96 lines
3.3 KiB
Terraform
96 lines
3.3 KiB
Terraform
terraform {
|
|
required_version = ">= 1.11.0"
|
|
|
|
required_providers {
|
|
vault = {
|
|
source = "hashicorp/vault"
|
|
version = "~> 5.7.0"
|
|
}
|
|
}
|
|
|
|
backend "s3" {}
|
|
}
|
|
|
|
provider "vault" {
|
|
address = var.vault_addr
|
|
skip_child_token = true
|
|
token = var.vault_token
|
|
}
|
|
|
|
locals {
|
|
workload_policy_dir = "${path.module}/policies"
|
|
|
|
jwt_transit_key_name = "project-auth-jwt"
|
|
kubernetes_auth_path = "kubernetes"
|
|
kubernetes_token_audience = "vault"
|
|
transit_mount_path = "transit"
|
|
|
|
workload_policies = {
|
|
auth-server-dev = file("${local.workload_policy_dir}/auth-server-dev.hcl")
|
|
auth-db-migration-dev = file("${local.workload_policy_dir}/auth-db-migration-dev.hcl")
|
|
postgres-dev = file("${local.workload_policy_dir}/postgres-dev.hcl")
|
|
keycloak-dev = file("${local.workload_policy_dir}/keycloak-dev.hcl")
|
|
keycloak-client-sync-dev = file("${local.workload_policy_dir}/keycloak-client-sync-dev.hcl")
|
|
}
|
|
}
|
|
|
|
module "workload_policies" {
|
|
source = "../../../components/vault-policy-set"
|
|
|
|
policies = local.workload_policies
|
|
}
|
|
|
|
module "workload_roles" {
|
|
source = "../../../components/vault-kubernetes-roles"
|
|
|
|
backend = local.kubernetes_auth_path
|
|
roles = {
|
|
auth-server-dev = {
|
|
audiences = [local.kubernetes_token_audience]
|
|
service_account_names = ["auth-server"]
|
|
service_account_namespaces = ["auth-dev"]
|
|
token_policies = [module.workload_policies.names["auth-server-dev"]]
|
|
token_ttl = var.kubernetes_role_ttl_seconds
|
|
}
|
|
auth-db-migration-dev = {
|
|
audiences = [local.kubernetes_token_audience]
|
|
service_account_names = ["auth-db-migration"]
|
|
service_account_namespaces = ["auth-dev"]
|
|
token_policies = [module.workload_policies.names["auth-db-migration-dev"]]
|
|
token_ttl = var.kubernetes_role_ttl_seconds
|
|
}
|
|
postgres-dev = {
|
|
audiences = [local.kubernetes_token_audience]
|
|
service_account_names = ["postgres"]
|
|
service_account_namespaces = ["auth-system-dev"]
|
|
token_policies = [module.workload_policies.names["postgres-dev"]]
|
|
token_ttl = var.kubernetes_role_ttl_seconds
|
|
}
|
|
keycloak-dev = {
|
|
audiences = [local.kubernetes_token_audience]
|
|
service_account_names = ["keycloak"]
|
|
service_account_namespaces = ["auth-system-dev"]
|
|
token_policies = [module.workload_policies.names["keycloak-dev"]]
|
|
token_ttl = var.kubernetes_role_ttl_seconds
|
|
}
|
|
keycloak-client-sync-dev = {
|
|
audiences = [local.kubernetes_token_audience]
|
|
service_account_names = ["keycloak-client-sync"]
|
|
service_account_namespaces = ["auth-system-dev"]
|
|
token_policies = [module.workload_policies.names["keycloak-client-sync-dev"]]
|
|
token_ttl = var.kubernetes_role_ttl_seconds
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "vault_transit_secret_backend_key" "project_auth_jwt" {
|
|
backend = local.transit_mount_path
|
|
deletion_allowed = false
|
|
name = local.jwt_transit_key_name
|
|
type = "rsa-2048"
|
|
|
|
lifecycle {
|
|
prevent_destroy = true
|
|
}
|
|
}
|