Added support for vault secrets

terraform/ansible.tf

@@ -1,5 +0,0 @@
-output "ansible_inventory" {
-  value = templatefile("${path.module}/templates/inventory.tftpl", {
-    devops = hcloud_server.server_devops.ipv4_address, k8s_servers = [hcloud_server.server_k8s_test.ipv4_address]
-  })
-}

terraform/main.tf

@@ -27,6 +27,7 @@ module "test_cluster" {
 
   admin_ssh_key             = data.hcloud_ssh_key.macos
   admin_user                = "2martensAdmin"
+  admin_email               = "admin@2martens.de"
   terraform_public_ssh_key  = var.terraform_public_ssh_key
   terraform_private_ssh_key = var.terraform_private_ssh_key
   basic_firewall_id         = hcloud_firewall.basic-firewall.id
@@ -53,4 +54,8 @@ module "test_cluster" {
   image_name          = "ubuntu-22.04"
   create_loadbalancer = false
   loadbalancer_ip     = "10.0.0.3"
+  vault_service_principal = {
+    client_id : var.vault_client_id
+    client_secret : var.vault_client_secret
+  }
 }

terraform/modules/k8s-cluster/helm.tf

@@ -7,10 +7,18 @@ resource "null_resource" "install_setup" {
     timeout     = "2m"
   }
 
+  provisioner "file" {
+    content = templatefile("${path.module}/templates/cluster-setup-values.yaml", {
+      client_id : var.vault_service_principal.client_id,
+      client_secret : var.vault_service_principal.client_secret
+    })
+    destination = "/home/terraform/cluster-setup-values.yaml"
+  }
+
   provisioner "remote-exec" {
     inline = [
       "helm repo add 2martens https://repo.2martens.de/charts/",
-      "helm install setup 2martens/cluster_setup",
+      "helm install setup 2martens/cluster_setup --values /home/terraform/cluster-setup-values.yaml",
     ]
   }
 

terraform/modules/k8s-cluster/outputs.tf

@@ -1,7 +1,11 @@
 output "api_server_ipv4_address" {
-  value = var.create_loadbalancer ? hcloud_load_balancer.kubernetes.ipv4 : hcloud_server.manager[0].ipv4_address
+  value = var.create_loadbalancer ? hcloud_load_balancer.kubernetes[0].ipv4 : hcloud_server.manager[0].ipv4_address
 }
 
 output "api_server_ipv6_address" {
-  value = var.create_loadbalancer ? hcloud_load_balancer.kubernetes.ipv6 : hcloud_server.manager[0].ipv6_address
+  value = var.create_loadbalancer ? hcloud_load_balancer.kubernetes[0].ipv6 : hcloud_server.manager[0].ipv6_address
+}
+
+output "node_ipv6_addresses" {
+  value = hcloud_server.manager.*.ipv6_address
 }

terraform/modules/k8s-cluster/templates/cluster-setup-values.yaml

@@ -0,0 +1,4 @@
+vault:
+  enabled: true
+  clientId: ${client_id}
+  clientSecret: ${client_secret}

terraform/modules/k8s-cluster/variables.tf

@@ -12,6 +12,11 @@ variable "admin_user" {
   type        = string
 }
 
+variable "admin_email" {
+  description = "Email of the admin. Will be passed to cluster setup helm chart and subsequently be used for registering with Lets Encrypt"
+  type        = string
+}
+
 variable "terraform_private_ssh_key" {
   description = "Private SSH key to be used by Terraform to connect with remote machines"
   type        = string
@@ -133,4 +138,13 @@ variable "microk8s_channel" {
   description = "The snap channel used for the microk8s installation"
   type        = string
   default     = "1.28-strict/stable"
+}
+
+variable "vault_service_principal" {
+  description = "Service Principal to access to Hashicorp Vault Secrets"
+  type = object({
+    client_id : string
+    client_secret : string
+  })
+  sensitive = true
 }

terraform/outputs.tf

@@ -0,0 +1,6 @@
+output "ansible_inventory" {
+  value = templatefile("${path.module}/templates/inventory.tftpl", {
+    devops      = hcloud_server.server_devops.ipv4_address,
+    k8s_servers = concat(tolist([hcloud_server.server_k8s_test.ipv4_address]), module.test_cluster.node_ipv6_addresses)
+  })
+}

terraform/variables.tf

@@ -47,4 +47,15 @@ variable "terraform_private_ssh_key" {
 variable "terraform_public_ssh_key" {
   description = "Public SSH key for the private key used by Terraform to connect with remote machines"
   type        = string
+}
+
+variable "vault_client_id" {
+  description = "Client ID of the service principal used to access Hashicorp Cloud"
+  type        = string
+  sensitive   = true
+}
+variable "vault_client_secret" {
+  description = "Client Secret of the service principal used to access Hashicorp Cloud"
+  type        = string
+  sensitive   = true
 }