From 2a1ba8fbc849f3c6617fbb4f2d52b22f5fc97dda Mon Sep 17 00:00:00 2001 From: gitops_test Date: Thu, 24 Sep 2026 15:52:40 +0000 Subject: [PATCH] terraform: created terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/configuration-ee649378-1298-41a1-b923-d0ab40646c5a.tf --- ...on-ee649378-1298-41a1-b923-d0ab40646c5a.tf | 84 +++++++++++++++++++ ...78-1298-41a1-b923-d0ab40646c5a_override.tf | 8 ++ ...rs-ee649378-1298-41a1-b923-d0ab40646c5a.tf | 17 ++++ 3 files changed, 109 insertions(+) create mode 100644 terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/configuration-ee649378-1298-41a1-b923-d0ab40646c5a.tf create mode 100644 terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/credentials-ee649378-1298-41a1-b923-d0ab40646c5a_override.tf create mode 100644 terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/providers-ee649378-1298-41a1-b923-d0ab40646c5a.tf diff --git a/terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/configuration-ee649378-1298-41a1-b923-d0ab40646c5a.tf b/terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/configuration-ee649378-1298-41a1-b923-d0ab40646c5a.tf new file mode 100644 index 0000000..0a25774 --- /dev/null +++ b/terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/configuration-ee649378-1298-41a1-b923-d0ab40646c5a.tf @@ -0,0 +1,84 @@ +############################################################################## +# Deployment Script: Managed PostgreSQL database (OVHcloud) +# +# Thin root calling the provisioner owned "dbaas" catalog module. The module +# provisions an OVHcloud Managed PostgreSQL cluster with one initial database +# and one application user. The user password is always generated server side +# by OVHcloud (it cannot be set to an arbitrary value) and is written by the +# module to Vault under the existing path contract, together with the +# connection attributes; only the Vault path is returned in the provisioning +# response. No secret material ever appears in this script or its outputs. +# +# No terraform/required_providers and no provider blocks are needed: the +# catalog module carries its own provider requirements, the cloud provider +# is configured from the runner environment and the Vault provider file is +# generated by the provisioner. +# +# Placeholders (all filled by the provisioner, never typed by the user): +# - the module source placeholder resolves to the dbaas module of the +# cloudProvider sent in the request headers +# - ee649378-1298-41a1-b923-d0ab40646c5a is the scriptTriggerId of the request +# - development-test is the value of the cloudAccount header +# - c468352d-0223-48c3-b831-5b2b7ddf1c6a is the value of the requesterUniqueId header +############################################################################## + +module "dbaas" { + source = "git::http://gitea-http.dataprovider01.svc.cluster.local:3000/gitops_test/tfmodules.git//dbaas/ovh?ref=3.2.0-F-feature-simpl-31672.685.982f75e7" + deployment_id = "ee649378-1298-41a1-b923-d0ab40646c5a" + cloud_account = "development-test" + requester_unique_id = "c468352d-0223-48c3-b831-5b2b7ddf1c6a" + + # OVHcloud macro region for the database nodes (for example SBG, GRA, DE), + # not the datacenter suffixed region (SBG5) used for instances. The project + # itself is not set here: the provider resolves it from the cloud account + # configuration of the environment. + region = "SBG" + + # Managed offer: PostgreSQL engine version and sizing. plan is essential, + # business or production; flavor for example db1-4. + engine_version = "16" + plan = "essential" + flavor = "db1-4" + + # Initial application database name. The application user name defaults to + # simpl_app_user and becomes the last segment of the Vault credentials path. + database_name = "simpl_app_db" + + # CIDR blocks allowed to reach the cluster on a public deployment. Without + # this OVHcloud blocks all access. Open to the internet by default here, + # restrict it to your own networks for anything beyond testing. + allowed_ips = ["0.0.0.0/0"] + + # Optional private mode: attach the database nodes to an existing vRack + # network of the same project and remove allowed_ips. + # private_network_id = "" + # private_subnet_id = "" +} + +output "database_endpoint" { + value = module.dbaas.database_endpoint +} + +output "database_port" { + value = module.dbaas.database_port +} + +output "database_name" { + value = module.dbaas.database_name +} + +output "database_username" { + value = module.dbaas.database_username +} + +output "database_cluster_id" { + value = module.dbaas.database_cluster_id +} + +output "database_user_id" { + value = module.dbaas.database_user_id +} + +output "credentials_ref" { + value = module.dbaas.credentials_ref +} diff --git a/terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/credentials-ee649378-1298-41a1-b923-d0ab40646c5a_override.tf b/terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/credentials-ee649378-1298-41a1-b923-d0ab40646c5a_override.tf new file mode 100644 index 0000000..c4fbbd7 --- /dev/null +++ b/terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/credentials-ee649378-1298-41a1-b923-d0ab40646c5a_override.tf @@ -0,0 +1,8 @@ +// Generated by the provisioner. Credential rotation marker for the catalog +// modules of this deployment: the credential renewal workflow rewrites the +// version value to rotate the generated credentials. Terraform merges these +// blocks into the module blocks of the deployment script through the +// override file mechanism, so the deployment script never declares them. +module "dbaas" { + credentials_version = "1" +} diff --git a/terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/providers-ee649378-1298-41a1-b923-d0ab40646c5a.tf b/terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/providers-ee649378-1298-41a1-b923-d0ab40646c5a.tf new file mode 100644 index 0000000..9e1841c --- /dev/null +++ b/terraform-configurations/ee649378-1298-41a1-b923-d0ab40646c5a/providers-ee649378-1298-41a1-b923-d0ab40646c5a.tf @@ -0,0 +1,17 @@ +// Generated by the provisioner. Vault provider configuration for catalog +// modules that store generated credentials. Authentication is the Kubernetes +// service account of the Terraform runner, exchanged for a Vault token +// through the Kubernetes auth method, never a value from this file or the +// user body. +provider "vault" { + address = "https://secrets.common01.dev-sandbox-ionos.simpl-europe.eu" + skip_child_token = true + + auth_login { + path = "auth/kubernetes/login" + parameters = { + role = "provisioner-role" + jwt = file("/var/run/secrets/kubernetes.io/serviceaccount/token") + } + } +}