unkinben
f56bb6be29
A terraform-plugin-framework provider for the vault-plugin-secrets-gpg engine, managing engine mounts and OpenPGP keys on Vault/OpenBao. - gpg_secret_backend resource: mount the engine (+ optional plugin catalog registration when a sha256 is given; deregisters on destroy). - gpg_key resource: create/configure a key (algorithm, identity, exportable, deletion_allowed, min_decryption_version); computed public_key/fingerprint/ key_id/latest_version; destroy auto-enables deletion; import <backend>/<name>. - gpg_key data source: read a key's metadata + armored public key. - Talks to Vault/OpenBao via hashicorp/vault/api; address/token fall back to VAULT_ADDR/VAULT_TOKEN. Unit tests plus an e2e running real terraform apply/destroy against a Vault dev server + the gpg plugin. Release publishes a zip to the artifactapi terraform-unkin registry on v* tags.
45 lines
1.1 KiB
Terraform
45 lines
1.1 KiB
Terraform
terraform {
|
|
required_providers {
|
|
gpg = {
|
|
source = "git.unkin.net/unkin/gpgvaultsecret"
|
|
}
|
|
}
|
|
}
|
|
|
|
variable "address" { type = string }
|
|
variable "token" { type = string }
|
|
variable "plugin_sha256" { type = string }
|
|
|
|
provider "gpg" {
|
|
address = var.address
|
|
token = var.token
|
|
}
|
|
|
|
# Register the plugin in the catalog (sha256) and mount the engine at gpg/.
|
|
resource "gpg_secret_backend" "gpg" {
|
|
path = "gpg"
|
|
sha256 = var.plugin_sha256
|
|
description = "GPG/OpenPGP secrets engine"
|
|
}
|
|
|
|
# A managed key.
|
|
resource "gpg_key" "app" {
|
|
backend = gpg_secret_backend.gpg.path
|
|
name = "app"
|
|
algorithm = "rsa-2048"
|
|
identity = "App <app@unkin.net>"
|
|
exportable = false
|
|
}
|
|
|
|
# Read it back via the data source.
|
|
data "gpg_key" "app" {
|
|
backend = gpg_secret_backend.gpg.path
|
|
name = gpg_key.app.name
|
|
depends_on = [gpg_key.app]
|
|
}
|
|
|
|
output "resource_fingerprint" { value = gpg_key.app.fingerprint }
|
|
output "resource_public_key" { value = gpg_key.app.public_key }
|
|
output "data_public_key" { value = data.gpg_key.app.public_key }
|
|
output "latest_version" { value = gpg_key.app.latest_version }
|