refactor: 구조 변경

2026-08-28 17:24:26 +09:00
parent a6f6c663e0
commit b8626946b1
192 changed files with 2251 additions and 206 deletions
@@ -0,0 +1,22 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/vault" {
+  version     = "5.7.0"
+  constraints = "~> 5.7.0"
+  hashes = [
+    "h1:Pm0AcUSYmBPZgRahQX/ahiYcjtZODSAEc2rK8r8MQ18=",
+    "zh:1dd9ab6d23f61a5e522efcb462f1fd6f4a210c77b9038c8e12fa5fa663b45d01",
+    "zh:3c98d37ead857c980f7b9285f8c3e1eb7a8fd6d6799275c311c6997973389cc9",
+    "zh:3df895fbaed383e3748ba1b50f5f1046f75503483bc3d783992059f85c85ba31",
+    "zh:3e9faaa0a85c6f03c7fd7f8b7008bb3fbb8777f26c001875947cafa47f91c657",
+    "zh:52a057d0c6cde7cbfd9ceb78a3781dcfc81cf108c533f454530ea6bb87a9bea8",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:8521c3825254a5f7fbff8f42ca57cabf052366f0420f5f239ebebf8292c03d0e",
+    "zh:953563d429e40087eb34faf22f28e781e50eee27cfc9ac1ad04308ba592a647f",
+    "zh:a52dd76bb7f5b86cb8de7380d2e68b47ec4445782c16ee205e6a013be35a57b6",
+    "zh:bdad38c95a14c8cce1eeadcc539cf9bf74902ce7c662b79105ad993bb48ec073",
+    "zh:d3c676d7d12c15b58518fa3ee7fc398a13893b4057fe9bf4bc1fe635f3fb995a",
+    "zh:f8673b6c06da80e912c9e32dd4853f07bfca386968d5b33c9fceb6f68b519959",
+  ]
+}
@@ -0,0 +1,16 @@
+# dev-k3s Vault workloads
+
+## 대상과 State
+
+- Environment/cluster: `dev-k3s`
+- Provider: HashiCorp Vault
+- State: `vault-workloads`
+- Backend example: `backend.s3.hcl.example`
+- Owner: delegated workload automation
+
+정확한 workload ACL, Kubernetes auth role와 Project Auth Transit key를
+소유합니다. `policies/`의 ACL은 wildcard 없이 workload가 실제 사용하는
+경로만 허용합니다.
+
+Foundation이 만든 short-lived identity로 실행하며, 이 state는 자기 실행
+policy/login role을 생성하지 않습니다.
@@ -0,0 +1,5 @@
+bucket       = "project-gitops-terraform-state"
+key          = "dev-k3s/vault-workloads.tfstate"
+region       = "us-east-1"
+encrypt      = true
+use_lockfile = true
@@ -0,0 +1,95 @@
+terraform {
+  required_version = ">= 1.11.0"
+
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 5.7.0"
+    }
+  }
+
+  backend "s3" {}
+}
+
+provider "vault" {
+  address          = var.vault_addr
+  skip_child_token = true
+  token            = var.vault_token
+}
+
+locals {
+  workload_policy_dir = "${path.module}/policies"
+
+  jwt_transit_key_name      = "project-auth-jwt"
+  kubernetes_auth_path      = "kubernetes"
+  kubernetes_token_audience = "vault"
+  transit_mount_path        = "transit"
+
+  workload_policies = {
+    auth-server-dev          = file("${local.workload_policy_dir}/auth-server-dev.hcl")
+    auth-db-migration-dev    = file("${local.workload_policy_dir}/auth-db-migration-dev.hcl")
+    postgres-dev             = file("${local.workload_policy_dir}/postgres-dev.hcl")
+    keycloak-dev             = file("${local.workload_policy_dir}/keycloak-dev.hcl")
+    keycloak-client-sync-dev = file("${local.workload_policy_dir}/keycloak-client-sync-dev.hcl")
+  }
+}
+
+module "workload_policies" {
+  source = "../../../components/vault-policy-set"
+
+  policies = local.workload_policies
+}
+
+module "workload_roles" {
+  source = "../../../components/vault-kubernetes-roles"
+
+  backend = local.kubernetes_auth_path
+  roles = {
+    auth-server-dev = {
+      audiences                  = [local.kubernetes_token_audience]
+      service_account_names      = ["auth-server"]
+      service_account_namespaces = ["auth-dev"]
+      token_policies             = [module.workload_policies.names["auth-server-dev"]]
