init: 아르고cd, vault 기반 인프라 설계

2026-07-24 14:31:09 +09:00
parent 8879d0a3fe
commit d507ac6ee9
137 changed files with 11431 additions and 1 deletions
@@ -0,0 +1,51 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 4.8.0"
+    }
+  }
+
+  backend "local" {
+    path = "../../../.terraform-state/vault-transit-reconcile.tfstate"
+  }
+}
+
+provider "vault" {
+  address          = var.vault_addr
+  skip_child_token = true
+  token            = var.vault_token
+}
+
+locals {
+  workflow_policy_path = "${path.module}/../../../runbooks/vault-transit/dev/policies/vault-transit-automation-dev.hcl"
+  workload_policy_path = "${path.module}/../../../runbooks/vault-transit/dev/policies/workload-vault-transit-dev.hcl"
+  admin_policy_path    = "${path.module}/../../../runbooks/vault-transit/dev/policies/vault-transit-admin-dev.hcl"
+}
+
+resource "vault_policy" "workload_vault_transit_dev" {
+  name   = var.workload_policy_name
+  policy = file(local.workload_policy_path)
+}
+
+resource "vault_policy" "vault_transit_admin_dev" {
+  name   = var.admin_policy_name
+  policy = file(local.admin_policy_path)
+}
+
+resource "vault_policy" "vault_transit_automation_dev" {
+  name   = var.workflow_policy_name
+  policy = file(local.workflow_policy_path)
+}
+
+resource "vault_approle_auth_backend_role" "workflow" {
+  backend            = var.approle_auth_path
+  role_name          = var.workflow_role_name
+  secret_id_num_uses = 0
+  secret_id_ttl      = 0
+  token_max_ttl      = var.workflow_token_max_ttl_seconds
+  token_policies     = [vault_policy.vault_transit_automation_dev.name]
+  token_ttl          = var.workflow_token_ttl_seconds
+}