
+    api_groups = ["policy"]
+    resources  = ["poddisruptionbudgets"]
+    verbs      = ["get", "list", "watch", "patch", "update"]
+  }
+
+  # Allow managing Nodes (e.g., for cordoning, draining)
+  rule {
+    api_groups = [""]
+    resources  = ["nodes"]
+    verbs      = ["get", "list", "patch", "update"]
+  }
+
+  # Allow reading PersistentVolumeClaims (PVCs) but not PersistentVolumes
+  rule {
+    api_groups = [""]
+    resources  = ["persistentvolumeclaims"]
+    verbs      = ["get", "list", "watch"]
+  }
+
+  # Allow listing and getting services and endpoints (but not updating)
+  rule {
+    api_groups = [""]
+    resources  = ["services", "endpoints"]
+    verbs      = ["get", "list", "watch"]
+  }
+}
+
+resource "kubernetes_cluster_role_binding" "operator_maintenance_binding" {
+  metadata {
+    name = "operator-maintenance-binding"
+  }
+
+  role_ref {
+    kind      = "ClusterRole"
+    name      = kubernetes_cluster_role.operator_maintenance_role.metadata[0].name
+    api_group = "rbac.authorization.k8s.io"
+  }
+
+  subject {
+    kind      = "ServiceAccount"
+    namespace = "default"
+    name      = kubernetes_service_account.operator_service_account.metadata[0].name
+  }
+}
+
+resource "kubernetes_secret" "operator_access_token" {
+  metadata {
+    annotations = {
+      "kubernetes.io/service-account.name" = kubernetes_service_account.operator_service_account.metadata[0].name
+    }
+    name      = "operator-token"
+    namespace = "default"
+  }
+
+  type                           = "kubernetes.io/service-account-token"
+  wait_for_service_account_token = true
+}

terraform/apps/dev-01/provider.tf

@@ -0,0 +1,20 @@
+terraform {
+  required_version = "~>1.8"
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+    tls = {
+      source  = "hashicorp/tls"
+      version = "4.0.5"
+    }
+  }
+}
+
+provider "kubernetes" {
+  config_path    = "~/.kube/config"
+  config_context = "microk8s-dev-01"
+  insecure       = true
+}
+

terraform/apps/dev-01/secrets.tf

@@ -0,0 +1 @@
+

terraform/apps/dev-01/sectool.env

@@ -0,0 +1,2 @@
+AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY
+AWS_SECRET_ACCESS_KEY=$AWS_SECRET_KEY

terraform/apps/dev-01/variables.tf

@@ -0,0 +1 @@
+