unkinben
f56bb6be29
A terraform-plugin-framework provider for the vault-plugin-secrets-gpg engine, managing engine mounts and OpenPGP keys on Vault/OpenBao. - gpg_secret_backend resource: mount the engine (+ optional plugin catalog registration when a sha256 is given; deregisters on destroy). - gpg_key resource: create/configure a key (algorithm, identity, exportable, deletion_allowed, min_decryption_version); computed public_key/fingerprint/ key_id/latest_version; destroy auto-enables deletion; import <backend>/<name>. - gpg_key data source: read a key's metadata + armored public key. - Talks to Vault/OpenBao via hashicorp/vault/api; address/token fall back to VAULT_ADDR/VAULT_TOKEN. Unit tests plus an e2e running real terraform apply/destroy against a Vault dev server + the gpg plugin. Release publishes a zip to the artifactapi terraform-unkin registry on v* tags.
103 lines
3.0 KiB
Go
103 lines
3.0 KiB
Go
package provider
|
|
|
|
import (
|
|
"context"
|
|
"os"
|
|
|
|
"github.com/hashicorp/terraform-plugin-framework/datasource"
|
|
"github.com/hashicorp/terraform-plugin-framework/provider"
|
|
"github.com/hashicorp/terraform-plugin-framework/provider/schema"
|
|
"github.com/hashicorp/terraform-plugin-framework/resource"
|
|
"github.com/hashicorp/terraform-plugin-framework/types"
|
|
)
|
|
|
|
var _ provider.Provider = &gpgProvider{}
|
|
|
|
type gpgProvider struct {
|
|
version string
|
|
}
|
|
|
|
type gpgProviderModel struct {
|
|
Address types.String `tfsdk:"address"`
|
|
Token types.String `tfsdk:"token"`
|
|
}
|
|
|
|
func New(version string) func() provider.Provider {
|
|
return func() provider.Provider {
|
|
return &gpgProvider{version: version}
|
|
}
|
|
}
|
|
|
|
func (p *gpgProvider) Metadata(_ context.Context, _ provider.MetadataRequest, resp *provider.MetadataResponse) {
|
|
// The provider's source address is git.unkin.net/unkin/gpgvaultsecret, but
|
|
// its resources are prefixed "gpg_" (declare it in required_providers under
|
|
// the local name "gpg"), mirroring how google-beta ships google_*.
|
|
resp.TypeName = "gpg"
|
|
resp.Version = p.version
|
|
}
|
|
|
|
func (p *gpgProvider) Schema(_ context.Context, _ provider.SchemaRequest, resp *provider.SchemaResponse) {
|
|
resp.Schema = schema.Schema{
|
|
Description: "Manage the vault-plugin-secrets-gpg engine — mounts and OpenPGP keys — on HashiCorp Vault or OpenBao.",
|
|
Attributes: map[string]schema.Attribute{
|
|
"address": schema.StringAttribute{
|
|
Description: "Address of the Vault/OpenBao server. Falls back to the VAULT_ADDR environment variable.",
|
|
Optional: true,
|
|
},
|
|
"token": schema.StringAttribute{
|
|
Description: "Token used to authenticate to Vault/OpenBao. Falls back to the VAULT_TOKEN environment variable.",
|
|
Optional: true,
|
|
Sensitive: true,
|
|
},
|
|
},
|
|
}
|
|
}
|
|
|
|
func (p *gpgProvider) Configure(ctx context.Context, req provider.ConfigureRequest, resp *provider.ConfigureResponse) {
|
|
var config gpgProviderModel
|
|
resp.Diagnostics.Append(req.Config.Get(ctx, &config)...)
|
|
if resp.Diagnostics.HasError() {
|
|
return
|
|
}
|
|
|
|
address := os.Getenv("VAULT_ADDR")
|
|
if !config.Address.IsNull() && config.Address.ValueString() != "" {
|
|
address = config.Address.ValueString()
|
|
}
|
|
|
|
token := os.Getenv("VAULT_TOKEN")
|
|
if !config.Token.IsNull() && config.Token.ValueString() != "" {
|
|
token = config.Token.ValueString()
|
|
}
|
|
|
|
if address == "" {
|
|
resp.Diagnostics.AddError(
|
|
"missing Vault address",
|
|
"Set the provider \"address\" attribute or the VAULT_ADDR environment variable.",
|
|
)
|
|
return
|
|
}
|
|
|
|
client, err := newVaultClient(address, token)
|
|
if err != nil {
|
|
resp.Diagnostics.AddError("failed to create Vault client", err.Error())
|
|
return
|
|
}
|
|
|
|
resp.DataSourceData = client
|
|
resp.ResourceData = client
|
|
}
|
|
|
|
func (p *gpgProvider) Resources(_ context.Context) []func() resource.Resource {
|
|
return []func() resource.Resource{
|
|
NewSecretBackendResource,
|
|
NewKeyResource,
|
|
}
|
|
}
|
|
|
|
func (p *gpgProvider) DataSources(_ context.Context) []func() datasource.DataSource {
|
|
return []func() datasource.DataSource{
|
|
NewKeyDataSource,
|
|
}
|
|
}
|