refactor: reorganize GitOps control plane

2026-07-25 23:55:31 +09:00
parent d507ac6ee9
commit 293ee6fc97
191 changed files with 7046 additions and 9034 deletions
@@ -0,0 +1,75 @@
+terraform {
+  required_version = ">= 1.11.0"
+
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 5.7.0"
+    }
+  }
+
+  backend "s3" {}
+}
+
+provider "vault" {
+  address          = var.vault_addr
+  skip_child_token = true
+  token            = var.vault_token
+}
+
+locals {
+  migration_role_name = "auth-db-migration-dev"
+  operator_role_name  = "postgres-operator-dev"
+
+  creation_statements = [
+    <<-EOT
+    CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
+    GRANT "${var.auth_db_role}" TO "{{name}}";
+    EOT
+  ]
+
+  revocation_statements = [
+    <<-EOT
+    REASSIGN OWNED BY "{{name}}" TO "${var.auth_db_role}";
+    DROP OWNED BY "{{name}}";
+    REVOKE "${var.auth_db_role}" FROM "{{name}}";
+    DROP ROLE IF EXISTS "{{name}}";
+    EOT
+  ]
+}
+
+resource "vault_database_secret_backend_connection" "platform_postgres" {
+  allowed_roles     = [local.migration_role_name, local.operator_role_name]
+  backend           = var.database_mount_path
+  name              = var.database_config_name
+  plugin_name       = "postgresql-database-plugin"
+  verify_connection = true
+
+  postgresql {
+    connection_url          = "postgresql://{{username}}:{{password}}@${var.postgres_host}:${var.postgres_port}/${var.postgres_database}?sslmode=${var.postgres_sslmode}"
+    password_authentication = "scram-sha-256"
+    password_wo             = var.postgres_admin_password
+    password_wo_version     = var.postgres_admin_password_version
+    username                = var.postgres_admin_username
+  }
+}
+
+resource "vault_database_secret_backend_role" "auth_db_migration" {
+  backend               = var.database_mount_path
+  creation_statements   = local.creation_statements
+  db_name               = vault_database_secret_backend_connection.platform_postgres.name
+  default_ttl           = var.auth_db_migration_default_ttl_seconds
+  max_ttl               = var.auth_db_migration_max_ttl_seconds
+  name                  = local.migration_role_name
+  revocation_statements = local.revocation_statements
+}
+
+resource "vault_database_secret_backend_role" "postgres_operator" {
+  backend               = var.database_mount_path
+  creation_statements   = local.creation_statements
+  db_name               = vault_database_secret_backend_connection.platform_postgres.name
+  default_ttl           = var.postgres_operator_default_ttl_seconds
+  max_ttl               = var.postgres_operator_max_ttl_seconds
+  name                  = local.operator_role_name
+  revocation_statements = local.revocation_statements
+}