init: 아르고cd, vault 기반 인프라 설계
This commit is contained in:
DongHyeonka
+22
@@ -0,0 +1,22 @@
|
||||
# This file is maintained automatically by "terraform init".
|
||||
# Manual edits may be lost in future updates.
|
||||
|
||||
provider "registry.terraform.io/hashicorp/vault" {
|
||||
version = "4.8.0"
|
||||
constraints = "~> 4.8.0"
|
||||
hashes = [
|
||||
"h1:aHqgWQhDBMeZO9iUKwJYMlh4q+xNMUlMIcjRbF4d02Y=",
|
||||
"zh:269ab13433f67684012ae7e15876532b0312f5d0d2002a9cf9febb1279ce5ea6",
|
||||
"zh:4babc95bf0c40eb85005db1dc2ca403c46be4a71dd3e409db3711a56f7a5ca0e",
|
||||
"zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
|
||||
"zh:86e27c1c625ecc24446a11eeffc3ac319b36c2b4e51251db8579256a0dbcf136",
|
||||
"zh:a32f31da94824009e26b077374440b52098aecb93c92ff55dc3d31dd37c4ea25",
|
||||
"zh:be0a18c6c0425518bab4fbffd82078b82036a88503b5d76064de551c9f646cbf",
|
||||
"zh:be5a77fdfd36863ebeec79cd12b1d13322ffad6821d157a0b279789fa06b5937",
|
||||
"zh:be8317d142a3caad74c7d936039ae27076a1b2b8312ef5208e2871a5f525977c",
|
||||
"zh:c94a84895a3d9954b80e983eed4603330a5cdbbd8eef5b3c99278c2d1402ef3c",
|
||||
"zh:de1fb712784dd8415f011ca5346a34f87fab6046c730557615247e511dbc7d98",
|
||||
"zh:e3eafae7da550f86cae395d6660b2a0e93ec8d2b0e0e5ef982ec762e961fc952",
|
||||
"zh:ff35fb1ab6add288f0f368981e56f780b50405accd1937131cba1137999c8d83",
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,283 @@
|
||||
terraform {
|
||||
required_version = ">= 1.6.0"
|
||||
|
||||
required_providers {
|
||||
vault = {
|
||||
source = "hashicorp/vault"
|
||||
version = "~> 4.8.0"
|
||||
}
|
||||
}
|
||||
|
||||
backend "local" {
|
||||
path = "../../../.terraform-state/vault-reconcile.tfstate"
|
||||
}
|
||||
}
|
||||
|
||||
provider "vault" {
|
||||
address = var.workload_vault_addr
|
||||
skip_child_token = true
|
||||
token = var.workload_vault_token
|
||||
}
|
||||
|
||||
provider "vault" {
|
||||
alias = "transit"
|
||||
address = var.transit_vault_addr
|
||||
skip_child_token = true
|
||||
token = var.transit_vault_token
|
||||
}
|
||||
|
||||
locals {
|
||||
policy_dir = "${path.module}/../../../runbooks/vault/dev/policies"
|
||||
|
||||
auth_server_policy_name = "auth-server-dev"
|
||||
auth_db_migration_policy_name = "auth-db-migration-dev"
|
||||
postgres_policy_name = "postgres-dev"
|
||||
keycloak_policy_name = "keycloak-dev"
|
||||
keycloak_client_sync_policy_name = "keycloak-client-sync-dev"
|
||||
postgres_operator_policy_name = "postgres-operator-dev"
|
||||
keycloak_operator_policy_name = "keycloak-operator-dev"
|
||||
platform_admin_policy_name = "platform-admin-dev"
|
||||
workload_automation_policy_name = "workload-automation-dev"
|
||||
workload_workflow_role_name = "workload-dev-workflow"
|
||||
auth_db_migration_role_name = "auth-db-migration-dev"
|
||||
postgres_operator_role_name = "postgres-operator-dev"
|
||||
|
||||
migration_creation_statements = [
|
||||
<<-EOT
|
||||
CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
|
||||
GRANT "${var.auth_db_role}" TO "{{name}}";
|
||||
EOT
|
||||
]
|
||||
|
||||
migration_revocation_statements = [
|
||||
<<-EOT
|
||||
REASSIGN OWNED BY "{{name}}" TO "${var.auth_db_role}";
|
||||
DROP OWNED BY "{{name}}";
|
||||
REVOKE "${var.auth_db_role}" FROM "{{name}}";
