refactor: 구조 변경

infrastructure/live/dev-k3s/vault-database/.terraform.lock.hcl

@@ -0,0 +1,22 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/vault" {
+  version     = "5.7.0"
+  constraints = "~> 5.7.0"
+  hashes = [
+    "h1:Pm0AcUSYmBPZgRahQX/ahiYcjtZODSAEc2rK8r8MQ18=",
+    "zh:1dd9ab6d23f61a5e522efcb462f1fd6f4a210c77b9038c8e12fa5fa663b45d01",
+    "zh:3c98d37ead857c980f7b9285f8c3e1eb7a8fd6d6799275c311c6997973389cc9",
+    "zh:3df895fbaed383e3748ba1b50f5f1046f75503483bc3d783992059f85c85ba31",
+    "zh:3e9faaa0a85c6f03c7fd7f8b7008bb3fbb8777f26c001875947cafa47f91c657",
+    "zh:52a057d0c6cde7cbfd9ceb78a3781dcfc81cf108c533f454530ea6bb87a9bea8",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:8521c3825254a5f7fbff8f42ca57cabf052366f0420f5f239ebebf8292c03d0e",
+    "zh:953563d429e40087eb34faf22f28e781e50eee27cfc9ac1ad04308ba592a647f",
+    "zh:a52dd76bb7f5b86cb8de7380d2e68b47ec4445782c16ee205e6a013be35a57b6",
+    "zh:bdad38c95a14c8cce1eeadcc539cf9bf74902ce7c662b79105ad993bb48ec073",
+    "zh:d3c676d7d12c15b58518fa3ee7fc398a13893b4057fe9bf4bc1fe635f3fb995a",
+    "zh:f8673b6c06da80e912c9e32dd4853f07bfca386968d5b33c9fceb6f68b519959",
+  ]
+}

infrastructure/live/dev-k3s/vault-database/README.md

@@ -0,0 +1,14 @@
+# dev-k3s Vault database
+
+## 대상과 State
+
+- Environment/cluster: `dev-k3s`
+- Provider: HashiCorp Vault
+- State: `vault-database`
+- Backend example: `backend.s3.hcl.example`
+- Owner: delegated database automation
+
+Project Auth PostgreSQL connection과 migration dynamic role만 소유합니다.
+PostgreSQL이 준비되고 연결 입력을 안전하게 주입할 수 있을 때 별도 승인으로
+실행합니다. Database password는 ephemeral/write-only 입력이며 state나
+repository에 저장하지 않습니다.

infrastructure/live/dev-k3s/vault-database/backend.s3.hcl.example

@@ -0,0 +1,5 @@
+bucket       = "project-gitops-terraform-state"
+key          = "dev-k3s/vault-database.tfstate"
+region       = "us-east-1"
+encrypt      = true
+use_lockfile = true

infrastructure/live/dev-k3s/vault-database/main.tf

@@ -0,0 +1,83 @@
+terraform {
+  required_version = ">= 1.11.0"
+
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 5.7.0"
+    }
+  }
+
+  backend "s3" {}
+}
+
+provider "vault" {
+  address          = var.vault_addr
+  skip_child_token = true
+  token            = var.vault_token
+}
+
+moved {
+  from = vault_database_secret_backend_connection.platform_postgres
+  to   = vault_database_secret_backend_connection.auth_system_postgres
+}
+
+removed {
+  from = vault_database_secret_backend_role.postgres_operator
+
+  lifecycle {
+    destroy = false
+  }
+}
+
+locals {
+  database_config_name = "auth-system-postgres-dev"
+  database_mount_path  = "database"
+  migration_role_name  = "auth-db-migration-dev"
+
+  creation_statements = [
+    <<-EOT
+    CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
+    GRANT "${var.auth_db_role}" TO "{{name}}";
+    EOT
+  ]
+
+  revocation_statements = [
+    <<-EOT
+    REASSIGN OWNED BY "{{name}}" TO "${var.auth_db_role}";
+    DROP OWNED BY "{{name}}";
+    REVOKE "${var.auth_db_role}" FROM "{{name}}";
+    DROP ROLE IF EXISTS "{{name}}";
+    EOT
+  ]
+}
+
+resource "vault_database_secret_backend_connection" "auth_system_postgres" {
+  allowed_roles     = [local.migration_role_name]
+  backend           = local.database_mount_path
+  name              = local.database_config_name
+  plugin_name       = "postgresql-database-plugin"
+  verify_connection = true
+
+  postgresql {
+    connection_url          = "postgresql://{{username}}:{{password}}@${var.postgres_host}:${var.postgres_port}/${var.postgres_database}?sslmode=${var.postgres_sslmode}"
+    password_authentication = "scram-sha-256"
+    password_wo             = var.postgres_admin_password
+    password_wo_version     = var.postgres_admin_password_version
+    username                = var.postgres_admin_username
+  }
+
+  lifecycle {
+    create_before_destroy = true
+  }
+}
+
+resource "vault_database_secret_backend_role" "auth_db_migration" {
+  backend               = local.database_mount_path
+  creation_statements   = local.creation_statements
+  db_name               = vault_database_secret_backend_connection.auth_system_postgres.name
+  default_ttl           = var.auth_db_migration_default_ttl_seconds
+  max_ttl               = var.auth_db_migration_max_ttl_seconds
+  name                  = local.migration_role_name
+  revocation_statements = local.revocation_statements
+}

infrastructure/live/dev-k3s/vault-database/variables.tf

@@ -0,0 +1,77 @@
+variable "auth_db_migration_default_ttl_seconds" {
+  description = "Default TTL for migration credentials."
+  type        = number
+  default     = 3600
+}
+
+variable "auth_db_migration_max_ttl_seconds" {
+  description = "Maximum TTL for migration credentials."
+  type        = number
+  default     = 86400
+}
+
+variable "auth_db_role" {
+  description = "Stable PostgreSQL owner role used by dynamic users."
+  type        = string
+  default     = "project_auth"
+}
+
+variable "postgres_admin_password" {
+  description = "PostgreSQL admin password passed only through a write-only provider field."
+  type        = string
+  sensitive   = true
+  ephemeral   = true
+}
+
+variable "postgres_admin_password_version" {
+  description = "Increment whenever postgres_admin_password is rotated."
+  type        = number
+}
+
+variable "postgres_admin_username" {
+  description = "Dedicated database administration username."
+  type        = string
+  default     = "postgres"
+}
+
+variable "postgres_database" {
+  description = "Database in which dynamic migration objects are owned and revoked."
+  type        = string
+  default     = "project_auth"
+}
+
+variable "postgres_host" {
+  description = "Auth system PostgreSQL service DNS name."
+  type        = string
+  default     = "postgres.auth-system-dev.svc.cluster.local"
+}
+
+variable "postgres_port" {
+  description = "Auth system PostgreSQL service port."
+  type        = number
+  default     = 5432
+}
+
+variable "postgres_sslmode" {
+  description = "PostgreSQL SSL mode. Dev currently uses disable; production must use verify-full."
+  type        = string
+  default     = "disable"
+
+  validation {
+    condition     = contains(["disable", "require", "verify-ca", "verify-full"], var.postgres_sslmode)
+    error_message = "postgres_sslmode must be disable, require, verify-ca, or verify-full."
+  }
+}
+
+variable "vault_addr" {
+  description = "Workload Vault API address."
+  type        = string
+  default     = "http://127.0.0.1:8200"
+}
+
+variable "vault_token" {
+  description = "Short-lived token carrying vault-database-automation-dev."
+  type        = string
+  sensitive   = true
+  ephemeral   = true
+}