Skip to content

Commit 9a36b44

Browse files
karteekiitgkarteekiitg
committed
1. feat(infisical): Add optional Infisical Secret Manager support.
2. feat(tofu_state): One local/remote state per branch. Signed-off-by: Karteek <[email protected]>
1 parent 4f694ce commit 9a36b44

File tree

14 files changed

+255
-94
lines changed

14 files changed

+255
-94
lines changed

‎tofu/kubernetes/BACKEND.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
## Setup Environment
2+
3+
### Using infisical
4+
1. Setup [gcloud cli](/DEVCONTAINER.md).
5+
1. Setup TF_VAR_proxmox_api_token, TF_VAR_tofu_encryption_passphrase and save them to infisical.
6+
1. Setup .env file in root folder and commit it to git.
7+
1. Follow devcontainers docs [here](/DEVCONTAINER.md). If done properly, all secrets from infisical will be available in the container environment.
8+
9+
Note: By default all secrets in /tofu folder will be populated. /tofu_rw is the folder where secrets are written. Also checkout default branch to env mapping.
10+
11+
## Setup Backend
12+
13+
### Local
14+
15+
```shell
16+
# Local Backend
17+
tofu init -backend-config="path=$(git rev-parse --abbrev-ref HEAD).tfstate"
18+
```
19+
**Note: If your are using local backend with dev devcontainers and git repo, your state file will be deleted when the container is removed. So be very careful.**
20+
21+
### GCS
22+
1. Follow instructions in [Google Cloud](../gcs-state/README.md) to setup GCS bucket for remote state.
23+
24+
```shell
25+
# GCS Backend
26+
cp samples/backend_gcs.tofu ./backend.tofu
27+
```
28+
29+
```shell
30+
# Initialize tofu
31+
tofu init -backend-config="bucket=<your_bucket_name>" -backend-config="prefix=kubernetes/$(git rev-parse --abbrev-ref HEAD)"
32+
```
33+
34+
### Beta Notice
35+
36+
`Please treat GCS backend as beta and only use for air-gapped installations as of now. Will remove the beta tag after testing it in due course.`

‎tofu/kubernetes/README.md‎

Lines changed: 6 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -3,35 +3,18 @@
33
Read [Talos Kubernetes on Proxmox using OpenTofu](https://blog.stonegarden.dev/articles/2024/08/talos-proxmox-tofu/) for
44
a more thorough explanation of how everything works.
55

6-
## Install pre-requisites
6+
## Install pre-requisites - Pre-installed in devContainer
77

88
1. [tofu](https://opentofu.org/docs/intro/install/)
99
2. [talosctl](https://www.talos.dev/v1.9/talos-guides/install/talosctl/)
1010
3. [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl)
1111

1212
## Initialize tofu
1313

14-
```shell
15-
tofu init
16-
```
17-
18-
## Proxmox
19-
20-
### Environment variable
21-
22-
```shell
23-
export TF_VAR_proxmox_api_token="<YOUR_API_TOKEN>"
24-
```
25-
26-
### Optional External Secrets Manager / Other methods
14+
One cluster/state per branch.
2715

28-
**Bitwarden Secrets Manager** - Name your secret TF_VAR_proxmox_api_token in bws.
29-
30-
```shell
31-
bws run -- tofu ...
32-
```
33-
34-
Note: By default, the shell is sh. Change with --shell if required.
16+
1. Setup and initialize [remote backend](BACKEND.md).
17+
1. Keep the environment populated with [required secrets](BACKEND.md) when running `tofu plan/apply`.
3518

