init: 아르고cd, vault 기반 인프라 설계

scripts/vault/dev/apply-argocd-dev-apps.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+for cmd in kubectl; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "$cmd is required" >&2
+    exit 1
+  fi
+done
+
+kubectl apply -f argocd/projects/dev
+kubectl apply -f argocd/applications/dev/infra/platform.yaml
+kubectl apply -f argocd/applications/dev/apps

scripts/vault/dev/apply-argocd-dev-infra.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+for cmd in kubectl; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "$cmd is required" >&2
+    exit 1
+  fi
+done
+
+kubectl apply -f argocd/projects/dev
+kubectl apply -f argocd/applications/dev/infra/sealed-secrets.yaml
+kubectl apply -f argocd/applications/dev/infra/vault-transit.yaml
+kubectl apply -f argocd/applications/dev/infra/vault.yaml
+kubectl apply -f argocd/applications/dev/infra/vault-agent-injector.yaml

scripts/vault/dev/bootstrap-runbook.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
+
+source "${SCRIPT_DIR}/provider-lib.sh"
+source "${SCRIPT_DIR}/workload-auth-lib.sh"
+
+if ! command -v terraform >/dev/null 2>&1; then
+  echo "terraform CLI is required" >&2
+  exit 1
+fi
+
+export VAULT_WORKLOAD_ADDR="${VAULT_WORKLOAD_ADDR:-${VAULT_ADDR:-http://127.0.0.1:8200}}"
+export VAULT_TRANSIT_ADDR="${VAULT_TRANSIT_ADDR:-http://127.0.0.1:18200}"
+export TF_VAR_workload_vault_addr="$VAULT_WORKLOAD_ADDR"
+export TF_VAR_workload_vault_token="$(workload_vault_token)"
+export TF_VAR_transit_vault_addr="$VAULT_TRANSIT_ADDR"
+export TF_VAR_transit_vault_token="$(provider_vault_token)"
+
+mkdir -p "${REPO_ROOT}/.terraform-state"
+
+if [[ -n "${TF_STATE_DIR:-}" ]]; then
+  mkdir -p "${TF_STATE_DIR}"
+  terraform -chdir="${REPO_ROOT}/terraform/vault/dev" init \
+    -input=false \
+    -reconfigure \
+    -backend-config="path=${TF_STATE_DIR}/vault-dev.tfstate"
+else
+  terraform -chdir="${REPO_ROOT}/terraform/vault/dev" init -input=false
+fi
+
+terraform -chdir="${REPO_ROOT}/terraform/vault/dev" apply -input=false -auto-approve

scripts/vault/dev/ensure-unsealed.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+VAULT_ADDR="${VAULT_ADDR:-http://127.0.0.1:8200}"
+
+export VAULT_ADDR
+
+if ! command -v vault >/dev/null 2>&1; then
+  echo "vault CLI is required" >&2
+  exit 1
+fi
+
+status_json="$(mktemp)"
+trap 'rm -f "$status_json"' EXIT
+
+if vault status -format=json >"$status_json" 2>/dev/null; then
+  :
+else
+  if [[ ! -s "$status_json" ]]; then
+    echo "Vault is unreachable at ${VAULT_ADDR}" >&2
+    exit 1
+  fi
+fi
+
+initialized="$(jq -r '.initialized' "$status_json")"
+sealed="$(jq -r '.sealed' "$status_json")"
+
+if [[ "$initialized" != "true" ]]; then
+  echo "Workload Vault is not initialized." >&2
+  exit 1
+fi
+
+if [[ "$sealed" == "true" ]]; then
+  echo "Workload Vault is still sealed. Check the transit unseal provider and vault-transit-seal secret." >&2
+  exit 1
+fi

scripts/vault/dev/issue-operator-tokens.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+VAULT_ADDR="${VAULT_ADDR:-http://127.0.0.1:8200}"
+VAULT_TOKEN="${VAULT_TOKEN:-}"
+TOKEN_TTL="${TOKEN_TTL:-1h}"
+
+if [[ -z "$VAULT_TOKEN" ]]; then
+  echo "VAULT_TOKEN must be set to a platform-admin-dev token." >&2
+  exit 1
+fi
+
+for cmd in vault; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "$cmd is required" >&2
+    exit 1
+  fi
+done
+
+export VAULT_ADDR
+export VAULT_TOKEN
+
+postgres_token="$(
+  vault token create -orphan -policy=postgres-operator-dev -ttl="$TOKEN_TTL" -field=token
+)"
+
+keycloak_token="$(
+  vault token create -orphan -policy=keycloak-operator-dev -ttl="$TOKEN_TTL" -field=token
+)"
+
+echo ""
+echo "postgres-operator-dev token:"
+echo "$postgres_token"
+echo ""
+echo "keycloak-operator-dev token:"
+echo "$keycloak_token"
+echo ""

