Skip to content

k8s: fix MySQL-TLS schema references in deploy/job/cronjob#238

Open
TobiKr wants to merge 1 commit into
fleetdm:mainfrom
TobiKr:fix/k8s-mysql-tls-schema-refs
Open

k8s: fix MySQL-TLS schema references in deploy/job/cronjob#238
TobiKr wants to merge 1 commit into
fleetdm:mainfrom
TobiKr:fix/k8s-mysql-tls-schema-refs

Conversation

@TobiKr
Copy link
Copy Markdown

@TobiKr TobiKr commented May 26, 2026

The database.tls input variable schema (k8s/variables.tf) declares six
attributes: enabled, config, server_name, ca_cert_key, cert_key, key_key.
However k8s/deploy.tf, k8s/job.tf, and k8s/cronjob.tf reference two
attributes that do not exist on that type:

  • local.database.tls.cert_secret_key -> should be cert_key
  • local.database.tls.secret_name -> not on tls; the MySQL secret
    is local.database.secret_name

These are inside dynamic blocks gated on local.database.tls.enabled,
but Terraform type-checks the expressions during planning regardless,
so any consumer setting database.tls.enabled = true (or even leaving
TLS off, since the type-check is static) hits:

Error: Unsupported attribute
This object does not have an attribute named "cert_secret_key".
Error: Unsupported attribute
This object does not have an attribute named "secret_name".

Align all three files with the variable schema, matching the pattern
already used for the password env var (which correctly reads
local.database.secret_name).

The database.tls input variable schema (k8s/variables.tf) declares six
attributes: enabled, config, server_name, ca_cert_key, cert_key, key_key.
However k8s/deploy.tf, k8s/job.tf, and k8s/cronjob.tf reference two
attributes that do not exist on that type:

  * local.database.tls.cert_secret_key  -> should be cert_key
  * local.database.tls.secret_name      -> not on tls; the MySQL secret
                                           is local.database.secret_name

These are inside dynamic blocks gated on local.database.tls.enabled,
but Terraform type-checks the expressions during planning regardless,
so any consumer setting database.tls.enabled = true (or even leaving
TLS off, since the type-check is static) hits:

  Error: Unsupported attribute
    This object does not have an attribute named "cert_secret_key".
  Error: Unsupported attribute
    This object does not have an attribute named "secret_name".

Align all three files with the variable schema, matching the pattern
already used for the password env var (which correctly reads
local.database.secret_name).
@TobiKr TobiKr requested review from a team and ddribeiro as code owners May 26, 2026 10:21
@BCTBB
Copy link
Copy Markdown
Contributor

BCTBB commented Jun 4, 2026

@TobiKr Thank you for your contribution! We'll schedule the review of your proposed changes for next sprint.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants