project-gitops/iac/terraform/live/dev-k3s/vault-foundation/main.tf

terraform {
  required_version = ">= 1.11.0"

  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "~> 5.7.0"
    }
  }

  backend "s3" {}
}

provider "vault" {
  address = var.vault_addr
  token   = var.vault_token
}

removed {
  from = module.workload_policies

  lifecycle {
    destroy = false
  }
}

removed {
  from = module.workload_roles

  lifecycle {
    destroy = false
  }
}

removed {
  from = vault_transit_secret_backend_key.project_auth_jwt

  lifecycle {
    destroy = false
  }
}

removed {
  from = vault_policy.platform_admin

  lifecycle {
    destroy = false
  }
}

removed {
  from = vault_kubernetes_auth_backend_role.operator

  lifecycle {
    destroy = false
  }
}

removed {
  from = vault_jwt_auth_backend_role.ci

  lifecycle {
    destroy = false
  }
}

locals {
  platform_policy_dir = "${path.module}/../../../../../policies/vault/dev-k3s/platform"

  database_automation_policy_name  = "vault-database-automation-dev"
  database_mount_path              = "database"
  ci_database_role_name            = "project-gitops-vault-database-dev"
  ci_jwt_auth_path                 = "jwt-ci"
  ci_workloads_role_name           = "project-gitops-vault-workloads-dev"
  kubernetes_auth_path             = "kubernetes"
  kv_mount_path                    = "kv"
  transit_mount_path               = "transit"
  workloads_automation_policy_name = "vault-workloads-automation-dev"

  automation_roles = var.ci_jwt_oidc_discovery_url == null ? {} : {
    workloads = {
      bound_claims = var.ci_workloads_bound_claims
      name         = local.ci_workloads_role_name
      policy       = vault_policy.workloads_automation.name
    }
    database = {
      bound_claims = var.ci_database_bound_claims
      name         = local.ci_database_role_name
      policy       = vault_policy.database_automation.name
    }
  }
}

resource "vault_mount" "kv" {
  path = local.kv_mount_path
  type = "kv"
  options = {
    version = "2"
  }

  lifecycle {
    prevent_destroy = true
  }
}

resource "vault_mount" "database" {
  path = local.database_mount_path
  type = "database"

  lifecycle {
    prevent_destroy = true
  }
}

resource "vault_mount" "transit" {
  path = local.transit_mount_path
  type = "transit"

  lifecycle {
    prevent_destroy = true
  }
}

resource "vault_auth_backend" "kubernetes" {
  path = local.kubernetes_auth_path
  type = "kubernetes"

  lifecycle {
    prevent_destroy = true
  }
}

resource "vault_kubernetes_auth_backend_config" "cluster" {
  backend                = vault_auth_backend.kubernetes.path
  disable_iss_validation = true
  disable_local_ca_jwt   = false
  kubernetes_host        = var.kubernetes_host
}

resource "vault_policy" "workloads_automation" {
  name   = local.workloads_automation_policy_name
  policy = file("${local.platform_policy_dir}/vault-workloads-automation-dev.hcl")
}

resource "vault_policy" "database_automation" {
  name   = local.database_automation_policy_name
  policy = file("${local.platform_policy_dir}/vault-database-automation-dev.hcl")
}

resource "vault_jwt_auth_backend" "ci" {
  count = var.ci_jwt_oidc_discovery_url == null ? 0 : 1

  bound_issuer       = var.ci_jwt_bound_issuer
  oidc_discovery_url = var.ci_jwt_oidc_discovery_url
  path               = local.ci_jwt_auth_path

  lifecycle {
    prevent_destroy = true

    precondition {
      condition = (
        var.ci_jwt_bound_issuer != null &&
        length(var.ci_jwt_bound_audiences) > 0 &&
        length(var.ci_workloads_bound_claims) > 0 &&
        length(var.ci_database_bound_claims) > 0 &&
        length([
          for claim, value in var.ci_workloads_bound_claims : claim
          if lookup(var.ci_database_bound_claims, claim, value) != value
        ]) > 0
      )
      error_message = "Enabled CI JWT auth requires issuer/audience constraints and workload/database claim maps with at least one shared discriminator key carrying different values."
    }
  }
}

resource "vault_jwt_auth_backend_role" "automation" {
  for_each = local.automation_roles

  backend                 = vault_jwt_auth_backend.ci[0].path
  bound_audiences         = var.ci_jwt_bound_audiences
  bound_claims            = each.value.bound_claims
  bound_claims_type       = "string"
  role_name               = each.value.name
  role_type               = "jwt"
  token_explicit_max_ttl  = var.ci_token_ttl_seconds
  token_no_default_policy = true
  token_policies          = [each.value.policy]
  user_claim              = var.ci_jwt_user_claim
}