scripts/vault/dev/provider-lib.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+__provider_vault_token_cache="${__provider_vault_token_cache:-}"
+
+provider_vault_addr() {
+  printf '%s\n' "${VAULT_TRANSIT_ADDR:-http://127.0.0.1:18200}"
+}
+
+provider_vault_login_with_approle() {
+  local role_id="$1"
+  local secret_id="$2"
+
+  if [[ -n "$__provider_vault_token_cache" ]]; then
+    printf '%s\n' "$__provider_vault_token_cache"
+    return 0
+  fi
+
+  __provider_vault_token_cache="$(
+    VAULT_ADDR="$(provider_vault_addr)" \
+      vault write -field=token auth/approle/login \
+        role_id="$role_id" \
+        secret_id="$secret_id"
+  )"
+
+  printf '%s\n' "$__provider_vault_token_cache"
+}
+
+provider_vault_token() {
+  if [[ -n "${VAULT_TRANSIT_DEV_ROLE_ID:-}" && -n "${VAULT_TRANSIT_DEV_SECRET_ID:-}" ]]; then
+    provider_vault_login_with_approle \
+      "$VAULT_TRANSIT_DEV_ROLE_ID" \
+      "$VAULT_TRANSIT_DEV_SECRET_ID"
+    return 0
+  fi
+
+  if [[ -n "${VAULT_TRANSIT_DEV_BOOTSTRAP_TOKEN:-}" ]]; then
+    printf '%s\n' "$VAULT_TRANSIT_DEV_BOOTSTRAP_TOKEN"
+    return 0
+  fi
+
+  if [[ -n "${VAULT_TOKEN:-}" ]]; then
+    printf '%s\n' "$VAULT_TOKEN"
+    return 0
+  fi
+
+  echo "VAULT_TRANSIT_DEV_BOOTSTRAP_TOKEN or VAULT_TRANSIT_DEV_ROLE_ID/VAULT_TRANSIT_DEV_SECRET_ID or VAULT_TOKEN must be set." >&2
+  return 1
+}
+
+provider_kv_get_json() {
+  local path="$1"
+  VAULT_ADDR="$(provider_vault_addr)" \
+  VAULT_TOKEN="$(provider_vault_token)" \
+    vault kv get -format=json "$path"
+}
+
+provider_read_workload_bootstrap_token() {
+  provider_kv_get_json "kv/dev/workload/bootstrap" | jq -r '.data.data.VAULT_WORKLOAD_DEV_BOOTSTRAP_TOKEN // empty'
+}
+
+provider_read_workload_role_id() {
+  provider_kv_get_json "kv/dev/workload/bootstrap" | jq -r '.data.data.VAULT_WORKLOAD_DEV_ROLE_ID // empty'
+}
+
+provider_read_workload_secret_id() {
+  provider_kv_get_json "kv/dev/workload/bootstrap" | jq -r '.data.data.VAULT_WORKLOAD_DEV_SECRET_ID // empty'
+}

scripts/vault/dev/workload-auth-lib.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+__workload_vault_token_cache="${__workload_vault_token_cache:-}"
+
+workload_vault_login_with_approle() {
+  local role_id="$1"
+  local secret_id="$2"
+
+  if [[ -n "$__workload_vault_token_cache" ]]; then
+    printf '%s\n' "$__workload_vault_token_cache"
+    return 0
+  fi
+
+  __workload_vault_token_cache="$(
+    VAULT_ADDR="${VAULT_WORKLOAD_ADDR:-${VAULT_ADDR:-http://127.0.0.1:8200}}" \
+      vault write -field=token auth/approle/login \
+        role_id="$role_id" \
+        secret_id="$secret_id"
+  )"
+
+  printf '%s\n' "$__workload_vault_token_cache"
+}
+
+workload_vault_token() {
+  local role_id=""
+  local secret_id=""
+  local token=""
+
+  if [[ -n "${VAULT_WORKLOAD_DEV_BOOTSTRAP_TOKEN:-}" ]]; then
+    printf '%s\n' "$VAULT_WORKLOAD_DEV_BOOTSTRAP_TOKEN"
+    return 0
+  fi
+
+  if [[ -n "${VAULT_WORKLOAD_DEV_ROLE_ID:-}" && -n "${VAULT_WORKLOAD_DEV_SECRET_ID:-}" ]]; then
+    workload_vault_login_with_approle \
+      "$VAULT_WORKLOAD_DEV_ROLE_ID" \
+      "$VAULT_WORKLOAD_DEV_SECRET_ID"
+    return 0
+  fi
+
+  role_id="$(provider_read_workload_role_id 2>/dev/null || true)"
+  secret_id="$(provider_read_workload_secret_id 2>/dev/null || true)"
+  if [[ -n "$role_id" && -n "$secret_id" ]]; then
+    workload_vault_login_with_approle "$role_id" "$secret_id"
+    return 0
+  fi
+
+  token="$(provider_read_workload_bootstrap_token 2>/dev/null || true)"
+  if [[ -n "$token" ]]; then
+    printf '%s\n' "$token"
+    return 0
+  fi
+
+  if [[ -n "${VAULT_TOKEN:-}" ]]; then
+    printf '%s\n' "$VAULT_TOKEN"
+    return 0
+  fi
+
+  echo "VAULT_WORKLOAD_DEV_ROLE_ID/VAULT_WORKLOAD_DEV_SECRET_ID or VAULT_WORKLOAD_DEV_BOOTSTRAP_TOKEN or VAULT_TOKEN must be set." >&2
+  return 1
+}