|
||||
DROP ROLE IF EXISTS "{{name}}";
|
||||
EOT
|
||||
]
|
||||
|
||||
operator_creation_statements = [
|
||||
<<-EOT
|
||||
CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}';
|
||||
GRANT "${var.auth_db_role}" TO "{{name}}";
|
||||
EOT
|
||||
]
|
||||
|
||||
operator_revocation_statements = [
|
||||
<<-EOT
|
||||
REASSIGN OWNED BY "{{name}}" TO "${var.auth_db_role}";
|
||||
DROP OWNED BY "{{name}}";
|
||||
REVOKE "${var.auth_db_role}" FROM "{{name}}";
|
||||
DROP ROLE IF EXISTS "{{name}}";
|
||||
EOT
|
||||
]
|
||||
}
|
||||
|
||||
resource "vault_policy" "auth_server" {
|
||||
name = local.auth_server_policy_name
|
||||
policy = file("${local.policy_dir}/auth-server-dev.hcl")
|
||||
}
|
||||
|
||||
resource "vault_policy" "auth_db_migration" {
|
||||
name = local.auth_db_migration_policy_name
|
||||
policy = file("${local.policy_dir}/auth-db-migration-dev.hcl")
|
||||
}
|
||||
|
||||
resource "vault_policy" "postgres" {
|
||||
name = local.postgres_policy_name
|
||||
policy = file("${local.policy_dir}/postgres-dev.hcl")
|
||||
}
|
||||
|
||||
resource "vault_policy" "keycloak" {
|
||||
name = local.keycloak_policy_name
|
||||
policy = file("${local.policy_dir}/keycloak-dev.hcl")
|
||||
}
|
||||
|
||||
resource "vault_policy" "keycloak_client_sync" {
|
||||
name = local.keycloak_client_sync_policy_name
|
||||
policy = file("${local.policy_dir}/keycloak-client-sync-dev.hcl")
|
||||
}
|
||||
|
||||
resource "vault_policy" "postgres_operator" {
|
||||
name = local.postgres_operator_policy_name
|
||||
policy = file("${local.policy_dir}/postgres-operator-dev.hcl")
|
||||
}
|
||||
|
||||
resource "vault_policy" "keycloak_operator" {
|
||||
name = local.keycloak_operator_policy_name
|
||||
policy = file("${local.policy_dir}/keycloak-operator-dev.hcl")
|
||||
}
|
||||
|
||||
resource "vault_policy" "platform_admin" {
|
||||
name = local.platform_admin_policy_name
|
||||
policy = file("${local.policy_dir}/platform-admin-dev.hcl")
|
||||
}
|
||||
|
||||
resource "vault_policy" "workload_automation" {
|
||||
name = local.workload_automation_policy_name
|
||||
policy = file("${local.policy_dir}/workload-automation-dev.hcl")
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "auth_server" {
|
||||
backend = var.kubernetes_auth_path
|
||||
bound_service_account_names = ["auth-server"]
|
||||
bound_service_account_namespaces = ["auth-dev"]
|
||||
role_name = local.auth_server_policy_name
|
||||
token_policies = [vault_policy.auth_server.name]
|
||||
token_ttl = var.kubernetes_role_ttl_seconds
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "auth_db_migration" {
|
||||
backend = var.kubernetes_auth_path
|
||||
bound_service_account_names = ["auth-db-migration"]
|
||||
bound_service_account_namespaces = ["auth-dev"]
|
||||
role_name = local.auth_db_migration_policy_name
|
||||
token_policies = [vault_policy.auth_db_migration.name]
|
||||
token_ttl = var.kubernetes_role_ttl_seconds
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "postgres" {
|
||||
backend = var.kubernetes_auth_path
|
||||
bound_service_account_names = ["postgres"]
|
||||
bound_service_account_namespaces = ["platform"]
|
||||
role_name = local.postgres_policy_name
|
||||
token_policies = [vault_policy.postgres.name]
|
||||
token_ttl = var.kubernetes_role_ttl_seconds
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "keycloak" {
|
||||
backend = var.kubernetes_auth_path
|
||||
bound_service_account_names = ["keycloak"]
|
||||
bound_service_account_namespaces = ["platform"]
|
||||
role_name = local.keycloak_policy_name
|
||||
token_policies = [vault_policy.keycloak.name]
|
||||
token_ttl = var.kubernetes_role_ttl_seconds
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "keycloak_client_sync" {
|
||||
backend = var.kubernetes_auth_path
|
||||
bound_service_account_names = ["keycloak-client-sync"]
|
||||
bound_service_account_namespaces = ["platform"]
|
||||
role_name = local.keycloak_client_sync_policy_name
|
||||
token_policies = [vault_policy.keycloak_client_sync.name]
|
||||
token_ttl = var.kubernetes_role_ttl_seconds
|
||||
}
|
||||
|
||||
resource "vault_approle_auth_backend_role" "workflow" {
|
||||
backend = var.approle_auth_path
|
||||
role_name = local.workload_workflow_role_name
|
||||
secret_id_num_uses = 0
|
||||
secret_id_ttl = 0
|
||||
token_max_ttl = var.workflow_token_max_ttl_seconds
|
||||
token_policies = [vault_policy.workload_automation.name]
|
||||
token_ttl = var.workflow_token_ttl_seconds
|
||||
}
|
||||
|
||||
data "vault_kv_secret_v2" "provider_postgres_superuser" {
|
||||
provider = vault.transit
|
||||
mount = var.seed_kv_mount_path
|
||||
name = "dev/workload/platform/postgres/superuser"
|
||||
}
|
||||
|
||||
data "vault_kv_secret_v2" "provider_postgres_auth_server" {
|
||||
provider = vault.transit
|
||||
mount = var.seed_kv_mount_path
|
||||
name = "dev/workload/platform/postgres/auth-server"
|
||||
}
|
||||
|
||||
data "vault_kv_secret_v2" "provider_postgres_keycloak" {
|
||||
provider = vault.transit
|
||||
mount = var.seed_kv_mount_path
|
||||
name = "dev/workload/platform/postgres/keycloak"
|
||||
}
|
||||
|
||||
data "vault_kv_secret_v2" "provider_keycloak_bootstrap_admin" {
|
||||
provider = vault.transit
|
||||
mount = var.seed_kv_mount_path
|
||||
name = "dev/workload/platform/keycloak/bootstrap-admin"
|
||||
}
|
||||
|
||||
data "vault_kv_secret_v2" "provider_keycloak_client_auth_server" {
|
||||
provider = vault.transit
|
||||
mount = var.seed_kv_mount_path
|
||||
name = "dev/workload/platform/keycloak/client-auth-server"
|
||||
}
|
||||
|
||||
resource "vault_kv_secret_v2" "platform_postgres_superuser" {
|
||||
mount = var.kv_mount_path
|
||||
name = "dev/platform/postgres/superuser"
|
||||
data_json = jsonencode({
|
||||
POSTGRES_SUPERUSER_PASSWORD = data.vault_kv_secret_v2.provider_postgres_superuser.data["POSTGRES_SUPERUSER_PASSWORD"]
|
||||
})
|
||||
}
|
||||
|
||||
resource "vault_kv_secret_v2" "platform_postgres_auth_server" {
|
||||
mount = var.kv_mount_path
|
||||
name = "dev/platform/postgres/auth-server"
|
||||
data_json = jsonencode({
|
||||
APP_DATASOURCE_PASSWORD = data.vault_kv_secret_v2.provider_postgres_auth_server.data["APP_DATASOURCE_PASSWORD"]
|
||||
APP_DATASOURCE_USERNAME = data.vault_kv_secret_v2.provider_postgres_auth_server.data["APP_DATASOURCE_USERNAME"]
|
||||
AUTH_DB_PASSWORD = data.vault_kv_secret_v2.provider_postgres_auth_server.data["AUTH_DB_PASSWORD"]
|
||||
})
|
||||
}
|
||||
|
||||
resource "vault_kv_secret_v2" "platform_postgres_keycloak" {
|
||||
mount = var.kv_mount_path
|
||||
name = "dev/platform/postgres/keycloak"
|
||||
data_json = jsonencode({
|
||||
KEYCLOAK_DB_PASSWORD = data.vault_kv_secret_v2.provider_postgres_keycloak.data["KEYCLOAK_DB_PASSWORD"]
|
||||
})
|
||||
}
|
||||
|
||||
resource "vault_kv_secret_v2" "platform_keycloak_bootstrap_admin" {
|
||||
mount = var.kv_mount_path
|
||||
name = "dev/platform/keycloak/bootstrap-admin"
|
||||
data_json = jsonencode({
|
||||
KC_BOOTSTRAP_ADMIN_PASSWORD = data.vault_kv_secret_v2.provider_keycloak_bootstrap_admin.data["KC_BOOTSTRAP_ADMIN_PASSWORD"]
|
||||
})
|
||||
}
|
||||
|
||||
resource "vault_kv_secret_v2" "platform_keycloak_client_auth_server" {
|
||||
mount = var.kv_mount_path
|
||||
name = "dev/platform/keycloak/client-auth-server"
|
||||
data_json = jsonencode({
|
||||
APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET = data.vault_kv_secret_v2.provider_keycloak_client_auth_server.data["APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET"]
|
||||
KEYCLOAK_CLIENT_SECRET = data.vault_kv_secret_v2.provider_keycloak_client_auth_server.data["KEYCLOAK_CLIENT_SECRET"]
|
||||
})
|
||||
}
|
||||
|
||||
resource "vault_database_secret_backend_connection" "platform_postgres" {
|
||||
allowed_roles = [local.auth_db_migration_role_name, local.postgres_operator_role_name]
|
||||
backend = var.database_mount_path
|
||||
name = var.database_config_name
|
||||
plugin_name = "postgresql-database-plugin"
|
||||
verify_connection = false
|
||||
|
||||
postgresql {
|
||||
connection_url = "postgresql://{{username}}:{{password}}@${var.postgres_host}:${var.postgres_port}/${var.postgres_admin_database}?sslmode=disable"
|
||||
password = vault_kv_secret_v2.platform_postgres_superuser.data["POSTGRES_SUPERUSER_PASSWORD"]
|
||||
username = var.postgres_superuser
|
||||
}
|
||||
}
|
||||
|
||||
resource "vault_database_secret_backend_role" "auth_db_migration" {
|
||||
backend = var.database_mount_path
|
||||
creation_statements = local.migration_creation_statements
|
||||
db_name = vault_database_secret_backend_connection.platform_postgres.name
|
||||
default_ttl = var.auth_db_migration_default_ttl_seconds
|
||||
max_ttl = var.auth_db_migration_max_ttl_seconds
|
||||
name = local.auth_db_migration_role_name
|
||||
revocation_statements = local.migration_revocation_statements
|
||||
}
|
||||
|
||||
resource "vault_database_secret_backend_role" "postgres_operator" {
|
||||
backend = var.database_mount_path
|
||||
creation_statements = local.operator_creation_statements
|
||||
db_name = vault_database_secret_backend_connection.platform_postgres.name
|
||||
default_ttl = var.postgres_operator_default_ttl_seconds
|
||||
max_ttl = var.postgres_operator_max_ttl_seconds
|
||||
name = local.postgres_operator_role_name
|
||||
revocation_statements = local.operator_revocation_statements
|
||||
}
|
||||
@@ -0,0 +1,131 @@
|
||||
variable "approle_auth_path" {
|
||||
description = "Path where the workload AppRole auth backend is mounted."
|
||||
type = string
|
||||
default = "approle"
|
||||
}
|
||||
|
||||
variable "auth_db_migration_default_ttl_seconds" {
|
||||
description = "Default TTL, in seconds, for auth DB migration credentials."
