I am attempting to create a kubernetes secret where the data keys/values come from a list of objects from a variable, this is the secret resource I am attemping to create, you can see have attempted a few different ways (there was alot more ways then just listed here that I tried).
resource "kubernetes_secret" "app" {
count = length({ for c, container in var.containers : c => container if container.env_secrets != null }) > 0 ? 1 : 0
metadata {
name = var.name
namespace = var.namespace
}
data = {
# for c, s in var.containers : c => merge({ for s in s.env_secrets != null ? s.env_secrets : [] : s.name => s.value })
# for c in var.containers : c.env_secrets.name => c.env_secrets.value if c.env_secrets != null
for s in var.containers.env_secrets : s.name => s.value if s != null
}
}
The variable that I am referencing the var.containers is as follows, you can see that it is a list of objects, and within that list is an optional list of env_secrets, for each env_secret in each container I want to map the key/value to a key/value of a kubernetes secret, I only want one secret in total with ALL secret env keys/values in it.
variable "containers" {
description = "containers to deploy in the pod"
type = list(object({
image_url = string
image_tag = string
name = string
env = optional(list(object({
name = string
value = any
})))
env_secrets = optional(list(object({
name = string
value = any
})))
ports = optional(list(object({
name = string
container_port = number
is_ingress = optional(object({
domain_name = string
tls_cluster_issuer = string
domain_path = optional(string)
enforce_https = optional(bool)
proxy_body_size = optional(string)
}))
})))
resources = optional(object({
requests = optional(object({
cpu = string
memory = string
}))
limits = optional(object({
cpu = string
memory = string
}))
}))
liveness_probe = optional(object({
http_get = object({
path = string
port = number
})
initial_delay_seconds = optional(number)
period_seconds = optional(number)
timeout_seconds = optional(number)
failure_threshold = optional(number)
success_threshold = optional(number)
}))
readiness_probe = optional(object({
http_get = object({
path = string
port = number
})
initial_delay_seconds = optional(number)
period_seconds = optional(number)
timeout_seconds = optional(number)
failure_threshold = optional(number)
success_threshold = optional(number)
}))
}))
default = null
}
When I do the module now for example I would do the following
module "deployment_test" {
source = "../../../modules/goeasycare/terraform-k8s-deployment-template"
namespace = "default"
name = "testing"
containers = [
{
name = "container-1"
image_url = "image1"
image_tag = "latest"
env_secrets = [
{
name = "THIS_IS_A_SECRET"
value = "THIS IS SECRET VALUES"
}
]
},
{
name = "container-2"
image_url = "image2"
image_tag = "latest"
env_secrets = [
{
name = "THIS_IS_A_SECRET_FOR_IMAGE_2"
value = "THIS IS SECRET VALUES 2"
}
]
},
{
name = "container-3"
image_url = "image3"
image_tag = "latest"
},
]
}
and in the end the secret data would look something like this
data = {
THIS_IS_A_SECRET = "BASE64OF(THIS IS A SECRET VALUES)"
THIS_IS_A_SECRET_FOR_IMAGE_2 = "BASE64OF(THIS IS A SECRET VALUES 2)"
}
As for the secret creation itself that part works if any of the containers have an env_secret it will create 1 and only 1 secret I just need to figure out the loop for the data portion itself.
