donghyeon.kang/project-gitops
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor(gitops): establish platform ownership boundaries

Browse Source
This commit is contained in:
donghyeon-ka
2026-07-26 01:34:29 +09:00
parent 293ee6fc97
commit a6f6c663e0
121 changed files with 2801 additions and 1204 deletions
Download Patch File Download Diff File Expand all files Collapse all files
iac/terraform/backend/dev-k3s/vault-foundation.s3.hcl.example
+5
View File
@@ -0,0 +1,5 @@
bucket = "project-gitops-terraform-state"
key = "dev-k3s/vault-foundation.tfstate"
region = "us-east-1"
encrypt = true
use_lockfile = true
iac/terraform/backend/dev-k3s/vault-core.s3.hcl.example → iac/terraform/backend/dev-k3s/vault-workloads.s3.hcl.example
+1 -1
View File
@@ -1,5 +1,5 @@
bucket = "project-gitops-terraform-state"
key = "dev-k3s/vault-core.tfstate"
key = "dev-k3s/vault-workloads.tfstate"
region = "us-east-1"
encrypt = true
use_lockfile = true
iac/terraform/live/dev-k3s/vault-core/main.tf
-171
View File
@@ -1,171 +0,0 @@
terraform {
required_version = ">= 1.11.0"
required_providers {
vault = {
source = "hashicorp/vault"
version = "~> 5.7.0"
}
}
backend "s3" {}
}
provider "vault" {
address = var.vault_addr
skip_child_token = true
token = var.vault_token
}
locals {
policy_dir = "${path.module}/../../../../../policies/vault/dev-k3s"
workload_policies = {
auth-server-dev = file("${local.policy_dir}/auth-server-dev.hcl")
auth-db-migration-dev = file("${local.policy_dir}/auth-db-migration-dev.hcl")
postgres-dev = file("${local.policy_dir}/postgres-dev.hcl")
keycloak-dev = file("${local.policy_dir}/keycloak-dev.hcl")
keycloak-client-sync-dev = file("${local.policy_dir}/keycloak-client-sync-dev.hcl")
postgres-operator-dev = file("${local.policy_dir}/postgres-operator-dev.hcl")
keycloak-operator-dev = file("${local.policy_dir}/keycloak-operator-dev.hcl")
}
}
resource "vault_mount" "kv" {
path = var.kv_mount_path
type = "kv"
options = {
version = "2"
}
lifecycle {
prevent_destroy = true
}
}
resource "vault_mount" "database" {
path = var.database_mount_path
type = "database"
lifecycle {
prevent_destroy = true
}
}
resource "vault_mount" "transit" {
path = var.transit_mount_path
type = "transit"
lifecycle {
prevent_destroy = true
}
}
resource "vault_auth_backend" "kubernetes" {
path = var.kubernetes_auth_path
type = "kubernetes"
}
resource "vault_kubernetes_auth_backend_config" "cluster" {
backend = vault_auth_backend.kubernetes.path
disable_iss_validation = true
disable_local_ca_jwt = false
kubernetes_host = var.kubernetes_host
}
resource "vault_transit_secret_backend_key" "project_auth_jwt" {
backend = vault_mount.transit.path
name = var.jwt_transit_key_name
type = "rsa-2048"
}
resource "vault_policy" "platform_admin" {
name = var.platform_admin_policy_name
policy = file("${local.policy_dir}/platform-admin-dev.hcl")
}
resource "vault_policy" "database_automation" {
name = var.database_automation_policy_name
policy = file("${local.policy_dir}/vault-database-automation-dev.hcl")
}
module "workload_policies" {
source = "../../../modules/vault-policy-set"
policies = local.workload_policies
}
resource "vault_kubernetes_auth_backend_role" "operator" {
audience = var.kubernetes_token_audience
backend = vault_auth_backend.kubernetes.path
bound_service_account_names = [var.operator_service_account_name]
bound_service_account_namespaces = [var.operator_service_account_namespace]
role_name = var.operator_role_name
token_policies = [vault_policy.platform_admin.name]
token_ttl = var.operator_token_ttl_seconds
}
module "workload_roles" {
source = "../../../modules/vault-kubernetes-roles"
backend = vault_auth_backend.kubernetes.path
roles = {
auth-server-dev = {
audiences = [var.kubernetes_token_audience]
service_account_names = ["auth-server"]
service_account_namespaces = ["auth-dev"]
