fd0f4a0365
6d224861 came from a --no-checkout worktree whose empty index made the
commit drop every file except two. This restores 05b50d2b's full tree and
correctly adds stacks/stem95su/gdrive-sync.tf + the service-catalog stem95su
entry. Forward-only (parent=6d224861, no force-push); [ci skip] since the
live infra was never applied from the broken commit.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
72 lines
2 KiB
HCL
72 lines
2 KiB
HCL
|
|
# =============================================================================
|
|
# TLS Certificate — Auto-sync to all namespaces
|
|
# =============================================================================
|
|
# Source wildcard cert (*.viktorbarzin.me) in kyverno namespace, cloned by
|
|
# ClusterPolicy into every NS. Renewal pipeline updates this source secret,
|
|
# Kyverno propagates to all namespaces within seconds.
|
|
|
|
resource "kubernetes_secret" "tls_secret" {
|
|
metadata {
|
|
name = "tls-secret"
|
|
namespace = kubernetes_namespace.kyverno.metadata[0].name
|
|
}
|
|
type = "kubernetes.io/tls"
|
|
data = {
|
|
"tls.crt" = file("${path.root}/secrets/fullchain.pem")
|
|
"tls.key" = file("${path.root}/secrets/privkey.pem")
|
|
}
|
|
}
|
|
|
|
resource "kubectl_manifest" "sync_tls_secret" {
|
|
yaml_body = yamlencode({
|
|
apiVersion = "kyverno.io/v1"
|
|
kind = "ClusterPolicy"
|
|
metadata = {
|
|
name = "sync-tls-secret"
|
|
}
|
|
spec = {
|
|
rules = [
|
|
{
|
|
name = "sync-tls-secret"
|
|
match = {
|
|
any = [
|
|
{
|
|
resources = {
|
|
kinds = ["Namespace"]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
exclude = {
|
|
any = [
|
|
{
|
|
resources = {
|
|
namespaces = ["kube-system", "kube-public", "kube-node-lease"]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
generate = {
|
|
apiVersion = "v1"
|
|
kind = "Secret"
|
|
name = "tls-secret"
|
|
namespace = "{{request.object.metadata.name}}"
|
|
synchronize = true
|
|
clone = {
|
|
namespace = "kyverno"
|
|
name = "tls-secret"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
})
|
|
|
|
depends_on = [
|
|
helm_release.kyverno,
|
|
kubernetes_secret.tls_secret,
|
|
kubernetes_cluster_role_binding.kyverno_admission_secret_manager,
|
|
kubernetes_cluster_role_binding.kyverno_background_secret_manager,
|
|
]
|
|
}
|