iac

Infrastructure as Code (IaC) by Bryan J.

A comprehensive set of tools and configurations for automating tasks across various environments.

Blog »

Kubernetes Deployments · Ansible Roles · Terraform Modules

Overview

This repository provides a set of tools and configurations for automating tasks across environments. It includes Ansible playbooks and roles, Docker configurations, Kubernetes manifests, Terraform modules, and Packer scripts. Secrets are managed through various methods, most notably Bitwarden Secrets Manager. The project is designed with flexibility in mind, allowing me to configure every inch of my infrastructure programmatically while being modular.

About The Lab

Kubernetes

Core Components

• Cilium: Internal Kubernetes networking plugin.
• Cert-manager: Creates SSL certificates for services in the cluster.
• External DNS: Syncs DNS records from Kubernetes ingresses to a DNS provider.
• External Secrets: Manages Kubernetes secrets using Bitwarden.
• Ingress NGINX: NGINX-based ingress controller for Kubernetes.
• Rook Ceph: Open-Source, Cloud-Native Storage for Kubernetes.
• Tofu Controller: Runs Terraform from within a Kubernetes cluster.

Terraform

❯ tree -L1 terraform
terraform
├── _modules
├── _templates
├── authentik
├── aws
[...]

Core Components

bws-cache

Securely retrieves secrets into the Terraform state by making API requests to a secrets management service (like Bitwarden) using an access token. By leveraging the bws-cache, it ensures sensitive information is dynamically fetched and securely passed into the Terraform state without hardcoding secrets, minimizing exposure risks.

[...]
for key in key_name:
  bws_response = requests.get(
      f"http://mgmt-srv-01:5000/key/{key}",
      headers={"Authorization": f"Bearer {access_token}"},
      timeout=10,
  ).json()

  logging.debug(bws_response)

  try:
      results.append(bws_response['value'])
  except KeyError as exc:
      raise InvalidToken(
          "Token is invalid or does not have permissions to read value"
      ) from exc
[...]

resource "radarr_download_client_sabnzbd" "sabnzbd" {
  enable         = true
  priority       = 1
  name           = "sabnzbd"
  host           = "sabnzbd.${var.cluster_media_domain}"
  url_base       = "/"
  port           = var.ports["sabnzbd"]
  movie_category = "movies"
  api_key        = data.external.bws_lookup.result["infra-media-secrets_sabnzbd_api_key"]
}

Ansible

Core Components

N/A

Equipment

(back to top)

Roadmap

• Finish README