Passes credential outputs through external data source (#91)

Signed-off-by: Sean Sundberg <[email protected]>

Author: Sean Sundberg

main.tf

@@ -221,6 +221,20 @@ resource ibm_is_security_group_rule rule_tcp_k8s {
   }
 }
 
+data external credentials {
+  depends_on = [ibm_container_vpc_cluster.cluster]
+  program = ["bash", "${path.module}/scripts/get-credentials.sh"]
+
+  query = {
+    public_endpoint = data.ibm_container_vpc_cluster.config.public_service_endpoint
+    public_server_url = data.ibm_container_vpc_cluster.config.public_service_endpoint_url
+    private_server_url = data.ibm_container_vpc_cluster.config.private_service_endpoint_url
+    username = "apikey"
+    ibmcloud_api_key = var.ibmcloud_api_key
+    token = ""
+  }
+}
+
 data ibm_container_vpc_cluster config {
   depends_on = [ibm_container_vpc_cluster.cluster, ibm_is_security_group_rule.rule_tcp_k8s]
 

outputs.tf

@@ -62,22 +62,22 @@ output "workers" {
 
 output "server_url" {
   description = "The url used to connect to the api server. If the cluster has public endpoints enabled this will be the public api server, otherwise this will be the private api server url"
-  value = data.ibm_container_vpc_cluster.config.public_service_endpoint ? data.ibm_container_vpc_cluster.config.public_service_endpoint_url : data.ibm_container_vpc_cluster.config.private_service_endpoint_url
+  value = data.external.credentials.result.server_url
 }
 
 output "username" {
   description = "The username of the admin user for the cluster"
-  value = "apikey"
+  value = data.external.credentials.result.username
 }
 
 output "password" {
   description = "The password of the admin user for the cluster"
-  value = var.ibmcloud_api_key
+  value = data.external.credentials.result.password
   sensitive = true
 }
 
 output "token" {
   description = "The admin user token used to generate the cluster"
-  value = ""
+  value = data.external.credentials.result.token
   sensitive = true
 }

scripts/get-credentials.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+
+INPUT=$(tee)
+
+BIN_DIR=$(echo "${INPUT}" | grep bin_dir | sed -E 's/.*"bin_dir": ?"([^"]*)".*/\1/g')
+
+export PATH="${BIN_DIR}:${PATH}"
+
+PUBLIC_ENDPOINT=$(echo "${INPUT}" | jq -r '.public_endpoint')
+PUBLIC_SERVER_URL=$(echo "${INPUT}" | jq -r '.public_server_url')
+PRIVATE_SERVER_URL=$(echo "${INPUT}" | jq -r '.private_server_url')
+IBMCLOUD_API_KEY=$(echo "${INPUT}" | jq -r '.ibmcloud_api_key')
+USERNAME=$(echo "${INPUT}" | jq -r '.username')
+TOKEN=$(echo "${INPUT}" | jq -r '.token')
+
+if [[ "${PUBLIC_ENDPOINT}" == "true" ]]; then
+  SERVER_URL="${PUBLIC_SERVER_URL}"
+else
+  SERVER_URL="${PRIVATE_SERVER_URL}"
+fi
+
+jq -n \
+  --arg SERVER_URL "${SERVER_URL}" \
+  --arg USERNAME "${USERNAME}" \
+  --arg PASSWORD "${IBMCLOUD_API_KEY}" \
+  --arg TOKEN "${TOKEN}" \
+  '{"server_url": $SERVER_URL,"username": $USERNAME, "password": $PASSWORD, "token": $TOKEN}'