token_policies = [module.workload_policies.names["auth-server-dev"]]
token_ttl = var.kubernetes_role_ttl_seconds
}
auth-db-migration-dev = {
audiences = [var.kubernetes_token_audience]
service_account_names = ["auth-db-migration"]
service_account_namespaces = ["auth-dev"]
token_policies = [module.workload_policies.names["auth-db-migration-dev"]]
token_ttl = var.kubernetes_role_ttl_seconds
}
postgres-dev = {
audiences = [var.kubernetes_token_audience]
service_account_names = ["postgres"]
service_account_namespaces = ["platform"]
token_policies = [module.workload_policies.names["postgres-dev"]]
token_ttl = var.kubernetes_role_ttl_seconds
}
keycloak-dev = {
audiences = [var.kubernetes_token_audience]
service_account_names = ["keycloak"]
service_account_namespaces = ["platform"]
token_policies = [module.workload_policies.names["keycloak-dev"]]
token_ttl = var.kubernetes_role_ttl_seconds
}
keycloak-client-sync-dev = {
audiences = [var.kubernetes_token_audience]
service_account_names = ["keycloak-client-sync"]
service_account_namespaces = ["platform"]
token_policies = [module.workload_policies.names["keycloak-client-sync-dev"]]
token_ttl = var.kubernetes_role_ttl_seconds
}
}
}
resource "vault_jwt_auth_backend" "ci" {
count = var.ci_jwt_oidc_discovery_url == null ? 0 : 1
bound_issuer = var.ci_jwt_bound_issuer
oidc_discovery_url = var.ci_jwt_oidc_discovery_url
path = var.ci_jwt_auth_path
}
resource "vault_jwt_auth_backend_role" "ci" {
count = var.ci_jwt_oidc_discovery_url == null ? 0 : 1
backend = vault_jwt_auth_backend.ci[0].path
bound_audiences = var.ci_jwt_bound_audiences
bound_claims = var.ci_jwt_bound_claims
bound_claims_type = "glob"
role_name = var.ci_jwt_role_name
role_type = "jwt"
token_explicit_max_ttl = var.ci_token_ttl_seconds
token_policies = [vault_policy.database_automation.name]
user_claim = var.ci_jwt_user_claim
}
iac/terraform/live/dev-k3s/vault-core/variables.tf
-146
View File
@@ -1,146 +0,0 @@
variable "database_automation_policy_name" {
description = "Least-privilege policy used by the approved Vault database runner."
type = string
default = "vault-database-automation-dev"
}
variable "ci_jwt_auth_path" {
description = "JWT auth mount used by external CI."
type = string
default = "jwt-ci"
}
variable "ci_jwt_bound_audiences" {
description = "Accepted CI JWT audiences."
type = set(string)
default = []
}
variable "ci_jwt_bound_claims" {
description = "Claims that bind CI JWTs to the canonical repository and protected branch."
type = map(string)
default = {}
}
variable "ci_jwt_bound_issuer" {
description = "Expected issuer for CI JWTs."
type = string
default = null
nullable = true
}
variable "ci_jwt_oidc_discovery_url" {
description = "CI OIDC discovery URL. Null keeps JWT auth disabled until the issuer is confirmed."
type = string
default = null
nullable = true
}
variable "ci_jwt_role_name" {
description = "Vault role used by the GitOps configuration workflow."
type = string
default = "project-gitops-dev"
}
variable "ci_jwt_user_claim" {
description = "JWT claim used as the Vault identity alias."
type = string
default = "sub"
}
variable "ci_token_ttl_seconds" {
description = "Maximum lifetime for a CI Vault token."
type = number
default = 3600
}
variable "database_mount_path" {
description = "Workload Vault database secrets mount path."
type = string
default = "database"
}
variable "jwt_transit_key_name" {
description = "Transit key used for application JWT signing."
type = string
default = "project-auth-jwt"
}
variable "kubernetes_auth_path" {
description = "Kubernetes auth backend path."
type = string
default = "kubernetes"
}
variable "kubernetes_host" {
description = "Kubernetes TokenReview API address."
type = string
default = "https://kubernetes.default.svc.cluster.local:443"
}
variable "kubernetes_role_ttl_seconds" {
description = "TTL for workload Kubernetes auth tokens."
