118 lines
3.6 KiB
HCL
118 lines
3.6 KiB
HCL
#
|
|
# Keycloak cluster.
|
|
#
|
|
# Derived from the d4science 'keycloak' module, rewritten for this repository:
|
|
# the ports are separate resources, the security groups go on the ports, and
|
|
# nothing is read from another state inside the module. The addresses of the
|
|
# instances are known in advance (keycloak_ip), so the rules of the cluster
|
|
# security group do not depend on the instances being created first.
|
|
#
|
|
|
|
variable "keycloak_data" {
|
|
description = "Instances of the keycloak cluster. m1.medium is RAM 4 - VCPUs 2"
|
|
type = object({
|
|
srv_name = optional(string, "keycloak")
|
|
vm_count = optional(number, 2)
|
|
flavor = optional(string, "m1.medium")
|
|
boot_vol_size = optional(number, 30)
|
|
# 'anti-affinity' is hard: the scheduler fails instead of co-locating the
|
|
# instances. 'soft-anti-affinity' only expresses a preference
|
|
affinity_policy = optional(string, "anti-affinity")
|
|
# Ports the service listens on
|
|
https_port = optional(number, 9443)
|
|
management_port = optional(number, 9000)
|
|
})
|
|
default = {}
|
|
}
|
|
|
|
variable "keycloak_ip" {
|
|
type = list(string)
|
|
description = "Addresses of the instances on the main private network, one per instance"
|
|
validation {
|
|
condition = length(var.keycloak_ip) >= var.keycloak_data.vm_count
|
|
error_message = "keycloak_ip must contain at least vm_count addresses."
|
|
}
|
|
}
|
|
|
|
# Data that comes from the network/DNS and project setup workspaces
|
|
variable "main_private_network_id" {
|
|
type = string
|
|
description = "ID of the main private network of the project"
|
|
}
|
|
|
|
variable "main_private_subnet_id" {
|
|
type = string
|
|
description = "ID of the main private subnet of the project"
|
|
}
|
|
|
|
variable "default_security_group_id" {
|
|
type = string
|
|
description = "ID of the 'default_for_all' security group of the project"
|
|
}
|
|
|
|
variable "haproxy_l7_ip" {
|
|
type = list(string)
|
|
description = "Addresses of the L7 HAPROXY load balancers, allowed to reach the service"
|
|
}
|
|
|
|
variable "prometheus_cidr" {
|
|
type = string
|
|
description = "Address of the Prometheus server, allowed to scrape the management port"
|
|
}
|
|
|
|
# Data that comes from the postgresql workspace
|
|
variable "postgresql_network_id" {
|
|
type = string
|
|
description = "ID of the dedicated network of the PostgreSQL service"
|
|
}
|
|
|
|
variable "postgresql_subnet_id" {
|
|
type = string
|
|
description = "ID of the dedicated subnet of the PostgreSQL service"
|
|
}
|
|
|
|
variable "postgresql_client_security_group_id" {
|
|
type = string
|
|
description = "Security group that allows the connections to the PostgreSQL service"
|
|
}
|
|
|
|
variable "availability_zone" {
|
|
type = string
|
|
description = "Availability zone hint of the instances"
|
|
}
|
|
|
|
variable "image" {
|
|
description = "Image of the instances: uuid and cloud-init user data file"
|
|
type = object({
|
|
uuid = string
|
|
user_data_file = string
|
|
})
|
|
}
|
|
|
|
variable "ssh_key_name" {
|
|
type = string
|
|
description = "Name of the SSH key pair injected by cloud-init"
|
|
}
|
|
|
|
# Optional CNAMEs pointing to the load balancer that publishes the service
|
|
variable "dns_zone_id" {
|
|
type = string
|
|
default = ""
|
|
description = "ID of the DNS zone. Required when keycloak_recordsets is not empty"
|
|
}
|
|
|
|
variable "keycloak_cname_target" {
|
|
type = string
|
|
default = ""
|
|
description = "Target of the CNAMEs, usually the name of the main load balancer, with the trailing dot"
|
|
}
|
|
|
|
variable "keycloak_recordsets" {
|
|
description = "CNAMEs that publish the service through the load balancer"
|
|
type = map(object({
|
|
name = string
|
|
description = string
|
|
}))
|
|
default = {}
|
|
}
|