path: root/main.tf

terraform {
  required_providers {
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.37.1"
    }
  }
}

#
# Module inputs
#

variable "annotations" {
  type        = map(string)
  default     = {}
  description = <<-EOF
    A map of strings representing the annotations to set on all resources
    created by the module. In Kubernetes manifests, this is equivalent to
    `.metadata.annotations`.
  EOF
}

variable "labels" {
  type        = map(string)
  default     = {}
  description = <<-EOF
    A map of strings representing the labels to add to all resources created by
    the module. In Kubernetes manifests, this is equivalent to
    `.metadata.annotations`. Note that the module applies several default
    labels, which can be overwritten with this map.
  EOF
}

variable "name" {
  type        = string
  description = <<-EOF
    The name used for the deployed resources. In Kubernetes manifests, this is
    equivalent to `.metadata.name`.
  EOF
}

variable "namespace" {
  type        = string
  default     = "default"
  description = <<-EOF
    The namespace used to deploy resources in. This must be created outside of
    the module before the module itself will deploy. In Kubernetes manifests,
    this is equivalent to `.metadata.namespace`.
  EOF
}

# Deployment

variable "allow_privilege_escalation" {
  type        = bool
  default     = null
  description = <<-EOF
    Allow privilege escalation of the container. Be wary of security risks when
    setting this to true. In Kubernetes manifests, this is equivalent to
    `.spec.template.spec.container[0].securityContext.allowPrivilegeEscalation`.
  EOF
}

variable "args" {
  type        = list(string)
  default     = null
  description = <<-EOF
    A list of strings to use as the arguments passed to the command to run
    inside the container. In Kubernetes manifests, this is equivalent to
    `.spec.template.spec.container[0].args`.
  EOF
}

variable "command" {
  type        = list(string)
  default     = null
  description = <<-EOF
    A list of strings representing the command to run inside the container. In
    Kubernetes manifests, this is equivalent to
    `.spec.template.spec.container[0].command`.
  EOF
}

variable "deployment_annotations" {
  type        = map(string)
  default     = {}
  description = <<-EOF
    A map of strings representing the annotations to set on the Deployment
    object.  In Kubernetes manifests, this is equivalent to
    `.metadata.annotations`.
  EOF
}

variable "deployment_labels" {
  type        = map(string)
  default     = {}
  description = <<-EOF
    A map of strings representing the labels to add to the Deployment object.
    In Kubernetes manifests, this is equivalent to `.metadata.annotations`.
    Note that the module applies several default labels, which can be
    overwritten with this map.
  EOF
}

variable "env" {
  type        = map(string)
  default     = {}
  description = <<-EOF
    A map of strings, where each key represents an environment variable name,
    and each value represents the environment variable's value.
  EOF
}

variable "env_configmaps" {
  type        = list(string)
  default     = []
  description = <<-EOF
    A list of names of ConfigMap resources, which will be used as environment
    variables.
  EOF
}

variable "env_secrets" {
  type        = list(string)
  default     = []
  description = <<-EOF
    A list of names of Secret resources, which will be used as environment
    variables.
  EOF
}

variable "fs_group" {
  type        = number
  default     = null
  description = <<-EOF
    The gid to assign to the container filesystem. If not set, but `gid` is
    set, the `fs_group` will be equivalent to `gid`. In Kubernetes manifests,
    this is equivalent to `.spec.template.spec.securityContext.fsGroup`.
  EOF
}

variable "fs_group_change_policy" {
  type        = string
  default     = null
  description = <<-EOF
    The policy to apply for filesystem group mismatches. In Kubernetes
    manifests, this is equivalent to
    `.spec.template.spec.securityContext.fsGroupChangePolicy`.
  EOF
}

variable "gid" {
  type        = number
  default     = null
  description = <<-EOF
   The gid to assign to the pod through the container security context. In
   Kubernetes manifests, this is equivalent to
   `.spec.template.spec.securityContext.runAsGroup`.
  EOF
}