3619
## Sealed-secrets
3720

@@ -59,32 +42,12 @@ tofu output -raw talos_config
5942

6043
## Upgrading Talos and Kubernetes
6144

62-
[Upgrade](https://blog.stonegarden.dev/articles/2024/08/talos-proxmox-tofu/#upgrading-the-cluster) talos nodes one by
63-
one.
64-
65-
1. Set talos_image.auto.tfvars -> image -> update_version to the required update version.
66-
2. Set talos_cluster.auto.tfvars -> talos_cluster_config -> kubernetes_version to the required kubernetes version.
67-
3. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_1 -> update = true and run tofu apply.
68-
4. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_2 -> update = true, leave the previous nodes update = true and
69-
run tofu apply.
70-
5. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_3 -> update = true, leave the previous nodes update = true and
71-
run tofu apply.
72-
6. ...
73-
7. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_n -> update = true, leave the previous nodes update = true and
74-
run tofu apply.
75-
8. After upgrading all nodes, Set talos_image.auto.tfvars -> image -> version to match the update version and set
76-
update = false for all nodes.
77-
78-
## Upgrading Talos Schematic
79-
80-
1. Create a new schematic file.
81-
2. Same process as above instead of `image.version` and `image.update_version`, change `image.schematic` and
82-
`image.update_schematic`, in `talos_image.auto.tfvars`.
45+
Follow these [instructions](UPGRADE.md).
8346