type = number
default = 3600
}
variable "kubernetes_token_audience" {
description = "Audience used by projected service account tokens."
type = string
default = "vault"
}
variable "kv_mount_path" {
description = "Workload Vault KV-v2 mount path."
type = string
default = "kv"
}
variable "operator_role_name" {
description = "Workload Vault Kubernetes auth role for human operators."
type = string
default = "vault-operator-dev"
}
variable "operator_service_account_name" {
description = "Service account authorized to open workload Vault operator sessions."
type = string
default = "vault-operator"
}
variable "operator_service_account_namespace" {
description = "Namespace of the workload Vault operator service account."
type = string
default = "vault"
}
variable "operator_token_ttl_seconds" {
description = "TTL for workload Vault operator sessions."
type = number
default = 1800
}
variable "platform_admin_policy_name" {
description = "Policy used only for short-lived break-glass administration."
type = string
default = "platform-admin-dev"
}
variable "transit_mount_path" {
description = "Workload Vault Transit mount path for application cryptography."
type = string
default = "transit"
}
variable "vault_addr" {
description = "Workload Vault API address reachable by the approved runner."
type = string
default = "http://127.0.0.1:8200"
}
variable "vault_token" {
description = "Short-lived token used only for this Terraform run."
type = string
sensitive = true
ephemeral = true
}
iac/terraform/live/dev-k3s/vault-database/main.tf
+26 -18
View File
@@ -17,9 +17,23 @@ provider "vault" {
token = var.vault_token
}
moved {
from = vault_database_secret_backend_connection.platform_postgres
to = vault_database_secret_backend_connection.auth_system_postgres
}
removed {
from = vault_database_secret_backend_role.postgres_operator
lifecycle {
destroy = false
}
}
locals {
migration_role_name = "auth-db-migration-dev"
operator_role_name = "postgres-operator-dev"
database_config_name = "auth-system-postgres-dev"
database_mount_path = "database"
migration_role_name = "auth-db-migration-dev"
creation_statements = [
<<-EOT
@@ -38,10 +52,10 @@ locals {
]
}
resource "vault_database_secret_backend_connection" "platform_postgres" {
allowed_roles = [local.migration_role_name, local.operator_role_name]
backend = var.database_mount_path
name = var.database_config_name
resource "vault_database_secret_backend_connection" "auth_system_postgres" {
allowed_roles = [local.migration_role_name]
backend = local.database_mount_path
name = local.database_config_name
plugin_name = "postgresql-database-plugin"
verify_connection = true
@@ -52,24 +66,18 @@ resource "vault_database_secret_backend_connection" "platform_postgres" {
password_wo_version = var.postgres_admin_password_version
username = var.postgres_admin_username
}
lifecycle {
create_before_destroy = true
}
}
resource "vault_database_secret_backend_role" "auth_db_migration" {
backend = var.database_mount_path
backend = local.database_mount_path
creation_statements = local.creation_statements
db_name = vault_database_secret_backend_connection.platform_postgres.name
db_name = vault_database_secret_backend_connection.auth_system_postgres.name
default_ttl = var.auth_db_migration_default_ttl_seconds
max_ttl = var.auth_db_migration_max_ttl_seconds
name = local.migration_role_name
revocation_statements = local.revocation_statements
}
resource "vault_database_secret_backend_role" "postgres_operator" {
backend = var.database_mount_path
creation_statements = local.creation_statements
db_name = vault_database_secret_backend_connection.platform_postgres.name
default_ttl = var.postgres_operator_default_ttl_seconds
max_ttl = var.postgres_operator_max_ttl_seconds
name = local.operator_role_name
revocation_statements = local.revocation_statements
}
iac/terraform/live/dev-k3s/vault-database/variables.tf
+3 -27
View File
@@ -16,18 +16,6 @@ variable "auth_db_role" {
default = "project_auth"
}
variable "database_config_name" {
description = "Vault database connection name."
type = string
default = "platform-postgres-dev"
}
variable "database_mount_path" {
description = "Foundation-owned database secrets mount path."
type = string
default = "database"
}
variable "postgres_admin_password" {
description = "PostgreSQL admin password passed only through a write-only provider field."