variable "host_network" {
  type        = bool
  default     = false
  description = <<-EOF
    Allow the container to use the host's own networking namespace. In
    Kubernetes manifests, this is equivalent to
    `.spec.template.spec.container[0].hostNetwork`.
  EOF
}

variable "image" {
  type        = string
  description = <<-EOF
    The container image to run. In Kubernetes manifests, this is equivalent to
    `.spec.template.spec.container[0].image`.
  EOF
}

variable "priority_class" {
  type        = string
  default     = null
  description = <<-EOF
    The priority class name to schedule the containers with. In Kubernetes
    manifests, this is equivalent to
    `.spec.template.spec.container[0].priorityClassName`.
  EOF
}

variable "privileged" {
  type        = bool
  default     = false
  description = <<-EOF
    Run the container with full privileges. Be wary of security risks when
    setting this to true. In Kubernetes manifests, this is equivalent to
    `.spec.template.spec.container[0].securityContext.privileged`.
  EOF
}

variable "pull_policy" {
  type        = string
  default     = null
  description = <<-EOF
    A string to set the container image's pull policy. If not set explicitly,
    it will be set to `Always` if the container image tag is `latest`,
    `main`, or `master`. Otherwise, it will use the `IfNotPresent` policy. In
    Kubernetes manifests, this is equivalent to
    `.spec.template.spec.container[0].imagePullPolicy`.
  EOF
}

variable "pull_secrets" {
  type        = list(string)
  default     = []
  description = <<-EOF
    A list of names of Secret resources representing image pull secrets. In
    Kubernetes manifests, this is equivalent to
    `.spec.template.spec.imagePullSecrets`.
  EOF
}

variable "replicas" {
  type        = number
  default     = 1
  description = <<-EOF
    The number of replicas to run. In Kubernetes manifests, this is equivalent
    to `.spec.replicas`.
  EOF
}

variable "resources" {
  type        = map(map(string))
  default     = {}
  description = <<-EOF
    A map to define resource requests and limits for the container. If the map
    contains either a `requests` or a `limits` key, the map inside of it will
    be mapped directly to the Kubernetes manifest attribute
    `.spec.template.spec.container[0].resources.requests` or
    `.spec.template.spec.container[0].resources.limits` respectively.
  EOF
}

variable "ro_rootfs" {
  type        = bool
  default     = false
  description = <<-EOF
    Mark the container's root filesystem as read-only. It is set to true by
    default, which can break some containers. In Kubernetes manifests, this is
    equivalent to
    `.spec.template.spec.container[0].securityContext.readOnlyRootFilesystem`.
  EOF
}

variable "selector" {
  type        = map(string)
  default     = {}
  description = <<-EOF
    A map of strings to set node selector labels. In Kubernetes manifests, this
    is equivalent to `.spec.template.spec.nodeSelector`.
  EOF
}

variable "strategy" {
  type        = string
  default     = null
  description = <<-EOF
    The strategy used for updating the image. In Kubernetes manifests, this is
    equivalent to `.spec.strategy`. If unset, the strategy "Recreate" will be
    used if there's only a single replica. If replicas is set to a number
    larger than 1, the strategy will default to "RollingUpdate".
  EOF
}

variable "uid" {
  type        = number
  default     = null
  description = <<-EOF
   The uid to assign to the pod through the container security context. If this
   is set, and not 0, the `run_as_non_root` flag will be set for this container
   as well. In Kubernetes manifests, this is equivalent to
   `.spec.template.spec.securityContext.runAsUser`.
  EOF
}

variable "volumes" {
  type        = map(map(string))
  default     = {}
  description = <<-EOF
    A map of volumes, each containing a map to describe said volumes. Each
    volume requires a `path` key to denote where inside the container it must
    be mounted. Each volume requires _either_ a `pvc`, `secret` or `configmap`
    key, using the name of a PersistentVolumeClaim, Secret, or ConfigMap
    respectively to use as the volume source. When using a `secret` or
    `configmap`, an optional `key` can be set as well to indicate which key
    from the Secret or ConfigMap to use for the data, allowing you to use an
    element from a Secret or ConfigMap as a configuration file.
  EOF
}