8447
## Reuse machine secrets
8548

8649
```shell
8750
tofu state rm module.talos.talos_machine_secrets.this
8851
tofu import module.talos.talos_machine_secrets.this output/talos-machine-secrets.yaml
8952
tofu apply --refresh=false
90-
```
53+
```

‎tofu/kubernetes/REMOTE_BACKEND.md‎

Lines changed: 0 additions & 42 deletions
This file was deleted.

‎tofu/kubernetes/UPGRADE.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
## Upgrading Talos
2+
[Upgrade](https://blog.stonegarden.dev/articles/2024/08/talos-proxmox-tofu/#upgrading-the-cluster) talos nodes one by
3+
one.
4+
5+
1. Set talos_image.auto.tfvars -> image -> update_version to the required update version.
6+
2. Set talos_cluster.auto.tfvars -> talos_cluster_config -> kubernetes_version to the required kubernetes version.
7+
3. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_1 -> update = true and run tofu apply.
8+
4. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_2 -> update = true, leave the previous nodes update = true and
9+
run tofu apply.
10+
5. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_3 -> update = true, leave the previous nodes update = true and
11+
run tofu apply.
12+
6. ...
13+
7. Set talos_nodes.auto.tfvars -> talos_nodes -> $node_n -> update = true, leave the previous nodes update = true and
14+
run tofu apply.
15+
8. After upgrading all nodes, Set talos_image.auto.tfvars -> image -> version to match the update version and set
16+
update = false for all nodes.
17+
18+
## Upgrading Talos Schematic
19+
20+
1. Create a new schematic file.
21+
2. Same process as above instead of `image.version` and `image.update_version`, change `image.schematic` and
22+
`image.update_schematic`, in `talos_image.auto.tfvars`.

‎tofu/kubernetes/backend.tofu‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
terraform {
2+
backend "gcs" {
3+
bucket = "kj-homelab-tf-state"
4+
prefix = "kubernetes/${local.backend_environment}"
5+
}
6+
}

‎tofu/kubernetes/infisical/git_branch.tofu‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
data "external" "git-branch" {
2+
program = ["/bin/bash", "-c", "jq -n --arg branch `git rev-parse --abbrev-ref HEAD` '{\"branch\":$branch}'"]
3+
}

‎tofu/kubernetes/infisical/infisical.tofu‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
locals {
2+
infisical_environment = lookup(var.infisical.branch_env_mapping, data.external.git-branch.result.branch, "dev")
3+
}
4+
5+
provider "infisical" {
6+
host = var.infisical_domain
7+
auth = {
8+
universal = {
9+
client_id = var.infisical_client_id
10+
client_secret = var.infisical_client_secret
11+
}
12+
}
13+
}
14+
15+
resource "infisical_secret" "created_secrets" {
16+
# Create one resource per entry in the input map
17+
for_each = var.secrets_to_create
18+
19+
name = each.key
20+
value = each.value
21+
22+
env_slug = local.infisical_environment
23+
folder_path = var.infisical_rw_secrets_path
24+
workspace_id = var.infisical_project_id
25+
}

‎tofu/kubernetes/infisical/variables.tofu‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
variable "infisical_domain" {
2+
description = "Infisical Domain"
3+
type = string
4+
default = "https://app.infisical.com"
5+
}
6+
7+
variable "infisical_client_id" {
8+
description = "Infisical Client ID"
9+
type = string
10+
default = null
11+
}
12+
13+
variable "infisical_project_id" {
14+
description = "Infisical Project ID"
15+
type = string
16+
default = null
17+
}
18+
19+
variable "infisical_rw_secrets_path" {
20+
description = "Infisical Client Secret"
21+
type = string
22+
default = "/tofu_rw"
23+
}
24+
25+
variable "infisical_branch_env_mapping" {
26+
description = "Infisical Branch Environment Mapping"
27+
type = map(string)
28+
default = {
29+
"main" = "prod"
30+
"prod" = "prod"
31+
"staging" = "staging"
32+
"dev" = "dev"
33+
}
34+
}
35+
36+
variable "infisical_client_secret" {
37+
description = "Infisical Client Secret"
38+
type = string
39+
sensitive = true
40+
default = null
41+
}
42+
43+
variable "secrets_to_create" {
44+
description = "A map of secrets to create in Infisical. Key: secret name, Value: secret content."
45+
type = map(string)
46+
default = {}
47+
sensitive = true
48+
}

‎tofu/kubernetes/infisical_variables.tofu‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
variable "infisical_domain" {
2+
description = "Infisical Domain"
3+
type = string
4+
default = "https://app.infisical.com"
5+
}
6+
7+
variable "infisical_client_id" {
8+
description = "Infisical Client ID"
9+
type = string
10+
default = null
11+
}
12+
13+
variable "infisical_project_id" {
14+
description = "Infisical Project ID"
15+
type = string
16+
default = null
17+
}
18+
19+
variable "infisical_rw_secrets_path" {
20+
description = "Infisical Client Secret"
21+
type = string
22+
default = "/tofu_rw"
23+
}
24+
25+
variable "infisical_branch_env_mapping" {
26+
description = "Infisical Branch Environment Mapping"
27+
type = map(string)
28+
default = {
29+
"main" = "prod"
30+
"prod" = "prod"
31+
"staging" = "staging"
32+
"dev" = "dev"
33+
}
34+
}
35+
36+
variable "infisical_client_secret" {
37+
description = "Infisical Client Secret"
38+
type = string
39+
sensitive = true
40+
default = null
41+
}

‎tofu/kubernetes/main.tofu‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,3 +45,27 @@ module "volumes" {
4545
proxmox_api = var.proxmox
4646
volumes = var.kubernetes_volumes
4747
}
48+
49+
module "infisical_secrets" {
50+
# Conditionally create infisical module based on where var.infisical is set in infisical.auto.tfvars
51+
count = (var.infisical_project_id != null && var.infisical_client_id != null) ? 1 : 0
52+
53+
source = "./infisical"
54+
55+
infisical_domain = var.infisical_domain
56+
infisical_client_id = var.infisical_client_id
57+
infisical_project_id = var.infisical_project_id
58+
infisical_rw_secrets_path = var.infisical_rw_secrets_path
59+
infisical_branch_env_mapping = var.infisical_branch_env_mapping
60+
infisical_client_secret = var.infisical_client_secret
61+
62+
secrets_to_create = {
63+
# Create map entries only for non-null values
64+
for k, v in {
65+
"kubeconfig" = module.talos.kube_config.kubeconfig_raw
66+
"talos_config" = module.talos.client_configuration.talos_config
67+
"kube_certificate" = file("${path.root}/${var.sealed_secrets_config.certificate_path}")
68+
"kube_certificate_key" = file("${path.root}/${var.sealed_secrets_config.certificate_key_path}")
69+
} : k => v if v != null
70+
}
71+
}

0 commit comments

Comments
 (0)