type = string
@@ -53,25 +41,13 @@ variable "postgres_database" {
}
variable "postgres_host" {
description = "Platform PostgreSQL service DNS name."
description = "Auth system PostgreSQL service DNS name."
type = string
default = "postgres.platform.svc.cluster.local"
}
variable "postgres_operator_default_ttl_seconds" {
description = "Default TTL for operator database credentials."
type = number
default = 3600
}
variable "postgres_operator_max_ttl_seconds" {
description = "Maximum TTL for operator database credentials."
type = number
default = 28800
default = "postgres.auth-system-dev.svc.cluster.local"
}
variable "postgres_port" {
description = "Platform PostgreSQL service port."
description = "Auth system PostgreSQL service port."
type = number
default = 5432
}
iac/terraform/live/dev-k3s/vault-core/.terraform.lock.hcl → iac/terraform/live/dev-k3s/vault-foundation/.terraform.lock.hcl
Generated
View File
iac/terraform/live/dev-k3s/vault-foundation/main.tf
+189
View File
@@ -0,0 +1,189 @@
terraform {
required_version = ">= 1.11.0"
required_providers {
vault = {
source = "hashicorp/vault"
version = "~> 5.7.0"
}
}
backend "s3" {}
}
provider "vault" {
address = var.vault_addr
token = var.vault_token
}
removed {
from = module.workload_policies
lifecycle {
destroy = false
}
}
removed {
from = module.workload_roles
lifecycle {
destroy = false
}
}
removed {
from = vault_transit_secret_backend_key.project_auth_jwt
lifecycle {
destroy = false
}
}
removed {
from = vault_policy.platform_admin
lifecycle {
destroy = false
}
}
removed {
from = vault_kubernetes_auth_backend_role.operator
lifecycle {
destroy = false
}
}
removed {
from = vault_jwt_auth_backend_role.ci
lifecycle {
destroy = false
}
}
locals {
platform_policy_dir = "${path.module}/../../../../../policies/vault/dev-k3s/platform"
database_automation_policy_name = "vault-database-automation-dev"
database_mount_path = "database"
ci_database_role_name = "project-gitops-vault-database-dev"
ci_jwt_auth_path = "jwt-ci"
ci_workloads_role_name = "project-gitops-vault-workloads-dev"
kubernetes_auth_path = "kubernetes"
kv_mount_path = "kv"
transit_mount_path = "transit"
workloads_automation_policy_name = "vault-workloads-automation-dev"
automation_roles = var.ci_jwt_oidc_discovery_url == null ? {} : {
workloads = {
bound_claims = var.ci_workloads_bound_claims
name = local.ci_workloads_role_name
policy = vault_policy.workloads_automation.name
}
database = {
bound_claims = var.ci_database_bound_claims
name = local.ci_database_role_name
policy = vault_policy.database_automation.name
}
}
}
resource "vault_mount" "kv" {
path = local.kv_mount_path
type = "kv"
options = {
version = "2"
}
lifecycle {
prevent_destroy = true
}
}
resource "vault_mount" "database" {
path = local.database_mount_path
type = "database"
lifecycle {
prevent_destroy = true
}
}
resource "vault_mount" "transit" {
path = local.transit_mount_path
type = "transit"
lifecycle {
prevent_destroy = true
}
}
resource "vault_auth_backend" "kubernetes" {
path = local.kubernetes_auth_path
type = "kubernetes"
lifecycle {
prevent_destroy = true
}
}
resource "vault_kubernetes_auth_backend_config" "cluster" {
backend = vault_auth_backend.kubernetes.path
disable_iss_validation = true
disable_local_ca_jwt = false
kubernetes_host = var.kubernetes_host
}
resource "vault_policy" "workloads_automation" {
name = local.workloads_automation_policy_name
policy = file("${local.platform_policy_dir}/vault-workloads-automation-dev.hcl")
}
resource "vault_policy" "database_automation" {
name = local.database_automation_policy_name
policy = file("${local.platform_policy_dir}/vault-database-automation-dev.hcl")
}
resource "vault_jwt_auth_backend" "ci" {
count = var.ci_jwt_oidc_discovery_url == null ? 0 : 1
bound_issuer = var.ci_jwt_bound_issuer
oidc_discovery_url = var.ci_jwt_oidc_discovery_url
path = local.ci_jwt_auth_path
lifecycle {
prevent_destroy = true
precondition {
condition = (
var.ci_jwt_bound_issuer != null &&
length(var.ci_jwt_bound_audiences) > 0 &&
length(var.ci_workloads_bound_claims) > 0 &&
length(var.ci_database_bound_claims) > 0 &&
length([
for claim, value in var.ci_workloads_bound_claims : claim
if lookup(var.ci_database_bound_claims, claim, value) != value
]) > 0
)
error_message = "Enabled CI JWT auth requires issuer/audience constraints and workload/database claim maps with at least one shared discriminator key carrying different values."
