From 8c352bf8ceb86120c1bd99b856c75c14603d1a40 Mon Sep 17 00:00:00 2001
From: Michael Thamm <mike.thamm@canonical.com>
Date: Wed, 27 May 2026 16:33:19 -0400
Subject: [PATCH] feat(terraform): conditional s3 integrator support

---
 terraform/main.tf      | 16 ++++++++++++----
 terraform/outputs.tf   |  4 ++--
 terraform/variables.tf | 17 ++++++++++++++---
 3 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/terraform/main.tf b/terraform/main.tf
index 468daed..7898aae 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -34,7 +34,12 @@ module "mimir_worker" {
 
 # -------------- # S3-integrator --------------
 
+locals {
+  deploy_s3 = var.s3_endpoint != null
+}
+
 resource "juju_secret" "mimir_s3_credentials_secret" {
+  count      = local.deploy_s3 ? 1 : 0
   model_uuid = var.model_uuid
   name       = "mimir_s3_credentials"
   value = {
@@ -45,18 +50,20 @@ resource "juju_secret" "mimir_s3_credentials_secret" {
 }
 
 resource "juju_access_secret" "mimir_s3_secret_access" {
+  count      = local.deploy_s3 ? 1 : 0
   model_uuid = var.model_uuid
   applications = [
-    juju_application.s3_integrator.name
+    juju_application.s3_integrator[0].name
   ]
-  secret_id = juju_secret.mimir_s3_credentials_secret.secret_id
+  secret_id = juju_secret.mimir_s3_credentials_secret[0].secret_id
 }
 
 resource "juju_application" "s3_integrator" {
+  count = local.deploy_s3 ? 1 : 0
   config = merge({
     endpoint    = var.s3_endpoint
     bucket      = var.s3_bucket
-    credentials = "secret:${juju_secret.mimir_s3_credentials_secret.secret_id}"
+    credentials = "secret:${juju_secret.mimir_s3_credentials_secret[0].secret_id}"
   }, var.s3_integrator_config)
   constraints        = var.s3_integrator_constraints
   model_uuid         = var.model_uuid
@@ -75,9 +82,10 @@ resource "juju_application" "s3_integrator" {
 # -------------- # Integrations --------------
 
 resource "juju_integration" "coordinator_to_s3_integrator" {
+  count      = local.deploy_s3 ? 1 : 0
   model_uuid = var.model_uuid
   application {
-    name     = juju_application.s3_integrator.name
+    name     = juju_application.s3_integrator[0].name
     endpoint = "s3-credentials"
   }
 
diff --git a/terraform/outputs.tf b/terraform/outputs.tf
index 0985858..84a78eb 100644
--- a/terraform/outputs.tf
+++ b/terraform/outputs.tf
@@ -1,9 +1,9 @@
 output "app_names" {
   value = merge(
     {
-      mimir_s3_integrator = juju_application.s3_integrator.name,
-      mimir_coordinator   = module.mimir_coordinator.app_name,
+      mimir_coordinator = module.mimir_coordinator.app_name,
     },
+    local.deploy_s3 ? { mimir_s3_integrator = juju_application.s3_integrator[0].name } : {},
     { for k, v in module.mimir_worker : "mimir_${k}" => v.app_name }
   )
   description = "All application names which make up this product module"
diff --git a/terraform/variables.tf b/terraform/variables.tf
index f69f67e..1ab3fec 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -34,19 +34,30 @@ variable "s3_bucket" {
 }
 
 variable "s3_access_key" {
-  description = "S3 access-key credential"
+  description = "S3 access-key credential. Set to null (along with s3_endpoint and s3_secret_key) to skip deploying the S3 integrator."
   type        = string
+  default     = null
 }
 
 variable "s3_secret_key" {
-  description = "S3 secret-key credential"
+  description = "S3 secret-key credential. Set to null (along with s3_endpoint and s3_access_key) to skip deploying the S3 integrator."
   type        = string
   sensitive   = true
+  default     = null
 }
 
 variable "s3_endpoint" {
-  description = "S3 endpoint"
+  description = "S3 endpoint. When null, the S3 integrator is not deployed and the caller must handle storage integration externally."
   type        = string
+  default     = null
+
+  validation {
+    condition = (
+      (var.s3_endpoint == null && var.s3_access_key == null && var.s3_secret_key == null) ||
+      (var.s3_endpoint != null && var.s3_access_key != null && var.s3_secret_key != null)
+    )
+    error_message = "s3_endpoint, s3_access_key, and s3_secret_key must all be set or all be null."
+  }
 }
 
 # -------------- # Workers --------------