init: 아르고cd, vault 기반 인프라 설계

2026-07-24 14:31:09 +09:00
parent 8879d0a3fe
commit d507ac6ee9
137 changed files with 11431 additions and 1 deletions
@@ -0,0 +1,42 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/kubernetes" {
+  version     = "2.38.0"
+  constraints = "~> 2.32"
+  hashes = [
+    "h1:5CkveFo5ynsLdzKk+Kv+r7+U9rMrNjfZPT3a0N/fhgE=",
+    "zh:0af928d776eb269b192dc0ea0f8a3f0f5ec117224cd644bdacdc682300f84ba0",
+    "zh:1be998e67206f7cfc4ffe77c01a09ac91ce725de0abaec9030b22c0a832af44f",
+    "zh:326803fe5946023687d603f6f1bab24de7af3d426b01d20e51d4e6fbe4e7ec1b",
+    "zh:4a99ec8d91193af961de1abb1f824be73df07489301d62e6141a656b3ebfff12",
+    "zh:5136e51765d6a0b9e4dbcc3b38821e9736bd2136cf15e9aac11668f22db117d2",
+    "zh:63fab47349852d7802fb032e4f2b6a101ee1ce34b62557a9ad0f0f0f5b6ecfdc",
+    "zh:924fb0257e2d03e03e2bfe9c7b99aa73c195b1f19412ca09960001bee3c50d15",
+    "zh:b63a0be5e233f8f6727c56bed3b61eb9456ca7a8bb29539fba0837f1badf1396",
+    "zh:d39861aa21077f1bc899bc53e7233262e530ba8a3a2d737449b100daeb303e4d",
+    "zh:de0805e10ebe4c83ce3b728a67f6b0f9d18be32b25146aa89116634df5145ad4",
+    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
+    "zh:faf23e45f0090eef8ba28a8aac7ec5d4fdf11a36c40a8d286304567d71c1e7db",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/vault" {
+  version     = "4.8.0"
+  constraints = "~> 4.8.0"
+  hashes = [
+    "h1:aHqgWQhDBMeZO9iUKwJYMlh4q+xNMUlMIcjRbF4d02Y=",
+    "zh:269ab13433f67684012ae7e15876532b0312f5d0d2002a9cf9febb1279ce5ea6",
+    "zh:4babc95bf0c40eb85005db1dc2ca403c46be4a71dd3e409db3711a56f7a5ca0e",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:86e27c1c625ecc24446a11eeffc3ac319b36c2b4e51251db8579256a0dbcf136",
+    "zh:a32f31da94824009e26b077374440b52098aecb93c92ff55dc3d31dd37c4ea25",
+    "zh:be0a18c6c0425518bab4fbffd82078b82036a88503b5d76064de551c9f646cbf",
+    "zh:be5a77fdfd36863ebeec79cd12b1d13322ffad6821d157a0b279789fa06b5937",
+    "zh:be8317d142a3caad74c7d936039ae27076a1b2b8312ef5208e2871a5f525977c",
+    "zh:c94a84895a3d9954b80e983eed4603330a5cdbbd8eef5b3c99278c2d1402ef3c",
+    "zh:de1fb712784dd8415f011ca5346a34f87fab6046c730557615247e511dbc7d98",
+    "zh:e3eafae7da550f86cae395d6660b2a0e93ec8d2b0e0e5ef982ec762e961fc952",
+    "zh:ff35fb1ab6add288f0f368981e56f780b50405accd1937131cba1137999c8d83",
+  ]
+}
@@ -0,0 +1,51 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.8.0"
+    }
+  }
+
+  backend "local" {
+    path = "../../../.terraform-state/vault-transit-reconcile.tfstate"
+  }
+}
+
+provider "vault" {
+  address          = var.vault_addr
+  skip_child_token = true
+  token            = var.vault_token
+}
+
+locals {
+  workflow_policy_path = "${path.module}/../../../runbooks/vault-transit/dev/policies/vault-transit-automation-dev.hcl"
+  workload_policy_path = "${path.module}/../../../runbooks/vault-transit/dev/policies/workload-vault-transit-dev.hcl"
+  admin_policy_path    = "${path.module}/../../../runbooks/vault-transit/dev/policies/vault-transit-admin-dev.hcl"
+}
+
+resource "vault_policy" "workload_vault_transit_dev" {
+  name   = var.workload_policy_name
+  policy = file(local.workload_policy_path)
+}
+
+resource "vault_policy" "vault_transit_admin_dev" {
+  name   = var.admin_policy_name
+  policy = file(local.admin_policy_path)
+}
+
+resource "vault_policy" "vault_transit_automation_dev" {
+  name   = var.workflow_policy_name
+  policy = file(local.workflow_policy_path)
+}
+
+resource "vault_approle_auth_backend_role" "workflow" {
+  backend            = var.approle_auth_path
+  role_name          = var.workflow_role_name
+  secret_id_num_uses = 0
+  secret_id_ttl      = 0
+  token_max_ttl      = var.workflow_token_max_ttl_seconds
+  token_policies     = [vault_policy.vault_transit_automation_dev.name]
+  token_ttl          = var.workflow_token_ttl_seconds
+}
@@ -0,0 +1,53 @@
+variable "admin_policy_name" {
+  description = "Name of the operator policy kept for manual vault-transit maintenance."
+  type        = string
+  default     = "vault-transit-admin-dev"
+}
+
+variable "approle_auth_path" {
+  description = "Path where the AppRole auth backend is mounted."
+  type        = string
+  default     = "approle"
+}
+
+variable "vault_addr" {
+  description = "Address of the vault-transit API."
+  type        = string
+  default     = "http://127.0.0.1:18200"
+}
+
+variable "vault_token" {
+  description = "Workflow token used to reconcile vault-transit policies and workflow AppRole."
+  type        = string
+  sensitive   = true
+}
+
+variable "workflow_policy_name" {
+  description = "Policy granted to the vault-transit workflow AppRole."
+  type        = string
+  default     = "vault-transit-automation-dev"
+}
+
+variable "workflow_role_name" {
+  description = "Name of the workflow AppRole used by CI."
+  type        = string
+  default     = "vault-transit-dev-workflow"
+}
+
+variable "workflow_token_max_ttl_seconds" {
+  description = "Maximum TTL, in seconds, for the workflow AppRole login token."
+  type        = number
+  default     = 14400
+}
+
+variable "workflow_token_ttl_seconds" {
+  description = "Default TTL, in seconds, for the workflow AppRole login token."
+  type        = number
+  default     = 3600
+}
+
+variable "workload_policy_name" {
+  description = "Policy name granted to the workload Vault auto-unseal token."
+  type        = string
+  default     = "workload-vault-transit-dev"
+}