}
}
}
resource "vault_jwt_auth_backend_role" "automation" {
for_each = local.automation_roles
backend = vault_jwt_auth_backend.ci[0].path
bound_audiences = var.ci_jwt_bound_audiences
bound_claims = each.value.bound_claims
bound_claims_type = "string"
role_name = each.value.name
role_type = "jwt"
token_explicit_max_ttl = var.ci_token_ttl_seconds
token_no_default_policy = true
token_policies = [each.value.policy]
user_claim = var.ci_jwt_user_claim
}
iac/terraform/live/dev-k3s/vault-foundation/variables.tf
+71
View File
@@ -0,0 +1,71 @@
variable "ci_database_bound_claims" {
description = "Exact repository, protected-ref, and database-job claims for the database role."
type = map(string)
default = {}
}
variable "ci_jwt_bound_audiences" {
description = "Exact CI JWT audiences."
type = set(string)
default = []
}
variable "ci_jwt_bound_issuer" {
description = "Expected CI JWT issuer."
type = string
default = null
nullable = true
}
variable "ci_jwt_oidc_discovery_url" {
description = "CI OIDC discovery URL. Null leaves external CI authentication disabled."
type = string
default = null
nullable = true
}
variable "ci_jwt_user_claim" {
description = "JWT claim used as the Vault identity alias."
type = string
default = "sub"
}
variable "ci_token_ttl_seconds" {
description = "Maximum lifetime for delegated CI tokens."
type = number
default = 1800
validation {
condition = (
var.ci_token_ttl_seconds >= 60 &&
var.ci_token_ttl_seconds <= 3600 &&
floor(var.ci_token_ttl_seconds) == var.ci_token_ttl_seconds
)
error_message = "ci_token_ttl_seconds must be a whole number between 60 and 3600."
}
}
variable "ci_workloads_bound_claims" {
description = "Exact repository, protected-ref, and workloads-job claims for the workloads role."
type = map(string)
default = {}
}
variable "kubernetes_host" {
description = "Kubernetes TokenReview API address."
type = string
default = "https://kubernetes.default.svc.cluster.local:443"
}
variable "vault_addr" {
description = "Vault API address reachable by the foundation operator."
type = string
default = "http://127.0.0.1:8200"
}
variable "vault_token" {
description = "Short-lived bootstrap or security-administrator token."
type = string
sensitive = true
ephemeral = true
}
iac/terraform/live/dev-k3s/vault-workloads/.terraform.lock.hcl
Generated
+22
View File
@@ -0,0 +1,22 @@
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.
