150 lines
3.9 KiB
Terraform
150 lines
3.9 KiB
Terraform
|
|
resource "kubernetes_service_account" "cert_checker" {
|
|
metadata {
|
|
name = "cert-checker-sa"
|
|
namespace = var.namespace
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_role" "cert_checker" {
|
|
metadata {
|
|
name = "cert-checker-role"
|
|
}
|
|
rule {
|
|
api_groups = ["apps"]
|
|
resources = ["deployments"]
|
|
verbs = ["get", "list", "patch", "update"]
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_role_binding" "cert_checker_auth_reader" {
|
|
metadata {
|
|
name = "cert-checker-biding"
|
|
namespace = var.namespace
|
|
}
|
|
role_ref {
|
|
api_group = "rbac.authorization.k8s.io"
|
|
kind = "Role"
|
|
name = "cert-checker-role"
|
|
}
|
|
subject {
|
|
kind = "ServiceAccount"
|
|
name = "cert-checker-sa"
|
|
namespace = var.namespace
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_config_map" "cert_checker" {
|
|
metadata {
|
|
name = "cert-checker-config"
|
|
namespace = var.namespace
|
|
}
|
|
data = {
|
|
"check.py" = file("${path.module}/resources/check.py")
|
|
"requirements.txt" = file("${path.module}/resources/requirements.txt")
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_cron_job_v1" "cert_checker" {
|
|
for_each = var.deployments
|
|
metadata {
|
|
name = "cert-checker-${each.key}"
|
|
namespace = var.namespace
|
|
labels = {
|
|
app = "cert-checker"
|
|
}
|
|
}
|
|
spec {
|
|
schedule = coalesce(each.value.schedule, "0 0 * * *") # Default to daily at midnight
|
|
successful_jobs_history_limit = 2
|
|
failed_jobs_history_limit = 1
|
|
|
|
job_template {
|
|
metadata {
|
|
name = "cert-checker"
|
|
}
|
|
spec {
|
|
backoff_limit = 1
|
|
parallelism = 1
|
|
completions = 1
|
|
|
|
template {
|
|
metadata {
|
|
labels = {
|
|
app = "cert-checker"
|
|
}
|
|
}
|
|
spec {
|
|
service_account_name = kubernetes_service_account.cert_checker.metadata[0].name
|
|
restart_policy = "Never"
|
|
container {
|
|
name = "cert-checker"
|
|
image = var.tag
|
|
command = ["sh", "-c", join(" && ", local.commands)]
|
|
volume_mount {
|
|
name = "config-volume"
|
|
mount_path = "/config"
|
|
read_only = true
|
|
}
|
|
volume_mount {
|
|
name = "cert-volume"
|
|
mount_path = "/certs"
|
|
read_only = true
|
|
}
|
|
volume_mount {
|
|
name = "workdir"
|
|
mount_path = "/tmp"
|
|
}
|
|
security_context {
|
|
run_as_user = 1000
|
|
run_as_group = 1000
|
|
allow_privilege_escalation = false
|
|
read_only_root_filesystem = true
|
|
run_as_non_root = true
|
|
capabilities {
|
|
drop = ["ALL"]
|
|
}
|
|
}
|
|
env {
|
|
name = "DEPLOYMENT_NAME"
|
|
value = each.key
|
|
}
|
|
env {
|
|
name = "NAMESPACE"
|
|
value = var.namespace
|
|
}
|
|
env {
|
|
name = "SERVICE_HOST"
|
|
value = "${each.value.service_name}.${var.namespace}.svc.cluster.local"
|
|
}
|
|
env {
|
|
name = "SERVICE_PORT"
|
|
value = tostring(each.value.service_port)
|
|
}
|
|
}
|
|
volume {
|
|
name = "config-volume"
|
|
config_map {
|
|
name = kubernetes_config_map.cert_checker.metadata[0].name
|
|
}
|
|
}
|
|
volume {
|
|
name = "cert-volume"
|
|
secret {
|
|
secret_name = each.value.secret_name
|
|
}
|
|
}
|
|
volume {
|
|
name = "workdir"
|
|
host_path {
|
|
path = local.workdir
|
|
type = "DirectoryOrCreate"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|