142 lines
3.5 KiB
Terraform
142 lines
3.5 KiB
Terraform
terraform {
|
|
required_version = ">= 1.6.0"
|
|
|
|
required_providers {
|
|
kubernetes = {
|
|
source = "hashicorp/kubernetes"
|
|
version = "~> 2.32"
|
|
}
|
|
vault = {
|
|
source = "hashicorp/vault"
|
|
version = "~> 4.8.0"
|
|
}
|
|
}
|
|
|
|
backend "local" {
|
|
path = "../../../.terraform-state/vault-transit-dev.tfstate"
|
|
}
|
|
}
|
|
|
|
provider "vault" {
|
|
address = var.vault_addr
|
|
skip_child_token = true
|
|
token = var.vault_token
|
|
}
|
|
|
|
provider "kubernetes" {
|
|
config_path = var.kubeconfig_path
|
|
}
|
|
|
|
locals {
|
|
workflow_policy_path = "${path.module}/../../../runbooks/vault-transit/dev/policies/vault-transit-automation-dev.hcl"
|
|
workload_policy_path = "${path.module}/../../../runbooks/vault-transit/dev/policies/workload-vault-transit-dev.hcl"
|
|
admin_policy_path = "${path.module}/../../../runbooks/vault-transit/dev/policies/vault-transit-admin-dev.hcl"
|
|
}
|
|
|
|
resource "vault_mount" "kv" {
|
|
path = var.kv_mount_path
|
|
type = "kv"
|
|
options = {
|
|
version = "2"
|
|
}
|
|
|
|
lifecycle {
|
|
prevent_destroy = true
|
|
ignore_changes = [type, options]
|
|
}
|
|
}
|
|
|
|
resource "vault_mount" "transit" {
|
|
path = var.transit_mount_path
|
|
type = "transit"
|
|
|
|
lifecycle {
|
|
prevent_destroy = true
|
|
}
|
|
}
|
|
|
|
resource "vault_transit_secret_backend_key" "workload_unseal" {
|
|
backend = vault_mount.transit.path
|
|
name = var.seal_key_name
|
|
type = "aes256-gcm96"
|
|
}
|
|
|
|
resource "vault_policy" "workload_vault_transit_dev" {
|
|
name = var.workload_policy_name
|
|
policy = file(local.workload_policy_path)
|
|
}
|
|
|
|
resource "vault_policy" "vault_transit_admin_dev" {
|
|
name = var.admin_policy_name
|
|
policy = file(local.admin_policy_path)
|
|
}
|
|
|
|
resource "vault_policy" "vault_transit_automation_dev" {
|
|
name = var.workflow_policy_name
|
|
policy = file(local.workflow_policy_path)
|
|
}
|
|
|
|
resource "vault_auth_backend" "approle" {
|
|
path = var.approle_auth_path
|
|
type = "approle"
|
|
}
|
|
|
|
resource "vault_approle_auth_backend_role" "workflow" {
|
|
backend = vault_auth_backend.approle.path
|
|
role_name = var.workflow_role_name
|
|
secret_id_num_uses = 0
|
|
secret_id_ttl = 0
|
|
token_max_ttl = var.workflow_token_max_ttl_seconds
|
|
token_policies = [vault_policy.vault_transit_automation_dev.name]
|
|
token_ttl = var.workflow_token_ttl_seconds
|
|
}
|
|
|
|
resource "vault_approle_auth_backend_role_secret_id" "workflow" {
|
|
backend = vault_auth_backend.approle.path
|
|
role_name = vault_approle_auth_backend_role.workflow.role_name
|
|
}
|
|
|
|
resource "vault_token" "seal" {
|
|
display_name = "workload-vault-dev-unseal"
|
|
no_parent = true
|
|
period = var.seal_token_period
|
|
policies = [vault_policy.workload_vault_transit_dev.name]
|
|
renewable = true
|
|
|
|
lifecycle {
|
|
ignore_changes = all
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_secret_v1" "vault_transit_seal" {
|
|
wait_for_service_account_token = true
|
|
|
|
metadata {
|
|
name = var.target_secret_name
|
|
namespace = var.target_namespace
|
|
}
|
|
|
|
data = {
|
|
VAULT_TRANSIT_SEAL_TOKEN = vault_token.seal.client_token
|
|
}
|
|
|
|
type = "Opaque"
|
|
}
|
|
|
|
output "workflow_role_id" {
|
|
description = "Vault transit workflow AppRole role_id."
|
|
value = vault_approle_auth_backend_role.workflow.role_id
|
|
}
|
|
|
|
output "workflow_secret_id" {
|
|
description = "Vault transit workflow AppRole secret_id."
|
|
value = vault_approle_auth_backend_role_secret_id.workflow.secret_id
|
|
sensitive = true
|
|
}
|
|
|
|
output "vault_transit_seal_token" {
|
|
description = "Periodic seal token written into the vault-transit-seal Kubernetes Secret."
|
|
value = vault_token.seal.client_token
|
|
sensitive = true
|
|
}
|