e6420c7b36
Move all 88 service modules (66 individual + 22 platform) from modules/kubernetes/<service>/ into their corresponding stack directories: - Service stacks: stacks/<service>/module/ - Platform stack: stacks/platform/modules/<service>/ This collocates module source code with its Terragrunt definition. Only shared utility modules remain in modules/kubernetes/: ingress_factory, setup_tls_secret, dockerhub_secret, oauth-proxy. All cross-references to shared modules updated to use correct relative paths. Verified with terragrunt run --all -- plan: 0 adds, 0 destroys across all 68 stacks.
120 lines
3.1 KiB
HCL
120 lines
3.1 KiB
HCL
|
|
resource "kubernetes_namespace" "kyverno" {
|
|
metadata {
|
|
name = "kyverno"
|
|
labels = {
|
|
"istio-injection" : "disabled"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "helm_release" "kyverno" {
|
|
namespace = kubernetes_namespace.kyverno.metadata[0].name
|
|
create_namespace = false
|
|
name = "kyverno"
|
|
atomic = true
|
|
|
|
repository = "https://kyverno.github.io/kyverno/"
|
|
chart = "kyverno"
|
|
|
|
# values = [templatefile("${path.module}/grafana_chart_values.yaml", { db_password = var.grafana_db_password })]
|
|
}
|
|
|
|
# To unlabel all:
|
|
# kubectl label deployment,statefulset,daemonset --all-namespaces -l tier tier-
|
|
resource "kubernetes_manifest" "mutate_tier_from_namespace" {
|
|
manifest = {
|
|
apiVersion = "kyverno.io/v1"
|
|
kind = "ClusterPolicy"
|
|
metadata = {
|
|
name = "sync-tier-label-from-namespace"
|
|
}
|
|
spec = {
|
|
rules = [
|
|
{
|
|
name = "lookup-and-add-tier"
|
|
match = {
|
|
any = [
|
|
{
|
|
resources = {
|
|
kinds = ["Deployment", "StatefulSet", "DaemonSet"]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
exclude = {
|
|
any = [
|
|
{
|
|
resources = {
|
|
namespaces = ["kube-system", "metallb-system", "n8n"]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
# Context allows us to perform an API call to get Namespace metadata
|
|
context = [
|
|
{
|
|
name = "namespaceLabel"
|
|
apiCall = {
|
|
urlPath = "/api/v1/namespaces/{{request.namespace}}"
|
|
jmesPath = "metadata.labels.tier || 'default'"
|
|
}
|
|
}
|
|
]
|
|
mutate = {
|
|
patchStrategicMerge = {
|
|
metadata = {
|
|
labels = {
|
|
# Injects the variable discovered in the context above
|
|
"+(tier)" = "{{namespaceLabel}}"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
|
|
# resource "kubernetes_manifest" "enforce_pod_tier_label" {
|
|
# manifest = {
|
|
# apiVersion = "kyverno.io/v1"
|
|
# kind = "ClusterPolicy"
|
|
# metadata = {
|
|
# name = "enforce-pod-tier-label"
|
|
# annotations = {
|
|
# "policies.kyverno.io/description" = "Rejects any pod that does not have a tier label."
|
|
# }
|
|
# }
|
|
# spec = {
|
|
# # 'Enforce' blocks the creation. 'Audit' just reports it.
|
|
# validationFailureAction = "Enforce"
|
|
# background = true
|
|
# rules = [
|
|
# {
|
|
# name = "check-for-tier-label"
|
|
# match = {
|
|
# any = [
|
|
# {
|
|
# resources = {
|
|
# kinds = ["Pod"]
|
|
# }
|
|
# }
|
|
# ]
|
|
# }
|
|
# validate = {
|
|
# message = "The label 'tier' is required for all pods in this cluster."
|
|
# pattern = {
|
|
# metadata = {
|
|
# labels = {
|
|
# "tier" = "?*" # The "?*" syntax means the value must not be empty
|
|
# }
|
|
# }
|
|
# }
|
|
# }
|
|
# }
|
|
# ]
|
|
# }
|
|
# }
|
|
# }
|