unkin-agent
78ba0011f9
Configure the arrstack Vault secrets engine (backend config + roles) from terraform-vault, matching the schema declared in terraform-vault #127. - Add terraform-plugin-framework provider (local name arrstack) authenticating to Vault/OpenBao via address + token (VAULT_ADDR/VAULT_TOKEN fallback). - Add arrstack_secret_backend resource: mounts the engine and writes <mount>/config. - Add arrstack_secret_backend_role resource: manages <mount>/roles/<name>. - Add Vault client, conversions, unit tests, Makefile, woodpecker CI + tag release to artifactapi terraform-unkin, examples, and README.
27 lines
624 B
Terraform
27 lines
624 B
Terraform
terraform {
|
|
required_providers {
|
|
arrstack = {
|
|
source = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "arrstack" {
|
|
# address / token fall back to VAULT_ADDR / VAULT_TOKEN.
|
|
}
|
|
|
|
# Mount the arrstack secrets engine and seed it with the arrproxy admin token.
|
|
resource "arrstack_secret_backend" "arrstack" {
|
|
path = "arrstack"
|
|
base_url = "https://arrstack.unkin.net"
|
|
|
|
admin_token = var.arrproxy_admin_token # e.g. sourced from vault_kv_secret_v2
|
|
|
|
request_timeout_seconds = 30
|
|
}
|
|
|
|
variable "arrproxy_admin_token" {
|
|
type = string
|
|
sensitive = true
|
|
}
|