db68067925
Phase 5 — CI pipelines: - default.yml: add SOPS decrypt in prepare step, change git add . to specific paths (stacks/ state/ .woodpecker/), cleanup on success+failure - renew-tls.yml: change git add . to git add secrets/ state/ Phase 6 — sensitive=true: - Add sensitive = true to 256 variable declarations across 149 stack files - Prevents secret values from appearing in terraform plan output - Does NOT modify shared modules (ingress_factory, nfs_volume) to avoid breaking module interface contracts Note: CI pipeline SOPS decryption requires sops_age_key Woodpecker secret to be created before the pipeline will work with SOPS. Until then, the old terraform.tfvars path continues to function.
33 lines
813 B
HCL
33 lines
813 B
HCL
variable "tls_secret_name" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
|
|
module "tls_secret" {
|
|
source = "../../modules/kubernetes/setup_tls_secret"
|
|
namespace = kubernetes_namespace.homepage.metadata[0].name
|
|
tls_secret_name = var.tls_secret_name
|
|
}
|
|
|
|
resource "kubernetes_namespace" "homepage" {
|
|
metadata {
|
|
name = "homepage"
|
|
labels = {
|
|
"istio-injection" : "disabled"
|
|
tier = local.tiers.aux
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "helm_release" "homepage" {
|
|
namespace = kubernetes_namespace.homepage.metadata[0].name
|
|
create_namespace = false
|
|
name = "homepage"
|
|
atomic = true
|
|
|
|
repository = "http://jameswynn.github.io/helm-charts"
|
|
chart = "homepage"
|
|
|
|
values = [templatefile("${path.module}/values.yaml", { tls_secret_name = var.tls_secret_name })]
|
|
}
|