devops-stack-module-secrets

A DevOps Stack module to deploy the External Secrets Operator and Reloader.

The charts used by this module is shipped in this repository as well, in order to avoid any unwanted behaviors caused by unsupported versions.

Chart	Current Chart Version	Original Repository	Default Values
External Secrets Operator	0.10.0	Chart	values.yaml
Reloader	1.0.119	Chart	values.yaml

Usage

This module can be declared by adding the following block on your Terraform configuration:

module "secrets" {
  source = "git::https://github.com/camptocamp/devops-stack-module-secrets.git?ref=<RELEASE>"

  cluster_name   = local.cluster_name
  base_domain    = local.base_domain
  argocd_project = local.cluster_name

  dependency_ids = {
    argocd = module.argocd.id
  }
}

Technical Reference

Dependencies

module.argocd.id

Obviously, the module depends on an already running Argo CD in the cluster in order for the application to be created.

Requirements

The following requirements are needed by this module:

• argocd (>= 6)

• null (>= 3)

• utils (>= 1)

Providers

The following providers are used by this module:

• utils (>= 1)

• argocd (>= 6)

• null (>= 3)

Resources

The following resources are used by this module:

• argocd_application.this (resource)

• argocd_project.this (resource)

• null_resource.dependencies (resource)

• null_resource.this (resource)

• utils_deep_merge_yaml.values (data source)

Optional Inputs

The following input variables are optional (have default values):

argocd_project

Description: Name of the Argo CD AppProject where the Application should be created. If not set, the Application will be created in a new AppProject only for this Application.

Type: string

Default: null

argocd_labels

Description: Labels to attach to the Argo CD Application resource.

Type: map(string)

Default: {}

destination_cluster

Description: Destination cluster where the application should be deployed.

Type: string

Default: "in-cluster"

target_revision

Description: Override of target revision of the application chart.

Type: string

Default: "v1.0.0"

enable_service_monitor

Description: Enable Prometheus ServiceMonitor in the Helm chart.

Type: bool

Default: true

helm_values

Description: Helm chart value overrides. They should be passed as a list of HCL structures.

Type: any

Default: []

deep_merge_append_list

Description: A boolean flag to enable/disable appending lists instead of overwriting them.

Type: bool

Default: false

app_autosync

Description: Automated sync options for the Argo CD Application resource.

Type:

object({
    allow_empty = optional(bool)
    prune       = optional(bool)
    self_heal   = optional(bool)
  })

Default:

{
  "allow_empty": false,
  "prune": true,
  "self_heal": true
}

dependency_ids

Description: IDs of the other modules on which this module depends on.

Type: map(string)

Default: {}

resources

Description: Resource limits and requests for External Secrets’s and Reloader’s components. Follow the style on official documentation to understand the format of the values.

Important

These are not production values. You should always adjust them to your needs.

Type:

object({

    external_secrets_operator = optional(object({
      requests = optional(object({
        cpu    = optional(string, "10m")
        memory = optional(string, "32Mi")
      }), {})
      limits = optional(object({
        cpu    = optional(string)
        memory = optional(string, "128Mi")
      }), {})
    }), {})

    external_secrets_webhook = optional(object({
      requests = optional(object({
        cpu    = optional(string, "10m")
        memory = optional(string, "32Mi")
      }), {})
      limits = optional(object({
        cpu    = optional(string)
        memory = optional(string, "128Mi")
      }), {})
    }), {})

    external_secrets_cert_controller = optional(object({
      requests = optional(object({
        cpu    = optional(string, "10m")
        memory = optional(string, "32Mi")
      }), {})
      limits = optional(object({
        cpu    = optional(string)
        memory = optional(string, "128Mi")
      }), {})
    }), {})

    reloader = optional(object({
      requests = optional(object({
        cpu    = optional(string, "10m")
        memory = optional(string, "32Mi")
      }), {})
      limits = optional(object({
        cpu    = optional(string)
        memory = optional(string, "128Mi")
      }), {})
    }), {})

  })

Default: {}

replicas

Description: Number of replicas for the External Secrets and Reloader components.