|
||||
type = number
|
||||
default = 3600
|
||||
}
|
||||
|
||||
variable "auth_db_migration_max_ttl_seconds" {
|
||||
description = "Maximum TTL, in seconds, for auth DB migration credentials."
|
||||
type = number
|
||||
default = 86400
|
||||
}
|
||||
|
||||
variable "auth_db_role" {
|
||||
description = "Existing PostgreSQL role granted to dynamic auth users."
|
||||
type = string
|
||||
default = "project_auth"
|
||||
}
|
||||
|
||||
variable "database_config_name" {
|
||||
description = "Name of the Vault database connection configuration."
|
||||
type = string
|
||||
default = "platform-postgres-dev"
|
||||
}
|
||||
|
||||
variable "database_mount_path" {
|
||||
description = "Mount path for the workload database secrets engine."
|
||||
type = string
|
||||
default = "database"
|
||||
}
|
||||
|
||||
variable "kubernetes_auth_path" {
|
||||
description = "Path where the Kubernetes auth backend is mounted."
|
||||
type = string
|
||||
default = "kubernetes"
|
||||
}
|
||||
|
||||
variable "kubernetes_role_ttl_seconds" {
|
||||
description = "TTL, in seconds, granted to workload Kubernetes auth logins."
|
||||
type = number
|
||||
default = 86400
|
||||
}
|
||||
|
||||
variable "kv_mount_path" {
|
||||
description = "Mount path for the workload KV-v2 engine."
|
||||
type = string
|
||||
default = "kv"
|
||||
}
|
||||
|
||||
variable "postgres_admin_database" {
|
||||
description = "Administrative PostgreSQL database used by the database secret engine."
|
||||
type = string
|
||||
default = "postgres"
|
||||
}
|
||||
|
||||
variable "postgres_host" {
|
||||
description = "DNS name of the platform PostgreSQL service."
|
||||
type = string
|
||||
default = "postgres-0.postgres.platform.svc.cluster.local"
|
||||
}
|
||||
|
||||
variable "postgres_operator_default_ttl_seconds" {
|
||||
description = "Default TTL, in seconds, for the operator PostgreSQL role."
|
||||
type = number
|
||||
default = 3600
|
||||
}
|
||||
|
||||
variable "postgres_operator_max_ttl_seconds" {
|
||||
description = "Maximum TTL, in seconds, for the operator PostgreSQL role."
|
||||
type = number
|
||||
default = 28800
|
||||
}
|
||||
|
||||
variable "postgres_port" {
|
||||
description = "Port of the platform PostgreSQL service."
|
||||
type = number
|
||||
default = 5432
|
||||
}
|
||||
|
||||
variable "postgres_superuser" {
|
||||
description = "PostgreSQL superuser used by Vault database secrets."
|
||||
type = string
|
||||
default = "postgres"
|
||||
}
|
||||
|
||||
variable "seed_kv_mount_path" {
|
||||
description = "Mount path for the provider KV-v2 seed data."
|
||||
type = string
|
||||
default = "kv"
|
||||
}
|
||||
|
||||
variable "transit_vault_addr" {
|
||||
description = "Address of the vault-transit API."
|
||||
type = string
|
||||
default = "http://127.0.0.1:18200"
|
||||
}
|
||||
|
||||
variable "transit_vault_token" {
|
||||
description = "Token used to read provider seed data."
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "workflow_token_max_ttl_seconds" {
|
||||
description = "Maximum TTL, in seconds, for the workload workflow AppRole login token."
|
||||
type = number
|
||||
default = 14400
|
||||
}
|
||||
|
||||
variable "workflow_token_ttl_seconds" {
|
||||
description = "Default TTL, in seconds, for the workload workflow AppRole login token."
|
||||
type = number
|
||||
default = 3600
|
||||
}
|
||||
|
||||
variable "workload_vault_addr" {
|
||||
description = "Address of the workload Vault API."
|
||||
type = string
|
||||
default = "http://127.0.0.1:8200"
|
||||
}
|
||||
|
||||
variable "workload_vault_token" {
|
||||
description = "Workflow token used to reconcile workload Vault."
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
Reference in New Issue
Block a user