+      token_ttl                  = var.kubernetes_role_ttl_seconds
+    }
+    auth-db-migration-dev = {
+      audiences                  = [local.kubernetes_token_audience]
+      service_account_names      = ["auth-db-migration"]
+      service_account_namespaces = ["auth-dev"]
+      token_policies             = [module.workload_policies.names["auth-db-migration-dev"]]
+      token_ttl                  = var.kubernetes_role_ttl_seconds
+    }
+    postgres-dev = {
+      audiences                  = [local.kubernetes_token_audience]
+      service_account_names      = ["postgres"]
+      service_account_namespaces = ["auth-system-dev"]
+      token_policies             = [module.workload_policies.names["postgres-dev"]]
+      token_ttl                  = var.kubernetes_role_ttl_seconds
+    }
+    keycloak-dev = {
+      audiences                  = [local.kubernetes_token_audience]
+      service_account_names      = ["keycloak"]
+      service_account_namespaces = ["auth-system-dev"]
+      token_policies             = [module.workload_policies.names["keycloak-dev"]]
+      token_ttl                  = var.kubernetes_role_ttl_seconds
+    }
+    keycloak-client-sync-dev = {
+      audiences                  = [local.kubernetes_token_audience]
+      service_account_names      = ["keycloak-client-sync"]
+      service_account_namespaces = ["auth-system-dev"]
+      token_policies             = [module.workload_policies.names["keycloak-client-sync-dev"]]
+      token_ttl                  = var.kubernetes_role_ttl_seconds
+    }
+  }
+}
+
+resource "vault_transit_secret_backend_key" "project_auth_jwt" {
+  backend          = local.transit_mount_path
+  deletion_allowed = false
+  name             = local.jwt_transit_key_name
+  type             = "rsa-2048"
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
@@ -0,0 +1,3 @@
+path "database/creds/auth-db-migration-dev" {
+  capabilities = ["read"]
+}
@@ -0,0 +1,15 @@
+path "kv/data/dev/systems/auth-system/postgres/auth-server" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/workloads/auth-server/keycloak-client" {
+  capabilities = ["read"]
+}
+
+path "transit/keys/project-auth-jwt" {
+  capabilities = ["read"]
+}
+
+path "transit/sign/project-auth-jwt" {
+  capabilities = ["update"]
+}
@@ -0,0 +1,7 @@
+path "kv/data/dev/systems/auth-system/keycloak/bootstrap-admin" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/workloads/auth-server/keycloak-client" {
+  capabilities = ["read"]
+}
@@ -0,0 +1,7 @@
+path "kv/data/dev/systems/auth-system/postgres/keycloak" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/systems/auth-system/keycloak/bootstrap-admin" {
+  capabilities = ["read"]
+}
@@ -0,0 +1,11 @@
+path "kv/data/dev/systems/auth-system/postgres/superuser" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/systems/auth-system/postgres/auth-server" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/systems/auth-system/postgres/keycloak" {
+  capabilities = ["read"]
+}
@@ -0,0 +1,18 @@
+variable "kubernetes_role_ttl_seconds" {
+  description = "TTL for workload Kubernetes auth tokens."
+  type        = number
+  default     = 3600
+}
+
+variable "vault_addr" {
+  description = "Vault API address reachable by the delegated runner."
+  type        = string
+  default     = "http://127.0.0.1:8200"
+}
+
+variable "vault_token" {
+  description = "Short-lived token carrying only vault-workloads-automation-dev."
+  type        = string
+  sensitive   = true
+  ephemeral   = true
+}