refactor(gitops): establish platform ownership boundaries

2026-07-26 01:34:29 +09:00
parent 293ee6fc97
commit a6f6c663e0
121 changed files with 2801 additions and 1204 deletions
@@ -0,0 +1,22 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/vault" {
+  version     = "5.7.0"
+  constraints = "~> 5.7.0"
+  hashes = [
+    "h1:Pm0AcUSYmBPZgRahQX/ahiYcjtZODSAEc2rK8r8MQ18=",
+    "zh:1dd9ab6d23f61a5e522efcb462f1fd6f4a210c77b9038c8e12fa5fa663b45d01",
+    "zh:3c98d37ead857c980f7b9285f8c3e1eb7a8fd6d6799275c311c6997973389cc9",
+    "zh:3df895fbaed383e3748ba1b50f5f1046f75503483bc3d783992059f85c85ba31",
+    "zh:3e9faaa0a85c6f03c7fd7f8b7008bb3fbb8777f26c001875947cafa47f91c657",
+    "zh:52a057d0c6cde7cbfd9ceb78a3781dcfc81cf108c533f454530ea6bb87a9bea8",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:8521c3825254a5f7fbff8f42ca57cabf052366f0420f5f239ebebf8292c03d0e",
+    "zh:953563d429e40087eb34faf22f28e781e50eee27cfc9ac1ad04308ba592a647f",
+    "zh:a52dd76bb7f5b86cb8de7380d2e68b47ec4445782c16ee205e6a013be35a57b6",
+    "zh:bdad38c95a14c8cce1eeadcc539cf9bf74902ce7c662b79105ad993bb48ec073",
+    "zh:d3c676d7d12c15b58518fa3ee7fc398a13893b4057fe9bf4bc1fe635f3fb995a",
+    "zh:f8673b6c06da80e912c9e32dd4853f07bfca386968d5b33c9fceb6f68b519959",
+  ]
+}
@@ -0,0 +1,95 @@
+terraform {
+  required_version = ">= 1.11.0"
+
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 5.7.0"
+    }
+  }
+
+  backend "s3" {}
+}
+
+provider "vault" {
+  address          = var.vault_addr
+  skip_child_token = true
+  token            = var.vault_token
+}
+
+locals {
+  workload_policy_dir = "${path.module}/../../../../../policies/vault/dev-k3s/workloads"
+
+  jwt_transit_key_name      = "project-auth-jwt"
+  kubernetes_auth_path      = "kubernetes"
+  kubernetes_token_audience = "vault"
+  transit_mount_path        = "transit"
+
+  workload_policies = {
+    auth-server-dev          = file("${local.workload_policy_dir}/auth-server-dev.hcl")
+    auth-db-migration-dev    = file("${local.workload_policy_dir}/auth-db-migration-dev.hcl")
+    postgres-dev             = file("${local.workload_policy_dir}/postgres-dev.hcl")
+    keycloak-dev             = file("${local.workload_policy_dir}/keycloak-dev.hcl")
+    keycloak-client-sync-dev = file("${local.workload_policy_dir}/keycloak-client-sync-dev.hcl")
+  }
+}
+
+module "workload_policies" {
+  source = "../../../modules/vault-policy-set"
+
+  policies = local.workload_policies
+}
+
+module "workload_roles" {
+  source = "../../../modules/vault-kubernetes-roles"
+
+  backend = local.kubernetes_auth_path
+  roles = {
+    auth-server-dev = {
+      audiences                  = [local.kubernetes_token_audience]
+      service_account_names      = ["auth-server"]
+      service_account_namespaces = ["auth-dev"]
+      token_policies             = [module.workload_policies.names["auth-server-dev"]]
+      token_ttl                  = var.kubernetes_role_ttl_seconds
+    }
+    auth-db-migration-dev = {
+      audiences                  = [local.kubernetes_token_audience]
+      service_account_names      = ["auth-db-migration"]
+      service_account_namespaces = ["auth-dev"]
+      token_policies             = [module.workload_policies.names["auth-db-migration-dev"]]
+      token_ttl                  = var.kubernetes_role_ttl_seconds
+    }
+    postgres-dev = {
+      audiences                  = [local.kubernetes_token_audience]
+      service_account_names      = ["postgres"]
+      service_account_namespaces = ["auth-system-dev"]
+      token_policies             = [module.workload_policies.names["postgres-dev"]]
+      token_ttl                  = var.kubernetes_role_ttl_seconds
+    }
+    keycloak-dev = {
+      audiences                  = [local.kubernetes_token_audience]
+      service_account_names      = ["keycloak"]
+      service_account_namespaces = ["auth-system-dev"]
+      token_policies             = [module.workload_policies.names["keycloak-dev"]]
+      token_ttl                  = var.kubernetes_role_ttl_seconds
+    }
+    keycloak-client-sync-dev = {
+      audiences                  = [local.kubernetes_token_audience]
+      service_account_names      = ["keycloak-client-sync"]
+      service_account_namespaces = ["auth-system-dev"]
+      token_policies             = [module.workload_policies.names["keycloak-client-sync-dev"]]
+      token_ttl                  = var.kubernetes_role_ttl_seconds
+    }
+  }
+}
+
+resource "vault_transit_secret_backend_key" "project_auth_jwt" {
+  backend          = local.transit_mount_path
+  deletion_allowed = false
+  name             = local.jwt_transit_key_name
+  type             = "rsa-2048"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
@@ -0,0 +1,18 @@
+variable "kubernetes_role_ttl_seconds" {
+  description = "TTL for workload Kubernetes auth tokens."
+  type        = number
+  default     = 3600
+}
+
+variable "vault_addr" {
+  description = "Vault API address reachable by the delegated runner."
+  type        = string
+  default     = "http://127.0.0.1:8200"
+}
+
+variable "vault_token" {
+  description = "Short-lived token carrying only vault-workloads-automation-dev."
+  type        = string
+  sensitive   = true
+  ephemeral   = true
+}