donghyeon.kang/project-gitops
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor(gitops): establish platform ownership boundaries

Browse Source
This commit is contained in:
donghyeon-ka
2026-07-26 01:34:29 +09:00
parent 293ee6fc97
commit a6f6c663e0
121 changed files with 2801 additions and 1204 deletions
Download Patch File Download Diff File Expand all files Collapse all files
iac/terraform/live/dev-k3s/vault-database/main.tf
+26 -18
View File
@@ -17,9 +17,23 @@ provider "vault" {
token = var.vault_token
}
moved {
from = vault_database_secret_backend_connection.platform_postgres
to = vault_database_secret_backend_connection.auth_system_postgres
}
removed {
from = vault_database_secret_backend_role.postgres_operator
lifecycle {
destroy = false
}
}
locals {
migration_role_name = "auth-db-migration-dev"
operator_role_name = "postgres-operator-dev"
database_config_name = "auth-system-postgres-dev"
database_mount_path = "database"
migration_role_name = "auth-db-migration-dev"
creation_statements = [
<<-EOT
@@ -38,10 +52,10 @@ locals {
]
}
resource "vault_database_secret_backend_connection" "platform_postgres" {
allowed_roles = [local.migration_role_name, local.operator_role_name]
backend = var.database_mount_path
name = var.database_config_name
resource "vault_database_secret_backend_connection" "auth_system_postgres" {
allowed_roles = [local.migration_role_name]
backend = local.database_mount_path
name = local.database_config_name
plugin_name = "postgresql-database-plugin"
verify_connection = true
@@ -52,24 +66,18 @@ resource "vault_database_secret_backend_connection" "platform_postgres" {
password_wo_version = var.postgres_admin_password_version
username = var.postgres_admin_username
}
lifecycle {
create_before_destroy = true
}
}
resource "vault_database_secret_backend_role" "auth_db_migration" {
backend = var.database_mount_path
backend = local.database_mount_path
creation_statements = local.creation_statements
db_name = vault_database_secret_backend_connection.platform_postgres.name
db_name = vault_database_secret_backend_connection.auth_system_postgres.name
default_ttl = var.auth_db_migration_default_ttl_seconds
max_ttl = var.auth_db_migration_max_ttl_seconds
name = local.migration_role_name
revocation_statements = local.revocation_statements
}
resource "vault_database_secret_backend_role" "postgres_operator" {
backend = var.database_mount_path
creation_statements = local.creation_statements
db_name = vault_database_secret_backend_connection.platform_postgres.name
default_ttl = var.postgres_operator_default_ttl_seconds
max_ttl = var.postgres_operator_max_ttl_seconds
name = local.operator_role_name
revocation_statements = local.revocation_statements
}
iac/terraform/live/dev-k3s/vault-database/variables.tf
+3 -27
View File
@@ -16,18 +16,6 @@ variable "auth_db_role" {
default = "project_auth"
}
variable "database_config_name" {
description = "Vault database connection name."
type = string
default = "platform-postgres-dev"
}
variable "database_mount_path" {
description = "Foundation-owned database secrets mount path."
type = string
default = "database"
}
variable "postgres_admin_password" {
description = "PostgreSQL admin password passed only through a write-only provider field."
type = string
@@ -53,25 +41,13 @@ variable "postgres_database" {
}
variable "postgres_host" {
description = "Platform PostgreSQL service DNS name."
description = "Auth system PostgreSQL service DNS name."
type = string
default = "postgres.platform.svc.cluster.local"
}
variable "postgres_operator_default_ttl_seconds" {
description = "Default TTL for operator database credentials."
type = number
default = 3600
}
variable "postgres_operator_max_ttl_seconds" {
description = "Maximum TTL for operator database credentials."
type = number
default = 28800
default = "postgres.auth-system-dev.svc.cluster.local"
}
variable "postgres_port" {
description = "Platform PostgreSQL service port."
description = "Auth system PostgreSQL service port."
type = number
default = 5432
}