refactor(external): create terraform secrets after apply

.tekton/external.yaml

@@ -20,7 +20,7 @@ spec:
   volumes:
     - name: terraform-secrets
       secret:
-        secretName: terraform
+        secretName: terraform-secrets
   steps:
     - name: lint
       args:

external/Makefile

@@ -3,20 +3,26 @@
 
 KUBE_CONFIG_PATH = ../metal/kubeconfig.yaml
 
-default: apply
+default: apply terraform-secrets
 
 ~/.terraform.d/credentials.tfrc.json:
 	terraform login
 
 terraform.tfvars:
-	ansible-playbook secrets.yml
+	ansible-playbook tfvars.yml
 
 .terraform.lock.hcl: ~/.terraform.d/credentials.tfrc.json versions.tf terraform.tfvars
 	terraform init
 	touch .terraform.lock.hcl
 
+namespaces:
+	ansible-playbook namespaces.yml
+
 plan: .terraform.lock.hcl
 	terraform plan
 
-apply: .terraform.lock.hcl
-	terraform apply -auto-approve
+apply: .terraform.lock.hcl namespaces
+	terraform apply
+
+terraform-secrets:
+	ansible-playbook terraform-secrets.yml

external/namespaces.yml

@@ -0,0 +1,13 @@
+- hosts: localhost
+  tasks:
+    - name: Ensure required namespaces exist
+      kubernetes.core.k8s:
+        api_version: v1
+        kind: Namespace
+        name: "{{ item }}"
+        state: present
+      loop:
+        - tekton-pipelines
+        - cert-manager
+        - external-dns
+        - cloudflared

external/secrets.yml

@@ -1,45 +0,0 @@
-# pip install kuberentes
-- name: Bootstrap external secrets
-  hosts: localhost
-  vars_prompt:
-    - name: cloudflare_email
-      prompt: Enter Cloudflare email
-      private: no
-    - name: cloudflare_api_key
-      prompt: Enter Cloudflare API Key (sensitive)
-    - name: cloudflare_account_id
-      prompt: Enter Cloudflare account ID
-      private: no
-    - name: b2_application_key_id
-      prompt: Enter Backblaze application key ID
-      private: no
-    - name: b2_application_key
-      prompt: Enter Backblaze application key (sensitive)
-  tasks:
-    - name: Render environment file
-      template:
-        src: ./terraform.tfvars.j2
-        dest: ./terraform.tfvars
-    - name: Ensure required namespaces exist
-      kubernetes.core.k8s:
-        api_version: v1
-        kind: Namespace
-        name: "{{ item }}"
-        state: present
-      loop:
-        - tekton-pipelines
-        - cert-manager
-        - external-dns
-        - cloudflared
-    - name: Add Terraform secrets to Tekton namespace
-      kubernetes.core.k8s:
-        definition:
-          apiVersion: v1
-          kind: Secret
-          type: Opaque
-          metadata:
-            name: terraform
-            namespace: tekton-pipelines
-          data:
-            credentials.tfrc.json: "{{ lookup('file', '~/.terraform.d/credentials.tfrc.json') | b64encode }}"
-            terraform.tfvars: "{{ lookup('file', './terraform.tfvars') | b64encode }}"

external/terraform-secrets.yml

@@ -0,0 +1,15 @@
+# pip install kuberentes
+- hosts: localhost
+  tasks:
+    - name: Inject Terraform secrets to Tekton namespace
+      kubernetes.core.k8s:
+        definition:
+          apiVersion: v1
+          kind: Secret
+          type: Opaque
+          metadata:
+            name: terraform-secrets
+            namespace: tekton-pipelines
+          data:
+            credentials.tfrc.json: "{{ lookup('file', '~/.terraform.d/credentials.tfrc.json') | b64encode }}"
+            terraform.tfvars: "{{ lookup('file', './terraform.tfvars') | b64encode }}"

external/tfvars.yml

@@ -0,0 +1,21 @@
+- name: Bootstrap external secrets
+  hosts: localhost
+  vars_prompt:
+    - name: cloudflare_email
+      prompt: Enter Cloudflare email
+      private: no
+    - name: cloudflare_api_key
+      prompt: Enter Cloudflare API Key (sensitive)
+    - name: cloudflare_account_id
+      prompt: Enter Cloudflare account ID
+      private: no
+    - name: b2_application_key_id
+      prompt: Enter Backblaze application key ID
+      private: no
+    - name: b2_application_key
+      prompt: Enter Backblaze application key (sensitive)
+  tasks:
+    - name: Render environment file
+      template:
+        src: ./terraform.tfvars.j2
+        dest: ./terraform.tfvars