# Service

variable "ports" {
  type        = list(number)
  default     = []
  description = <<-EOF
    A list of port numbers to open up through a Service resource. If unset, or
    set to an empty list, no Service object will be created.
  EOF
}

variable "service_annotations" {
  type        = map(string)
  default     = {}
  description = <<-EOF
    A map of strings representing the annotations to set on the Service object.
    In Kubernetes manifests, this is equivalent to `.metadata.annotations`.
  EOF
}

variable "service_labels" {
  type        = map(string)
  default     = {}
  description = <<-EOF
    A map of strings representing the labels to add to the Service object.
    In Kubernetes manifests, this is equivalent to `.metadata.annotations`.
    Note that the module applies several default labels, which can be
    overwritten with this map.
  EOF
}

variable "service_type" {
  type        = string
  default     = "ClusterIP"
  description = <<-EOF
    The type of Service to deploy. In Kubernetes manifests, this is equivalent
    to `.spec.type`.
  EOF
}


# Ingress

variable "hosts" {
  type        = list(string)
  default     = []
  description = <<-EOF
    A list of hostnames to include in the Ingress object.
  EOF
}

variable "ingress_annotations" {
  type        = map(string)
  default     = {}
  description = <<-EOF
    A map of strings representing the annotations to set on the Ingress object.
    In Kubernetes manifests, this is equivalent to `.metadata.annotations`.
  EOF
}

variable "ingress_class" {
  type        = string
  default     = ""
  description = <<-EOF
    The name of the IngressClass to use for this Ingress object. If unset, or
    set to an empty string, no Ingress object will be made. In Kubernetes
    manifests, this is equivalent to `.spec.ingressClassName`.
  EOF
}

variable "ingress_labels" {
  type        = map(string)
  default     = {}
  description = <<-EOF
    A map of strings representing the labels to add to the Ingress object.
    In Kubernetes manifests, this is equivalent to `.metadata.annotations`.
    Note that the module applies several default labels, which can be
    overwritten with this map.
  EOF
}

variable "ingress_port" {
  type        = number
  default     = 0
  description = <<-EOF
    The port to use for the Ingress object. If unset, it will use the first
    port defined in the `ports` list.
  EOF
}

#
# IngressRoute
#

variable "ingress_certresolver" {
  type        = string
  default     = null
  description = <<-EOF
    The name of the certificate resolver provider.
  EOF
}

variable "ingress_entrypoints" {
  type        = list(string)
  default     = ["web", "websecure"]
  description = <<-EOF
    A list of entrypoints to use with the IngressRoute object. Defaults to
    `["web", "websecure"]`.
  EOF
}

variable "ingress_middlewares" {
  type        = list(string)
  default     = []
  description = <<-EOF
    A list of names of Middleware resources to apply to the IngressRoute object.
  EOF
}

variable "ingress_route" {
  type        = bool
  default     = false
  description = <<-EOF
    Create an IngressRoute resource, rather than an Ingress resource. Defaults
    to `false`.
  EOF
}

#
# Module outputs
#

output "labels" {
  value = local.labels
}

output "resources" {
  value = {
    deployment = kubernetes_deployment_v1.this
    service    = try(kubernetes_service_v1.this[0], null)
    ingress    = try(kubernetes_ingress_v1.this[0], null)
  }
}

output "service_fqdn" {
  value = length(kubernetes_service_v1.this) < 1 ? null : "${kubernetes_service_v1.this[0].metadata[0].name}.${kubernetes_service_v1.this[0].metadata[0].namespace}"
}

#
# Module local variables
#

locals {
  container_tag = reverse(split(var.image, ":"))[0]
  container_tags_pull_always = [
    "latest",
    "main",
    "master",
  ]
  labels = {
    "app.kubernetes.io/created-by" = "terraform-kubernetes-container"
    "app.kubernetes.io/managed-by" = "opentofu"
    "app.kubernetes.io/name"       = var.name
    "app.kubernetes.io/part-of"    = var.name
  }
}