provider "registry.terraform.io/hashicorp/vault" {
version = "5.7.0"
constraints = "~> 5.7.0"
hashes = [
"h1:Pm0AcUSYmBPZgRahQX/ahiYcjtZODSAEc2rK8r8MQ18=",
"zh:1dd9ab6d23f61a5e522efcb462f1fd6f4a210c77b9038c8e12fa5fa663b45d01",
"zh:3c98d37ead857c980f7b9285f8c3e1eb7a8fd6d6799275c311c6997973389cc9",
"zh:3df895fbaed383e3748ba1b50f5f1046f75503483bc3d783992059f85c85ba31",
"zh:3e9faaa0a85c6f03c7fd7f8b7008bb3fbb8777f26c001875947cafa47f91c657",
"zh:52a057d0c6cde7cbfd9ceb78a3781dcfc81cf108c533f454530ea6bb87a9bea8",
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
"zh:8521c3825254a5f7fbff8f42ca57cabf052366f0420f5f239ebebf8292c03d0e",
"zh:953563d429e40087eb34faf22f28e781e50eee27cfc9ac1ad04308ba592a647f",
"zh:a52dd76bb7f5b86cb8de7380d2e68b47ec4445782c16ee205e6a013be35a57b6",
"zh:bdad38c95a14c8cce1eeadcc539cf9bf74902ce7c662b79105ad993bb48ec073",
"zh:d3c676d7d12c15b58518fa3ee7fc398a13893b4057fe9bf4bc1fe635f3fb995a",
"zh:f8673b6c06da80e912c9e32dd4853f07bfca386968d5b33c9fceb6f68b519959",
]
}
iac/terraform/live/dev-k3s/vault-workloads/main.tf
+95
View File
@@ -0,0 +1,95 @@
terraform {
required_version = ">= 1.11.0"
required_providers {
vault = {
source = "hashicorp/vault"
version = "~> 5.7.0"
}
}
backend "s3" {}
}
provider "vault" {
address = var.vault_addr
skip_child_token = true
token = var.vault_token
}
locals {
workload_policy_dir = "${path.module}/../../../../../policies/vault/dev-k3s/workloads"
jwt_transit_key_name = "project-auth-jwt"
kubernetes_auth_path = "kubernetes"
kubernetes_token_audience = "vault"
transit_mount_path = "transit"
workload_policies = {
auth-server-dev = file("${local.workload_policy_dir}/auth-server-dev.hcl")
auth-db-migration-dev = file("${local.workload_policy_dir}/auth-db-migration-dev.hcl")
postgres-dev = file("${local.workload_policy_dir}/postgres-dev.hcl")
keycloak-dev = file("${local.workload_policy_dir}/keycloak-dev.hcl")
keycloak-client-sync-dev = file("${local.workload_policy_dir}/keycloak-client-sync-dev.hcl")
}
}
module "workload_policies" {
source = "../../../modules/vault-policy-set"
policies = local.workload_policies
}
module "workload_roles" {
source = "../../../modules/vault-kubernetes-roles"
backend = local.kubernetes_auth_path
roles = {
auth-server-dev = {
audiences = [local.kubernetes_token_audience]
service_account_names = ["auth-server"]
service_account_namespaces = ["auth-dev"]
token_policies = [module.workload_policies.names["auth-server-dev"]]
token_ttl = var.kubernetes_role_ttl_seconds
}
auth-db-migration-dev = {
audiences = [local.kubernetes_token_audience]
service_account_names = ["auth-db-migration"]
service_account_namespaces = ["auth-dev"]
token_policies = [module.workload_policies.names["auth-db-migration-dev"]]
token_ttl = var.kubernetes_role_ttl_seconds
}
postgres-dev = {
audiences = [local.kubernetes_token_audience]
service_account_names = ["postgres"]
service_account_namespaces = ["auth-system-dev"]
token_policies = [module.workload_policies.names["postgres-dev"]]
token_ttl = var.kubernetes_role_ttl_seconds
}
keycloak-dev = {
audiences = [local.kubernetes_token_audience]
service_account_names = ["keycloak"]
service_account_namespaces = ["auth-system-dev"]
token_policies = [module.workload_policies.names["keycloak-dev"]]
token_ttl = var.kubernetes_role_ttl_seconds
}
keycloak-client-sync-dev = {
audiences = [local.kubernetes_token_audience]
service_account_names = ["keycloak-client-sync"]
service_account_namespaces = ["auth-system-dev"]
token_policies = [module.workload_policies.names["keycloak-client-sync-dev"]]
token_ttl = var.kubernetes_role_ttl_seconds
}
}
}
resource "vault_transit_secret_backend_key" "project_auth_jwt" {
backend = local.transit_mount_path
deletion_allowed = false
name = local.jwt_transit_key_name
type = "rsa-2048"
lifecycle {
prevent_destroy = true
}
}
iac/terraform/live/dev-k3s/vault-workloads/variables.tf
+18
View File
@@ -0,0 +1,18 @@
variable "kubernetes_role_ttl_seconds" {
description = "TTL for workload Kubernetes auth tokens."
type = number
default = 3600
}
variable "vault_addr" {
description = "Vault API address reachable by the delegated runner."
type = string
default = "http://127.0.0.1:8200"
}
variable "vault_token" {
description = "Short-lived token carrying only vault-workloads-automation-dev."
type = string
sensitive = true
ephemeral = true
}