Type:

object({
    external_secrets = number
    reloader         = number
  })

Default:

{
  "external_secrets": 1,
  "reloader": 1
}

auto_reload_all

Description: Boolean to enable auto reloading for all resources.

In this case, all resources that do not have the auto annotation (or its typed version) set to "false", will be reloaded automatically when their ConfigMaps or Secrets are updated. Notice that setting the auto annotation to an undefined value counts as false as-well. " # TOD

Type: bool

Default: false

Outputs

The following outputs are exported:

id

Description: ID to pass other modules in order to refer to this module as a dependency.

Reference in table format

Show tables

= Requirements

Name	Version
argocd	>= 6
null	>= 3
utils	>= 1

= Providers

Name	Version
null	>= 3
argocd	>= 6
utils	>= 1

= Resources

Name	Type
argocd_application.this	resource
argocd_project.this	resource
null_resource.dependencies	resource
null_resource.this	resource
utils_deep_merge_yaml.values	data source

= Inputs

Name	Description	Type	Default	Required
argocd_project	Name of the Argo CD AppProject where the Application should be created. If not set, the Application will be created in a new AppProject only for this Application.	string	null	no
argocd_labels	Labels to attach to the Argo CD Application resource.	map(string)	{}	no
destination_cluster	Destination cluster where the application should be deployed.	string	"in-cluster"	no
target_revision	Override of target revision of the application chart.	string	"v1.0.0"	no
enable_service_monitor	Enable Prometheus ServiceMonitor in the Helm chart.	bool	true	no
helm_values	Helm chart value overrides. They should be passed as a list of HCL structures.	any	[]	no
deep_merge_append_list	A boolean flag to enable/disable appending lists instead of overwriting them.	bool	false	no
app_autosync	Automated sync options for the Argo CD Application resource.	object({ allow_empty = optional(bool) prune = optional(bool) self_heal = optional(bool) })	{ "allow_empty": false, "prune": true, "self_heal": true }	no
dependency_ids	IDs of the other modules on which this module depends on.	map(string)	{}	no
resources	Resource limits and requests for External Secrets’s and Reloader’s components. Follow the style on official documentation to understand the format of the values. Important These are not production values. You should always adjust them to your needs.	object({ external_secrets_operator = optional(object({ requests = optional(object({ cpu = optional(string, "10m") memory = optional(string, "32Mi") }), {}) limits = optional(object({ cpu = optional(string) memory = optional(string, "128Mi") }), {}) }), {}) external_secrets_webhook = optional(object({ requests = optional(object({ cpu = optional(string, "10m") memory = optional(string, "32Mi") }), {}) limits = optional(object({ cpu = optional(string) memory = optional(string, "128Mi") }), {}) }), {}) external_secrets_cert_controller = optional(object({ requests = optional(object({ cpu = optional(string, "10m") memory = optional(string, "32Mi") }), {}) limits = optional(object({ cpu = optional(string) memory = optional(string, "128Mi") }), {}) }), {}) reloader = optional(object({ requests = optional(object({ cpu = optional(string, "10m") memory = optional(string, "32Mi") }), {}) limits = optional(object({ cpu = optional(string) memory = optional(string, "128Mi") }), {}) }), {}) })	{}	no
replicas	Number of replicas for the External Secrets and Reloader components.	object({ external_secrets = number reloader = number })	{ "external_secrets": 1, "reloader": 1 }	no
auto_reload_all	Boolean to enable auto reloading for all resources. In this case, all resources that do not have the auto annotation (or its typed version) set to "false", will be reloaded automatically when their ConfigMaps or Secrets are updated. Notice that setting the auto annotation to an undefined value counts as false as-well. " # TOD	bool	false	no

= Outputs

Name	Description
id	ID to pass other modules in order to refer to this module as a dependency.