-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathdb.tf
159 lines (125 loc) · 4.81 KB
/
db.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
resource "random_string" "db_root_password" {
count = var.db_password == "" ? 1 : 0
length = 16
special = false
}
resource "aws_security_group" "db" {
name = "db-${var.db_identifier}-${var.env}"
description = "Security group for db ${var.db_identifier}-${var.env}"
vpc_id = var.aws["vpc_id"]
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
self = true
}
tags = var.db_tags
}
resource "aws_security_group_rule" "db-self" {
description = "Allow db sg to communicate with each other"
from_port = 0
protocol = "-1"
security_group_id = aws_security_group.db.id
to_port = 65535
type = "ingress"
self = true
}
resource "aws_security_group_rule" "db-eks" {
description = "Allow worker Kubelets and pods to communicate with ${var.db_identifier}-${var.env} DB"
from_port = var.db_port
protocol = "tcp"
security_group_id = aws_security_group.db.id
source_security_group_id = data.terraform_remote_state.eks.outputs.eks-node-sg
to_port = var.db_port
type = "ingress"
}
resource "aws_security_group_rule" "db-bastion-eks" {
count = data.terraform_remote_state.eks.outputs.bastion-sg == "" ? 0 : 1
description = "Allow worker Kubelets and pods to communicate with ${var.db_identifier}-${var.env} DB"
from_port = var.db_port
protocol = "tcp"
security_group_id = aws_security_group.db.id
source_security_group_id = data.terraform_remote_state.eks.outputs.bastion-sg
to_port = var.db_port
type = "ingress"
}
resource "aws_security_group_rule" "db-bastion" {
count = var.db_remote_security_group_id == "" ? 0 : 1
description = "Allow worker Kubelets and pods to communicate with ${var.db_identifier}-${var.env} DB"
from_port = var.db_port
protocol = "tcp"
security_group_id = aws_security_group.db.id
source_security_group_id = var.db_remote_security_group_id
to_port = var.db_port
type = "ingress"
}
module "db" {
source = "terraform-aws-modules/rds/aws"
version = "~> v2.0"
identifier = "${var.db_identifier}-${var.env}"
engine = var.db_engine
engine_version = var.db_engine_version
family = var.db_family
major_engine_version = var.db_major_engine_version
ca_cert_identifier = var.db_ca_cert_identifier
create_db_option_group = var.db_create_db_option_group
parameters = var.db_parameters
instance_class = var.db_instance_class
allocated_storage = var.db_allocated_storage
storage_encrypted = var.db_storage_encrypted
storage_type = var.db_storage_type
max_allocated_storage = var.db_max_allocated_storage
name = var.db_name
username = var.db_username
password = var.db_password == "" ? join(",", random_string.db_root_password.*.result) : var.db_password
port = var.db_port
vpc_security_group_ids = [aws_security_group.db.id]
maintenance_window = var.db_maintenance_window
apply_immediately = var.db_apply_immediately
backup_window = var.db_backup_window
backup_retention_period = var.db_backup_retention_period
tags = var.db_tags
enabled_cloudwatch_logs_exports = var.db_enable_cloudwatch_logs_exports
subnet_ids = data.aws_subnet_ids.private.ids
final_snapshot_identifier = "${var.db_identifier}-${var.env}-final-snapshot"
deletion_protection = var.db_deletion_protection
multi_az = var.db_multi_az
}
resource "kubernetes_secret" "db_secret" {
count = length(var.inject_secret_into_ns)
metadata {
name = "db-${var.db_identifier}-${var.env}"
namespace = var.inject_secret_into_ns[count.index]
}
data = {
DB_USERNAME = module.db.this_db_instance_username
DB_NAME = module.db.this_db_instance_name
DB_PASSWORD = var.db_password == "" ? random_string.db_root_password[0].result : var.db_password
DB_ENDPOINT = module.db.this_db_instance_endpoint
DB_ADDRESS = module.db.this_db_instance_address
DB_PORT = module.db.this_db_instance_port
}
}
output "db_instance_address" {
value = module.db.this_db_instance_address
}
output "db_instance_port" {
value = module.db.this_db_instance_port
}
output "db_instance_endpoint" {
value = module.db.this_db_instance_endpoint
}
output "db_instance_username" {
value = module.db.this_db_instance_username
}
output "db_instance_password" {
value = module.db.this_db_instance_password
sensitive = true
}
output "db_security_group_id" {
value = aws_security_group.db.id
}
output "db_instance_name" {
value = module.db.this_db_instance_name
}