Add password auth support

Author: bobbyiliev

kubernetes/modules/materialize-instance/README.md

@@ -28,6 +28,7 @@ No modules.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_authenticator_kind"></a> [authenticator\_kind](#input\_authenticator\_kind) | Kind of authenticator to use for Materialize instance | `string` | `"None"` | no |
 | <a name="input_balancer_cpu_request"></a> [balancer\_cpu\_request](#input\_balancer\_cpu\_request) | CPU request for balancer | `string` | `"100m"` | no |
 | <a name="input_balancer_memory_limit"></a> [balancer\_memory\_limit](#input\_balancer\_memory\_limit) | Memory limit for balancer | `string` | `"256Mi"` | no |
 | <a name="input_balancer_memory_request"></a> [balancer\_memory\_request](#input\_balancer\_memory\_request) | Memory request for balancer | `string` | `"256Mi"` | no |
@@ -36,6 +37,7 @@ No modules.
 | <a name="input_environmentd_extra_args"></a> [environmentd\_extra\_args](#input\_environmentd\_extra\_args) | Extra command line arguments for environmentd | `list(string)` | `[]` | no |
 | <a name="input_environmentd_extra_env"></a> [environmentd\_extra\_env](#input\_environmentd\_extra\_env) | Extra environment variables for environmentd | <pre>list(object({<br/>    name  = string<br/>    value = string<br/>  }))</pre> | `[]` | no |
 | <a name="input_environmentd_version"></a> [environmentd\_version](#input\_environmentd\_version) | Version of environmentd to use | `string` | `"v0.130.13"` | no |
+| <a name="input_external_login_password_mz_system"></a> [external\_login\_password\_mz\_system](#input\_external\_login\_password\_mz\_system) | Password for external login to mz\_system | `string` | `null` | no |
 | <a name="input_force_rollout"></a> [force\_rollout](#input\_force\_rollout) | UUID to force a rollout | `string` | `"00000000-0000-0000-0000-000000000001"` | no |
 | <a name="input_in_place_rollout"></a> [in\_place\_rollout](#input\_in\_place\_rollout) | Whether to perform in-place rollouts | `bool` | `true` | no |
 | <a name="input_instance_name"></a> [instance\_name](#input\_instance\_name) | Name of the Materialize instance | `string` | n/a | yes |

kubernetes/modules/materialize-instance/main.tf

@@ -25,6 +25,7 @@ resource "kubernetes_manifest" "materialize_instance" {
     spec = {
       environmentdImageRef = "materialize/environmentd:${var.environmentd_version}"
       backendSecretName    = "${var.instance_name}-materialize-backend"
+      authenticatorKind    = var.authenticator_kind
       inPlaceRollout       = var.in_place_rollout
       requestRollout       = var.request_rollout
       forceRollout         = var.force_rollout
@@ -73,11 +74,16 @@ resource "kubernetes_secret" "materialize_backend" {
     namespace = var.instance_namespace
   }
 
-  data = {
-    metadata_backend_url = var.metadata_backend_url
-    persist_backend_url  = var.persist_backend_url
-    license_key          = var.license_key == null ? "" : var.license_key
-  }
+  data = merge(
+    {
+      metadata_backend_url = var.metadata_backend_url
+      persist_backend_url  = var.persist_backend_url
+      license_key          = var.license_key == null ? "" : var.license_key
+    },
+    var.authenticator_kind == "Password" && var.external_login_password_mz_system != null ? {
+      external_login_password_mz_system = var.external_login_password_mz_system
+    } : {}
+  )
 
   depends_on = [
     kubernetes_namespace.instance

kubernetes/modules/materialize-instance/variables.tf

@@ -120,3 +120,26 @@ variable "balancer_cpu_request" {
   type        = string
   default     = "100m"
 }
+
+variable "authenticator_kind" {
+  description = "Kind of authenticator to use for Materialize instance"
+  type        = string
+  default     = "None"
+
+  validation {
+    condition     = contains(["None", "Password"], var.authenticator_kind)
+    error_message = "Authenticator kind must be either 'None' or 'Password'"
+  }
+}
+
+variable "external_login_password_mz_system" {
+  description = "Password for external login to mz_system"
+  type        = string
+  default     = null
+  sensitive   = true
+
+  validation {
+    condition     = var.authenticator_kind == "Password" || var.external_login_password_mz_system == null
+    error_message = "external_login_password_mz_system must be set if authenticator_kind is 'Password'"
+  }
+}