unkin-agent
218a640882
Parameterise the authentik provider url as var.authentik_url (default: the environment's public URL) and override it for identity.k8s.syd1.au.unkin.net to http://authentik-server.authentik.svc.cluster.local. Combined with sessionAffinity: ClientIP on the Service, in-cluster CI runs pin to a single server replica, eliminating the cross-replica read-back race (goauthentik/terraform-provider-authentik#954).
43 lines
1.2 KiB
HCL
43 lines
1.2 KiB
HCL
generate "backend" {
|
|
path = "backend.tf"
|
|
if_exists = "overwrite"
|
|
contents = <<EOF
|
|
provider "authentik" {
|
|
url = var.authentik_url
|
|
token = var.authentik_token
|
|
}
|
|
|
|
# Reads client secrets seeded in Vault (kv-v2). Auth via VAULT_ADDR + VAULT_TOKEN
|
|
# from the environment (set by the Makefile vault_env helper). skip_child_token
|
|
# is required because the short-lived CI token cannot create child tokens.
|
|
provider "vault" {
|
|
skip_child_token = true
|
|
}
|
|
|
|
variable "authentik_token" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
# Defaults to the environment's public URL; an exported TF_VAR_authentik_url
|
|
# takes precedence over terragrunt inputs.
|
|
variable "authentik_url" {
|
|
type = string
|
|
default = "https://${path_relative_to_include()}"
|
|
}
|
|
|
|
terraform {
|
|
backend "consul" {
|
|
address = "https://consul.service.consul"
|
|
path = "infra/terraform/authentik/${path_relative_to_include()}/state"
|
|
scheme = "https"
|
|
lock = true
|
|
ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
|
|
}
|
|
required_version = ">= 1.10"
|
|
# required_providers are declared in the module's versions.tf; declaring them
|
|
# here as well is a duplicate configuration (OpenTofu permits only one).
|
|
}
|
|
EOF
|
|
}
|