From d38d3f12c340adf58a2c0a4ea3048ab8c68ed095 Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Mon, 6 Nov 2023 07:54:51 +0100
Subject: [PATCH] Turned allowed namespaces into variable

---
 terraform/main.tf                                           | 1 +
 terraform/modules/k8s-cluster/manager-node.tf               | 1 +
 .../k8s-cluster/templates/helm/cluster-setup-values.yaml    | 5 ++++-
 terraform/modules/k8s-cluster/variables.tf                  | 6 ++++++
 4 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/terraform/main.tf b/terraform/main.tf
index ce67fc9..694ae42 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -62,4 +62,5 @@ module "test_cluster" {
     client_id : var.vault_client_id
     client_secret : var.vault_client_secret
   }
+  vault_allowed_namespaces = ["wahlrecht"]
 }
\ No newline at end of file
diff --git a/terraform/modules/k8s-cluster/manager-node.tf b/terraform/modules/k8s-cluster/manager-node.tf
index 086d189..b2bfef1 100644
--- a/terraform/modules/k8s-cluster/manager-node.tf
+++ b/terraform/modules/k8s-cluster/manager-node.tf
@@ -112,6 +112,7 @@ resource "hcloud_server" "manager" {
     cluster_setup_values : base64encode(templatefile("${path.module}/templates/helm/cluster-setup-values.yaml", {
       client_id : var.vault_service_principal.client_id
       client_secret : var.vault_service_principal.client_secret
+      allowed_namespaces : var.vault_allowed_namespaces
     }))
     argocd_ha_values : base64encode(file("${path.module}/templates/helm/argocd-values-ha.yaml"))
     cluster_setup : base64encode(templatefile("${path.module}/templates/scripts/cluster-setup.sh", {
diff --git a/terraform/modules/k8s-cluster/templates/helm/cluster-setup-values.yaml b/terraform/modules/k8s-cluster/templates/helm/cluster-setup-values.yaml
index c70abb8..14e7213 100644
--- a/terraform/modules/k8s-cluster/templates/helm/cluster-setup-values.yaml
+++ b/terraform/modules/k8s-cluster/templates/helm/cluster-setup-values.yaml
@@ -2,4 +2,7 @@ vault:
   enabled: true
   clientId: ${client_id}
   clientSecret: ${client_secret}
-  applicationNamespaces: []
\ No newline at end of file
+  applicationNamespaces:
+%{ for namespace in allowed_namespaces ~}
+    - ${namespace}
+%{ endfor ~}
\ No newline at end of file
diff --git a/terraform/modules/k8s-cluster/variables.tf b/terraform/modules/k8s-cluster/variables.tf
index 4ff6a48..0802a57 100644
--- a/terraform/modules/k8s-cluster/variables.tf
+++ b/terraform/modules/k8s-cluster/variables.tf
@@ -153,4 +153,10 @@ variable "vault_service_principal" {
     client_secret : string
   })
   sensitive = true
+}
+
+variable "vault_allowed_namespaces" {
+  description = "Namespaces that are allowed to access secrets from the Vault"
+  type        = list(string)
+  default     = []
 }
\ No newline at end of file