fix: Remove volume type variable, handle invalid index error (#24)

* fix: Remove volume type, handle invalid index error

* docs: update terraform docs

* Only use throughput and iops if appropriate type

see [docs](https://registry.terraform.io/providers/hashicorp/aws/5.81.0/docs/resources/ebs_volume#throughput-1)

* docs: update terraform docs

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Martin Norbury <martin.norbury@gmail.com>

Author: 3 people

.github/workflows/terraform.yml

@@ -10,6 +10,7 @@ permissions:
   contents: write
   pull-requests: write
   security-events: write
+  # id-token: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -169,6 +170,12 @@ jobs:
         working-directory: ${{ matrix.example }}
 
     steps:
+      # - name: Configure AWS credentials
+      #   uses: aws-actions/configure-aws-credentials@v4
+      #   with:
+      #     role-to-assume: "arn:aws:iam::615713231484:role/terraform-cloudquery-modules-repo-role"
+      #     aws-region: us-east-1
+
       - name: Checkout
         uses: actions/checkout@v4
 
@@ -183,3 +190,6 @@ jobs:
 
       - name: Terraform Validate
         run: terraform validate
+
+      # - name: Terraform Plan
+      #   run: terraform plan

clickhouse/ebs.tf

@@ -3,8 +3,8 @@ resource "aws_ebs_volume" "clickhouse" {
   availability_zone = module.vpc.private_subnet_objects[each.value.subnet_index].availability_zone
   size              = var.clickhouse_volume_size
   type              = var.clickhouse_volume_type
-  throughput        = 125
-  iops              = 3000
+  throughput        = var.clickhouse_volume_type == "gp3" ? 125 : null
+  iops              = contains(["io1", "io2", "gp3"], var.clickhouse_volume_type) ? 3000 : null
   tags              = var.tags
 }
 
@@ -20,8 +20,8 @@ resource "aws_ebs_volume" "keeper" {
   availability_zone = module.vpc.private_subnet_objects[each.value.subnet_index].availability_zone
   size              = var.keeper_volume_size
   type              = var.keeper_volume_type
-  throughput        = 125
-  iops              = 3000
+  throughput        = var.keeper_volume_type == "gp3" ? 125 : null
+  iops              = contains(["io1", "io2", "gp3"], var.keeper_volume_type) ? 3000 : null
   tags              = var.tags
 }
 

clickhouse/examples/tls-encryption/main.tf

@@ -46,9 +46,7 @@ module "secure_clickhouse" {
 
   # Storage configuration
   clickhouse_volume_size = 100
-  clickhouse_volume_type = "gp3"
   keeper_volume_size     = 20
-  keeper_volume_type     = "gp3"
 
   # AWS specific settings
   region = "us-west-2"

clickhouse/main.tf

@@ -42,8 +42,8 @@ module "clickhouse_cluster" {
     internal_domain          = local.internal_domain,
     use_external_certs       = var.use_external_certs
     external_ca_cert         = var.use_external_certs ? var.external_ca_cert : ""
-    ca_secret_arn            = var.use_external_certs ? "" : aws_secretsmanager_secret.ca_materials[0].arn
-    node_secret_arn          = var.use_external_certs ? var.external_cert_secret_ids.cluster_nodes[each.key] : aws_secretsmanager_secret.node_certs[each.key].arn
+    ca_secret_arn            = !var.enable_encryption || var.use_external_certs ? "" : aws_secretsmanager_secret.ca_materials[0].arn
+    node_secret_arn          = var.use_external_certs ? var.external_cert_secret_ids.cluster_nodes[each.key] : var.enable_encryption ? aws_secretsmanager_secret.node_certs[each.key].arn : ""
   })
 
   metadata_options = {
@@ -84,8 +84,8 @@ module "clickhouse_keeper" {
     internal_domain          = local.internal_domain,
     use_external_certs       = var.use_external_certs
     external_ca_cert         = var.use_external_certs ? var.external_ca_cert : ""
-    ca_secret_arn            = var.use_external_certs ? "" : aws_secretsmanager_secret.ca_materials[0].arn
-    node_secret_arn          = var.use_external_certs ? var.external_cert_secret_ids.cluster_nodes[each.key] : aws_secretsmanager_secret.node_certs[each.key].arn
+    ca_secret_arn            = !var.enable_encryption || var.use_external_certs ? "" : aws_secretsmanager_secret.ca_materials[0].arn
+    node_secret_arn          = var.use_external_certs ? var.external_cert_secret_ids.keeper_nodes[each.key] : var.enable_encryption ? aws_secretsmanager_secret.node_certs[each.key].arn : ""
   })
 
   metadata_options = {