add git-crypt terraform

modules/kubernetes/drone/main.tf

@@ -28,25 +28,14 @@ module "tls_secret" {
   tls_key         = var.tls_key
 }
 
-resource "kubernetes_config_map" "tfvars" {
+resource "kubernetes_config_map" "git_crypt_key" {
   metadata {
-    name      = "tfvars"
+    name      = "git-crypt-key"
     namespace = "drone"
   }
 
   data = {
-    "tfvars" = base64gzip(file("${path.root}/terraform.tfvars"))
-  }
-}
-
-resource "kubernetes_config_map" "tfstate" {
-  metadata {
-    name      = "tfstate"
-    namespace = "drone"
-  }
-
-  data = {
-    "tfstate" = base64gzip(file("${path.root}/terraform.tfstate"))
+    "key" = filebase64("${path.root}/.git/git-crypt/keys/default")
   }
 }
 
@@ -270,15 +259,6 @@ resource "kubernetes_deployment" "drone_runner" {
               memory = "1Gi"
             }
           }
-          volume_mount {
-            mount_path = "/terraform.tfvars"
-            name       = "tfvars"
-            sub_path   = "tfvars"
-          }
-          # volume_mount {
-          #   mount_path = "/data/"
-          #   name       = "data"
-          # }
           env {
             name  = "DRONE_RPC_HOST"
             value = var.rpc_host
@@ -300,8 +280,7 @@ resource "kubernetes_deployment" "drone_runner" {
             value = var.rpc_secret
           }
           env {
-            name = "DRONE_SECRET_PLUGIN_ENDPOINT"
-            # value = "http://localhost:3000"
+            name  = "DRONE_SECRET_PLUGIN_ENDPOINT"
             value = "http://drone-runner-secret.drone.svc.cluster.local:3000"
           }
           env {
@@ -313,12 +292,12 @@ resource "kubernetes_deployment" "drone_runner" {
             value = "true"
           }
         }
-        volume {
-          name = "tfvars"
-          config_map {
-            name = "tfvars"
-          }
-        }
+        # volume {
+        #   name = "tfvars"
+        #   config_map {
+        #     name = "tfvars"
+        #   }
+        # }
         # volume {
         #   name = "data"
         #   iscsi {

modules/kubernetes/main.tf

@@ -155,6 +155,13 @@ module privatebin {
   depends_on = [null_resource.core_services]
 }
 
+module vault {
+  source          = "./vault"
+  tls_secret_name = var.tls_secret_name
+  tls_crt         = var.tls_crt
+  tls_key         = var.tls_key
+}
+
 module webhook_handler {
   source          = "./webhook_handler"
   tls_secret_name = var.tls_secret_name

modules/kubernetes/vault/chart_values.tpl

@@ -0,0 +1,24 @@
+injector:
+  metrics:
+    enabled: true
+server:
+  enabled: true
+  volumes:
+    - name: data
+      emptyDir: {}
+  ingress:
+    enabled: true
+    annotations:
+      "kubernetes.io/ingress.class": "nginx"
+      "nginx.ingress.kubernetes.io/auth-tls-verify-client": "on"
+      "nginx.ingress.kubernetes.io/auth-tls-secret": "default/ca-secret"
+    hosts:
+      - host: "${host}"
+        paths:
+          - /
+    tls:
+      - secretName: ${tls_secret_name}
+        hosts:
+            - "${host}"
+ui:
+  enabled: true

modules/kubernetes/vault/main.tf

@@ -0,0 +1,51 @@
+variable "tls_secret_name" {}
+variable "tls_crt" {}
+variable "tls_key" {}
+variable "host" {
+  default = "vault.viktorbarzin.me"
+}
+
+resource "kubernetes_namespace" "vault" {
+  metadata {
+    name = "vault"
+  }
+}
+
+module "tls_secret" {
+  source          = "../setup_tls_secret"
+  namespace       = "vault"
+  tls_secret_name = var.tls_secret_name
+  tls_crt         = var.tls_crt
+  tls_key         = var.tls_key
+}
+
+resource "kubernetes_persistent_volume" "vault_data" {
+  metadata {
+    name = "vauld-data-pv"
+  }
+  spec {
+    capacity = {
+      "storage" = "10Gi"
+    }
+    access_modes = ["ReadWriteOnce"]
+    persistent_volume_source {
+      iscsi {
+        target_portal = "iscsi.viktorbarzin.lan:3260"
+        iqn           = "iqn.2020-12.lan.viktorbarzin:storage:vault"
+        lun           = 0
+        fs_type       = "ext4"
+      }
+    }
+  }
+}
+
+resource "helm_release" "prometheus" {
+  namespace        = "vault"
+  create_namespace = true
+  name             = "vault"
+
+  repository = "https://helm.releases.hashicorp.com"
+  chart      = "vault"
+
+  values = [templatefile("${path.module}/chart_values.tpl", { host = var.host, tls_secret_name = var.tls_secret_name })]
+}