[BOYSCOUT]: Generate and wire status check token

Generate a per-deployment status check token and inject it into the
rendered deployment CR so the server /livez and /readyz probes can
validate it.

- Add a random_password resource that produces a 32-char alphanumeric
  token by default.
- Resolve the token via coalesce(var.status_check_token, generated),
  changing the variable default from "token" to null so the generated
  value is used unless an operator overrides it explicitly.
- Pass the resolved token into the infra_settings.tpl templatefile call
  and render it as global.statusCheckToken (quoted for YAML safety).
- Declare the hashicorp/random provider in versions.tf.

Author: cfernhout

examples/deployment/infra/config.tf

@@ -1,3 +1,15 @@
+# Generate a random status check token by default. It is used by the server
+# /livez and /readyz probes. Operators can override it by setting the
+# status_check_token variable explicitly.
+resource "random_password" "status_check_token" {
+  length  = 32
+  special = false
+}
+
+locals {
+  status_check_token = coalesce(var.status_check_token, random_password.status_check_token.result)
+}
+
 # Output the infrastructure configuration to console
 output "infra_config" {
   description = "Infrastructure configuration for Datafold deployment"
@@ -32,6 +44,7 @@ output "infra_config" {
       redis_data_volume_id           = module.aws[0].redis_data_volume_id,
       server_name                    = module.aws[0].domain_name,
       vpc_cidr                       = module.aws[0].vpc_cidr,
+      status_check_token             = local.status_check_token,
 
       # service accounts vars
       dfshell_role_arn                        = module.aws[0].dfshell_role_arn,

examples/deployment/infra/variables.tf

@@ -6,6 +6,6 @@ variable "backend_app_port" {
 
 variable "status_check_token" {
   type        = string
-  default     = "token"
-  description = "The status check token to apply"
+  default     = null
+  description = "The status check token used by the server /livez and /readyz probes. When left unset (null), a random token is generated automatically."
 }

examples/deployment/infra/versions.tf

@@ -4,5 +4,9 @@ terraform {
       source  = "carlpett/sops"
       version = "~> 0.5"
     }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.0"
+    }
   }
 }

examples/deployment/templates/infra_settings.tpl

@@ -32,6 +32,7 @@ global:
     server: ${postgres_server}
   serverName: ${server_name}
   vpcCidr: ${vpc_cidr}
+  statusCheckToken: "${status_check_token}"
 
 nginx:
   service: