diff --git a/.gitignore b/.gitignore index 64b3492..ae4a6bd 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ .terraform .terraform.lock.hcl env +.terragrunt-cache diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index f0719ae..9d38d4b 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,4 +1,11 @@ repos: + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v4.4.0 + hooks: + - id: end-of-file-fixer + types: [yaml] + - id: trailing-whitespace + types: [yaml] - repo: https://github.com/gruntwork-io/pre-commit rev: v0.1.30 hooks: diff --git a/Makefile b/Makefile index 6516722..69ca190 100644 --- a/Makefile +++ b/Makefile @@ -1,20 +1,29 @@ -.PHONY: init plan apply help +.PHONY: init plan apply format + +#init: +# @echo "Sourcing environment and initializing Terraform..." +# @source ./env && terraform init +# +#plan: +# @echo "Sourcing environment and planning Terraform changes..." +# @source ./env && terraform plan +# +#apply: +# @echo "Sourcing environment and applying Terraform changes..." +# @source ./env && terraform apply -auto-approve -# Default target -help: - @echo "Available targets:" - @echo " init - Initialize Terraform" - @echo " plan - Plan Terraform changes" - @echo " apply - Apply Terraform changes" init: - @echo "Sourcing environment and initializing Terraform..." - @source ./env && terraform init + @terragrunt run --all --non-interactive init -- -upgrade -plan: - @echo "Sourcing environment and planning Terraform changes..." - @source ./env && terraform plan +plan: init + @terragrunt run --all --parallelism 4 --non-interactive plan -apply: - @echo "Sourcing environment and applying Terraform changes..." - @source ./env && terraform apply -auto-approve \ No newline at end of file +apply: init + @terragrunt run --all --parallelism 2 --non-interactive apply + +format: + @echo "Formatting Terraform files..." + @terraform fmt -recursive . + @echo "Formatting Terragrunt files..." + @terragrunt hcl fmt diff --git a/auth_approle_certmanager.tf b/auth_approle_certmanager.tf deleted file mode 100644 index bcc6e14..0000000 --- a/auth_approle_certmanager.tf +++ /dev/null @@ -1,15 +0,0 @@ -resource "vault_approle_auth_backend_role" "certmanager" { - role_name = "certmanager" - bind_secret_id = false - token_policies = ["pki_int/certmanager"] - token_ttl = 30 - token_max_ttl = 30 - token_bound_cidrs = [ - "198.18.25.5/32", # ausyd1nxvm2052.main.unkin.net - "198.18.26.3/32", # ausyd1nxvm2053.main.unkin.net - "198.18.27.89/32", # ausyd1nxvm2054.main.unkin.net - "198.18.28.8/32", # ausyd1nxvm2055.main.unkin.net - "198.18.29.33/32", # ausyd1nxvm2056.main.unkin.net - "198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net - ] -} diff --git a/auth_approle_incus_cluster.tf b/auth_approle_incus_cluster.tf deleted file mode 100644 index 548ff88..0000000 --- a/auth_approle_incus_cluster.tf +++ /dev/null @@ -1,16 +0,0 @@ -resource "vault_approle_auth_backend_role" "incus_cluster" { - role_name = "incus_cluster" - bind_secret_id = false - token_policies = [ - "default_access", - "kv/service/incus/incus-cluster-join-tokens" - ] - token_ttl = 60 - token_max_ttl = 120 - token_bound_cidrs = [ - "10.10.12.200/32", - "198.18.13.77/32", - "198.18.13.78/32", - "198.18.13.79/32" - ] -} diff --git a/auth_approle_packer_builder.tf b/auth_approle_packer_builder.tf deleted file mode 100644 index 7095183..0000000 --- a/auth_approle_packer_builder.tf +++ /dev/null @@ -1,16 +0,0 @@ -resource "vault_approle_auth_backend_role" "packer_builder" { - role_name = "packer_builder" - bind_secret_id = false - token_policies = [ - "default_access", - "kv/service/packer/packer_builder", - ] - token_ttl = 300 # builds can take a few minutes - token_max_ttl = 600 - token_bound_cidrs = [ - "10.10.12.200/32", - "198.18.25.102/32", - "198.18.26.91/32", - "198.18.27.40/32", - ] -} diff --git a/auth_approle_puppetapi.tf b/auth_approle_puppetapi.tf deleted file mode 100644 index 1b67c85..0000000 --- a/auth_approle_puppetapi.tf +++ /dev/null @@ -1,15 +0,0 @@ -resource "vault_approle_auth_backend_role" "puppetapi" { - role_name = "puppetapi" - bind_secret_id = false - token_policies = ["kv/service/puppetapi/puppetapi_read_tokens"] - token_ttl = 30 - token_max_ttl = 30 - token_bound_cidrs = [ - "198.18.25.5/32", # ausyd1nxvm2052.main.unkin.net - "198.18.26.3/32", # ausyd1nxvm2053.main.unkin.net - "198.18.27.89/32", # ausyd1nxvm2054.main.unkin.net - "198.18.28.8/32", # ausyd1nxvm2055.main.unkin.net - "198.18.29.33/32", # ausyd1nxvm2056.main.unkin.net - "198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net - ] -} diff --git a/auth_approle_rpmbuilder.tf b/auth_approle_rpmbuilder.tf deleted file mode 100644 index 609189c..0000000 --- a/auth_approle_rpmbuilder.tf +++ /dev/null @@ -1,16 +0,0 @@ -resource "vault_approle_auth_backend_role" "rpmbuilder" { - role_name = "rpmbuilder" - bind_secret_id = false - token_policies = [ - "kv/service/github/neoloc/tokens/read-only-token/read", - "kv/service/gitea/unkinben/tokens/read-only-packages/read", - ] - token_ttl = 30 - token_max_ttl = 30 - token_bound_cidrs = [ - "10.10.12.200/32", - "198.18.25.102/32", - "198.18.26.91/32", - "198.18.27.40/32", - ] -} diff --git a/auth_approle_rundeck-role.tf b/auth_approle_rundeck-role.tf deleted file mode 100644 index 35d3c0e..0000000 --- a/auth_approle_rundeck-role.tf +++ /dev/null @@ -1,9 +0,0 @@ -resource "vault_approle_auth_backend_role" "rundeck-role" { - role_name = "rundeck-role" - bind_secret_id = true - token_policies = ["rundeck/rundeck"] - token_ttl = 1 * 3600 - token_max_ttl = 4 * 3600 - token_bound_cidrs = ["198.18.13.59/32"] - secret_id_bound_cidrs = ["198.18.13.59/32"] -} diff --git a/auth_approle_sshsign-host-role.tf b/auth_approle_sshsign-host-role.tf deleted file mode 100644 index 090b961..0000000 --- a/auth_approle_sshsign-host-role.tf +++ /dev/null @@ -1,15 +0,0 @@ -resource "vault_approle_auth_backend_role" "sshsign-host-role" { - role_name = "sshsign-host-role" - bind_secret_id = false - token_policies = ["ssh-host-signer/sshsign-host-policy"] - token_ttl = 30 - token_max_ttl = 30 - token_bound_cidrs = [ - "198.18.25.5/32", # ausyd1nxvm2052.main.unkin.net - "198.18.26.3/32", # ausyd1nxvm2053.main.unkin.net - "198.18.27.89/32", # ausyd1nxvm2054.main.unkin.net - "198.18.28.8/32", # ausyd1nxvm2055.main.unkin.net - "198.18.29.33/32", # ausyd1nxvm2056.main.unkin.net - "198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net - ] -} diff --git a/auth_approle_sshsigner.tf b/auth_approle_sshsigner.tf deleted file mode 100644 index af32e62..0000000 --- a/auth_approle_sshsigner.tf +++ /dev/null @@ -1,18 +0,0 @@ -resource "vault_approle_auth_backend_role" "sshsigner" { - role_name = "sshsigner" - bind_secret_id = false - token_policies = [ - "ssh-host-signer/sshsigner", - "sshca_signhost" - ] - token_ttl = 30 - token_max_ttl = 30 - token_bound_cidrs = [ - "198.18.25.5/32", # ausyd1nxvm2052.main.unkin.net - "198.18.26.3/32", # ausyd1nxvm2053.main.unkin.net - "198.18.27.89/32", # ausyd1nxvm2054.main.unkin.net - "198.18.28.8/32", # ausyd1nxvm2055.main.unkin.net - "198.18.29.33/32", # ausyd1nxvm2056.main.unkin.net - "198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net - ] -} diff --git a/auth_approle_terraform_incus.tf b/auth_approle_terraform_incus.tf deleted file mode 100644 index fae226d..0000000 --- a/auth_approle_terraform_incus.tf +++ /dev/null @@ -1,17 +0,0 @@ -resource "vault_approle_auth_backend_role" "terraform_incus" { - role_name = "terraform_incus" - bind_secret_id = false - token_policies = [ - "default_access", - "kv/service/terraform/incus", - "kv/service/puppet/certificates/terraform_puppet_cert", - ] - token_ttl = 60 - token_max_ttl = 120 - token_bound_cidrs = [ - "10.10.12.200/32", - "198.18.25.102/32", - "198.18.26.91/32", - "198.18.27.40/32", - ] -} diff --git a/auth_approle_terraform_nomad.tf b/auth_approle_terraform_nomad.tf deleted file mode 100644 index 8d8aa9d..0000000 --- a/auth_approle_terraform_nomad.tf +++ /dev/null @@ -1,16 +0,0 @@ -resource "vault_approle_auth_backend_role" "terraform_nomad" { - role_name = "terraform_nomad" - bind_secret_id = false - token_policies = [ - "default_access", - "kv/service/terraform/nomad", - ] - token_ttl = 60 - token_max_ttl = 120 - token_bound_cidrs = [ - "10.10.12.200/32", - "198.18.25.102/32", - "198.18.26.91/32", - "198.18.27.40/32", - ] -} diff --git a/auth_approle_terraform_repoflow.tf b/auth_approle_terraform_repoflow.tf deleted file mode 100644 index 96b7176..0000000 --- a/auth_approle_terraform_repoflow.tf +++ /dev/null @@ -1,17 +0,0 @@ -resource "vault_approle_auth_backend_role" "terraform_repoflow" { - role_name = "terraform_repoflow" - bind_secret_id = false - token_policies = [ - "default_access", - "kv/service/repoflow/unkinadmin/tokens/terraform/read", - "kv/service/terraform/repoflow", - ] - token_ttl = 60 - token_max_ttl = 120 - token_bound_cidrs = [ - "10.10.12.200/32", - "198.18.25.102/32", - "198.18.26.91/32", - "198.18.27.40/32", - ] -} diff --git a/auth_approle_tf_vault.tf b/auth_approle_tf_vault.tf deleted file mode 100644 index 3e3c542..0000000 --- a/auth_approle_tf_vault.tf +++ /dev/null @@ -1,33 +0,0 @@ -resource "vault_approle_auth_backend_role" "tf_vault" { - role_name = "tf_vault" - bind_secret_id = false - token_policies = [ - "default_access", - "approle_token_create", - "auth/approle/approle_role_admin", - "auth/approle/approle_role_login", - "auth/kubernetes/k8s_auth_admin", - "auth/ldap/ldap_admin", - "auth/token/auth_token_create", - "auth/token/auth_token_self", - "auth/token/auth_token_roles_admin", - "kubernetes/au/config_admin", - "kubernetes/au/roles_admin", - "kv/service/glauth/services/svc_vault_read", - "kv/service/kubernetes/au/syd1/token_reviewer_jwt/read", - "kv/service/kubernetes/au/syd1/service_account_jwt/read", - "pki_int/pki_int_roles_admin", - "pki_root/pki_root_roles_admin", - "ssh-host-signer/ssh-host-signer_roles_admin", - "sshca/sshca_roles_admin", - "sys/sys_auth_admin", - "sys/sys_mounts_admin", - "sys/sys_policy_admin", - "transit/keys/admin", - ] - token_ttl = 60 - token_max_ttl = 120 - token_bound_cidrs = [ - "10.10.12.200/32", - ] -} diff --git a/auth_backend_approle.tf b/auth_backend_approle.tf deleted file mode 100644 index 7c8412d..0000000 --- a/auth_backend_approle.tf +++ /dev/null @@ -1,7 +0,0 @@ -#---------------------------- -# Enable approle auth method -#---------------------------- -resource "vault_auth_backend" "approle" { - type = "approle" - path = "approle" -} diff --git a/auth_backend_kubernetes.tf b/auth_backend_kubernetes.tf deleted file mode 100644 index 2b720a2..0000000 --- a/auth_backend_kubernetes.tf +++ /dev/null @@ -1,23 +0,0 @@ -#----------------------------------- -# Enable kubernetes auth method -#----------------------------------- -resource "vault_auth_backend" "kubernetes" { - type = "kubernetes" - path = "kubernetes" -} - -# Data source to read the token_reviewer_jwt from Vault KV -data "vault_kv_secret_v2" "token_reviewer_jwt_au_syd1" { - mount = "kv" - name = "service/kubernetes/au/syd1/token_reviewer_jwt" -} - -# Configure Kubernetes auth backend -resource "vault_kubernetes_auth_backend_config" "config" { - backend = vault_auth_backend.kubernetes.path - kubernetes_host = "https://api-k8s.service.consul:6443" - kubernetes_ca_cert = local.kubernetes_ca_cert_au_syd1 - token_reviewer_jwt = data.vault_kv_secret_v2.token_reviewer_jwt_au_syd1.data["token"] - disable_iss_validation = true - use_annotations_as_alias_metadata = true -} diff --git a/auth_backend_ldap.tf b/auth_backend_ldap.tf deleted file mode 100644 index b732dcf..0000000 --- a/auth_backend_ldap.tf +++ /dev/null @@ -1,40 +0,0 @@ -#-------------------------------- -# Enable ldap auth method -#-------------------------------- - -# retrieve the bindpass from Vault -data "vault_generic_secret" "svc_vault" { - path = "kv/service/glauth/services/svc_vault" -} - -# create the ldap backend -resource "vault_ldap_auth_backend" "ldap" { - path = "ldap" - url = "ldap://ldap.service.consul" - userdn = "ou=people,ou=users,dc=main,dc=unkin,dc=net" - userattr = "uid" - upndomain = "users.main.unkin.net" - discoverdn = false - groupdn = "ou=users,dc=main,dc=unkin,dc=net" - groupfilter = "(&(objectClass=posixGroup)(memberUid={{.Username}}))" - groupattr = "uid" - binddn = data.vault_generic_secret.svc_vault.data["distinguishedName"] - bindpass = data.vault_generic_secret.svc_vault.data["pass"] -} - -resource "vault_ldap_auth_backend_group" "vault_access" { - groupname = "vault_access" - policies = [ - "default_access", - ] - backend = vault_ldap_auth_backend.ldap.path -} - -resource "vault_ldap_auth_backend_group" "vault_admin" { - groupname = "vault_admin" - policies = [ - "default_access", - "global-admin", - ] - backend = vault_ldap_auth_backend.ldap.path -} diff --git a/auth_kubernetes_roles.tf b/auth_kubernetes_roles.tf deleted file mode 100644 index d4edeac..0000000 --- a/auth_kubernetes_roles.tf +++ /dev/null @@ -1,117 +0,0 @@ -resource "vault_kubernetes_auth_backend_role" "default" { - backend = vault_auth_backend.kubernetes.path - role_name = "default" - bound_service_account_names = ["default"] - bound_service_account_namespaces = ["*"] - token_ttl = 3600 - token_policies = [ - "default" - ] - audience = "vault" -} - -resource "vault_kubernetes_auth_backend_role" "demo_default" { - backend = vault_auth_backend.kubernetes.path - role_name = "demo_default" - bound_service_account_names = ["default"] - bound_service_account_namespaces = ["demo"] - token_ttl = 60 - token_policies = [ - "kv/service/terraform/nomad" - ] - audience = "vault" -} - -resource "vault_kubernetes_auth_backend_role" "huntarr-default" { - backend = vault_auth_backend.kubernetes.path - role_name = "huntarr-default" - bound_service_account_names = ["default"] - bound_service_account_namespaces = ["huntarr"] - token_ttl = 60 - token_policies = [ - "pki_int/sign/servers_default", - "pki_int/issue/servers_default", - ] - audience = "vault" -} - -resource "vault_kubernetes_auth_backend_role" "externaldns" { - backend = vault_auth_backend.kubernetes.path - role_name = "externaldns" - bound_service_account_names = ["externaldns"] - bound_service_account_namespaces = ["externaldns"] - token_ttl = 60 - token_policies = [ - "kv/service/kubernetes/au/syd1/externaldns/tsig/read", - ] - audience = "vault" -} - -resource "vault_kubernetes_auth_backend_role" "cert_manager_issuer" { - backend = vault_auth_backend.kubernetes.path - role_name = "cert-manager-issuer" - bound_service_account_names = ["cert-manager-vault-issuer"] - bound_service_account_namespaces = ["cert-manager"] - token_ttl = 60 - token_policies = [ - "pki_int/sign/servers_default", - "pki_int/issue/servers_default", - ] - audience = "vault" -} - -resource "vault_kubernetes_auth_backend_role" "ceph-csi" { - backend = vault_auth_backend.kubernetes.path - role_name = "ceph-csi" - bound_service_account_names = [ - "ceph-csi-rbd-csi-rbd-provisioner", - "ceph-csi-cephfs-csi-cephfs-provisioner", - ] - bound_service_account_namespaces = [ - "csi-cephrbd", - "csi-cephfs", - ] - token_ttl = 60 - token_policies = [ - "kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read", - "kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read", - ] - audience = "vault" -} - -resource "vault_kubernetes_auth_backend_role" "media-apps" { - backend = vault_auth_backend.kubernetes.path - role_name = "media-apps" - bound_service_account_names = [ - "media-apps-vault-reader", - ] - bound_service_account_namespaces = [ - "media-apps", - ] - token_ttl = 60 - token_policies = [ - "kv/service/media-apps/radarr/read", - "kv/service/media-apps/sonarr/read", - ] - audience = "vault" -} - -resource "vault_kubernetes_auth_backend_role" "repoflow" { - backend = vault_auth_backend.kubernetes.path - role_name = "repoflow" - bound_service_account_names = [ - "default", - ] - bound_service_account_namespaces = [ - "repoflow", - ] - token_ttl = 60 - token_policies = [ - "kv/service/repoflow/au/syd1/ceph-s3/read", - "kv/service/repoflow/au/syd1/elasticsearch/read", - "kv/service/repoflow/au/syd1/hasura/read", - "kv/service/repoflow/au/syd1/postgres/read", - "kv/service/repoflow/au/syd1/repoflow-server/read", - ] - audience = "vault" -} diff --git a/config/auth_approle_backend/approle.yaml b/config/auth_approle_backend/approle.yaml new file mode 100644 index 0000000..128d2ea --- /dev/null +++ b/config/auth_approle_backend/approle.yaml @@ -0,0 +1,2 @@ +default_lease_ttl: 60s +max_lease_ttl: 24h diff --git a/config/auth_approle_role/approle/certmanager.yaml b/config/auth_approle_role/approle/certmanager.yaml new file mode 100644 index 0000000..0e7ec68 --- /dev/null +++ b/config/auth_approle_role/approle/certmanager.yaml @@ -0,0 +1,13 @@ +token_policies: + - "pki_int/certmanager" +token_ttl: 30 +token_max_ttl: 30 +bind_secret_id: false +token_bound_cidrs: + - "198.18.25.5/32" + - "198.18.26.3/32" + - "198.18.27.89/32" + - "198.18.28.8/32" + - "198.18.29.33/32" + - "198.18.29.239/32" +use_deterministic_role_id: false diff --git a/config/auth_approle_role/approle/incus_cluster.yaml b/config/auth_approle_role/approle/incus_cluster.yaml new file mode 100644 index 0000000..57f1ae5 --- /dev/null +++ b/config/auth_approle_role/approle/incus_cluster.yaml @@ -0,0 +1,12 @@ +token_policies: + - "default_access" + - "kv/service/incus/incus-cluster-join-tokens" +token_ttl: 60 +token_max_ttl: 120 +bind_secret_id: false +token_bound_cidrs: + - "10.10.12.200/32" + - "198.18.13.77/32" + - "198.18.13.78/32" + - "198.18.13.79/32" +use_deterministic_role_id: false diff --git a/config/auth_approle_role/approle/packer_builder.yaml b/config/auth_approle_role/approle/packer_builder.yaml new file mode 100644 index 0000000..b75cceb --- /dev/null +++ b/config/auth_approle_role/approle/packer_builder.yaml @@ -0,0 +1,12 @@ +token_policies: + - "default_access" + - "kv/service/packer/packer_builder" +token_ttl: 300 +token_max_ttl: 600 +bind_secret_id: false +token_bound_cidrs: + - "10.10.12.200/32" + - "198.18.25.102/32" + - "198.18.26.91/32" + - "198.18.27.40/32" +use_deterministic_role_id: false diff --git a/config/auth_approle_role/approle/puppetapi.yaml b/config/auth_approle_role/approle/puppetapi.yaml new file mode 100644 index 0000000..d58dfe6 --- /dev/null +++ b/config/auth_approle_role/approle/puppetapi.yaml @@ -0,0 +1,13 @@ +token_policies: + - "kv/service/puppetapi/puppetapi_read_tokens" +token_ttl: 30 +token_max_ttl: 30 +bind_secret_id: false +token_bound_cidrs: + - "198.18.25.5/32" + - "198.18.26.3/32" + - "198.18.27.89/32" + - "198.18.28.8/32" + - "198.18.29.33/32" + - "198.18.29.239/32" +use_deterministic_role_id: false diff --git a/config/auth_approle_role/approle/rpmbuilder.yaml b/config/auth_approle_role/approle/rpmbuilder.yaml new file mode 100644 index 0000000..9a6b498 --- /dev/null +++ b/config/auth_approle_role/approle/rpmbuilder.yaml @@ -0,0 +1,12 @@ +token_policies: + - "kv/service/github/neoloc/tokens/read-only-token/read" + - "kv/service/gitea/unkinben/tokens/read-only-packages/read" +token_ttl: 30 +token_max_ttl: 30 +bind_secret_id: false +token_bound_cidrs: + - "10.10.12.200/32" + - "198.18.25.102/32" + - "198.18.26.91/32" + - "198.18.27.40/32" +use_deterministic_role_id: false diff --git a/config/auth_approle_role/approle/rundeck-role.yaml b/config/auth_approle_role/approle/rundeck-role.yaml new file mode 100644 index 0000000..76fd259 --- /dev/null +++ b/config/auth_approle_role/approle/rundeck-role.yaml @@ -0,0 +1,8 @@ +token_policies: + - "rundeck/rundeck" +token_ttl: 3600 +token_max_ttl: 14400 +bind_secret_id: true +token_bound_cidrs: + - "198.18.13.59/32" +use_deterministic_role_id: false diff --git a/config/auth_approle_role/approle/sshsigner.yaml b/config/auth_approle_role/approle/sshsigner.yaml new file mode 100644 index 0000000..4fa774d --- /dev/null +++ b/config/auth_approle_role/approle/sshsigner.yaml @@ -0,0 +1,14 @@ +token_policies: + - "ssh-host-signer/sshsigner" + - "sshca_signhost" +token_ttl: 30 +token_max_ttl: 30 +bind_secret_id: false +token_bound_cidrs: + - "198.18.25.5/32" + - "198.18.26.3/32" + - "198.18.27.89/32" + - "198.18.28.8/32" + - "198.18.29.33/32" + - "198.18.29.239/32" +use_deterministic_role_id: false diff --git a/config/auth_approle_role/approle/terraform_incus.yaml b/config/auth_approle_role/approle/terraform_incus.yaml new file mode 100644 index 0000000..fdd409b --- /dev/null +++ b/config/auth_approle_role/approle/terraform_incus.yaml @@ -0,0 +1,13 @@ +token_policies: + - "default_access" + - "kv/service/terraform/incus" + - "kv/service/puppet/certificates/terraform_puppet_cert" +token_ttl: 60 +token_max_ttl: 120 +bind_secret_id: false +token_bound_cidrs: + - "10.10.12.200/32" + - "198.18.25.102/32" + - "198.18.26.91/32" + - "198.18.27.40/32" +use_deterministic_role_id: false diff --git a/config/auth_approle_role/approle/terraform_nomad.yaml b/config/auth_approle_role/approle/terraform_nomad.yaml new file mode 100644 index 0000000..ff85b2b --- /dev/null +++ b/config/auth_approle_role/approle/terraform_nomad.yaml @@ -0,0 +1,12 @@ +token_policies: + - "default_access" + - "kv/service/terraform/nomad" +token_ttl: 60 +token_max_ttl: 120 +bind_secret_id: false +token_bound_cidrs: + - "10.10.12.200/32" + - "198.18.25.102/32" + - "198.18.26.91/32" + - "198.18.27.40/32" +use_deterministic_role_id: false diff --git a/config/auth_approle_role/approle/terraform_repoflow.yaml b/config/auth_approle_role/approle/terraform_repoflow.yaml new file mode 100644 index 0000000..4d4d7bc --- /dev/null +++ b/config/auth_approle_role/approle/terraform_repoflow.yaml @@ -0,0 +1,13 @@ +token_policies: + - "default_access" + - "kv/service/repoflow/unkinadmin/tokens/terraform/read" + - "kv/service/terraform/repoflow" +token_ttl: 60 +token_max_ttl: 120 +bind_secret_id: false +token_bound_cidrs: + - "10.10.12.200/32" + - "198.18.25.102/32" + - "198.18.26.91/32" + - "198.18.27.40/32" +use_deterministic_role_id: false diff --git a/config/auth_approle_role/approle/tf_vault.yaml b/config/auth_approle_role/approle/tf_vault.yaml new file mode 100644 index 0000000..cf5b647 --- /dev/null +++ b/config/auth_approle_role/approle/tf_vault.yaml @@ -0,0 +1,30 @@ +token_policies: + - "default_access" + - "approle_token_create" + - "auth/approle/approle_role_admin" + - "auth/approle/approle_role_login" + - "auth/kubernetes/k8s_auth_admin" + - "auth/ldap/ldap_admin" + - "auth/token/auth_token_create" + - "auth/token/auth_token_self" + - "auth/token/auth_token_roles_admin" + - "kubernetes/au/config_admin" + - "kubernetes/au/roles_admin" + - "kv/service/glauth/services/svc_vault_read" + - "kv/service/kubernetes/au/syd1/token_reviewer_jwt/read" + - "kv/service/kubernetes/au/syd1/service_account_jwt/read" + - "kv/service/vault/auth_backends_read" + - "pki_int/pki_int_roles_admin" + - "pki_root/pki_root_roles_admin" + - "ssh-host-signer/ssh-host-signer_roles_admin" + - "sshca/sshca_roles_admin" + - "sys/sys_auth_admin" + - "sys/sys_mounts_admin" + - "sys/sys_policy_admin" + - "transit/keys/admin" +token_ttl: 60 +token_max_ttl: 120 +bind_secret_id: false +token_bound_cidrs: + - "10.10.12.200/32" +use_deterministic_role_id: false diff --git a/config/auth_kubernetes_backend/k8s/au/syd1.yaml b/config/auth_kubernetes_backend/k8s/au/syd1.yaml new file mode 100644 index 0000000..55c3135 --- /dev/null +++ b/config/auth_kubernetes_backend/k8s/au/syd1.yaml @@ -0,0 +1,5 @@ +kubernetes_host: https://api-k8s.service.consul:6443 +disable_iss_validation: true +use_annotations_as_alias_metadata: true +default_lease_ttl: 1h +max_lease_ttl: 24h diff --git a/config/auth_kubernetes_role/k8s/au/syd1/ceph-csi.yaml b/config/auth_kubernetes_role/k8s/au/syd1/ceph-csi.yaml new file mode 100644 index 0000000..f9dcb51 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/ceph-csi.yaml @@ -0,0 +1,11 @@ +bound_service_account_names: + - ceph-csi-rbd-csi-rbd-provisioner + - ceph-csi-cephfs-csi-cephfs-provisioner +bound_service_account_namespaces: + - csi-cephrbd + - csi-cephfs +token_ttl: 60 +token_policies: + - kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read + - kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read +audience: vault diff --git a/config/auth_kubernetes_role/k8s/au/syd1/cert_manager_issuer.yaml b/config/auth_kubernetes_role/k8s/au/syd1/cert_manager_issuer.yaml new file mode 100644 index 0000000..0911d28 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/cert_manager_issuer.yaml @@ -0,0 +1,9 @@ +bound_service_account_names: + - cert-manager-vault-issuer +bound_service_account_namespaces: + - cert-manager +token_ttl: 60 +token_policies: + - pki_int/sign/servers_default + - pki_int/issue/servers_default +audience: vault diff --git a/config/auth_kubernetes_role/k8s/au/syd1/externaldns.yaml b/config/auth_kubernetes_role/k8s/au/syd1/externaldns.yaml new file mode 100644 index 0000000..4f1d4c3 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/externaldns.yaml @@ -0,0 +1,8 @@ +bound_service_account_names: + - externaldns +bound_service_account_namespaces: + - externaldns +token_ttl: 60 +token_policies: + - kv/service/kubernetes/au/syd1/externaldns/tsig/read +audience: vault diff --git a/config/auth_kubernetes_role/k8s/au/syd1/huntarr-default.yaml b/config/auth_kubernetes_role/k8s/au/syd1/huntarr-default.yaml new file mode 100644 index 0000000..69bbfa0 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/huntarr-default.yaml @@ -0,0 +1,9 @@ +bound_service_account_names: + - default +bound_service_account_namespaces: + - huntarr +token_ttl: 60 +token_policies: + - pki_int/sign/servers_default + - pki_int/issue/servers_default +audience: vault diff --git a/config/auth_kubernetes_role/k8s/au/syd1/media-apps.yaml b/config/auth_kubernetes_role/k8s/au/syd1/media-apps.yaml new file mode 100644 index 0000000..4fa0429 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/media-apps.yaml @@ -0,0 +1,9 @@ +bound_service_account_names: + - media-apps-vault-reader +bound_service_account_namespaces: + - media-apps +token_ttl: 60 +token_policies: + - kv/service/media-apps/radarr/read + - kv/service/media-apps/sonarr/read +audience: vault diff --git a/config/auth_kubernetes_role/k8s/au/syd1/repoflow.yaml b/config/auth_kubernetes_role/k8s/au/syd1/repoflow.yaml new file mode 100644 index 0000000..4d184b6 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/repoflow.yaml @@ -0,0 +1,12 @@ +bound_service_account_names: + - default +bound_service_account_namespaces: + - repoflow +token_ttl: 60 +token_policies: + - kv/service/repoflow/au/syd1/ceph-s3/read + - kv/service/repoflow/au/syd1/elasticsearch/read + - kv/service/repoflow/au/syd1/hasura/read + - kv/service/repoflow/au/syd1/postgres/read + - kv/service/repoflow/au/syd1/repoflow-server/read +audience: vault diff --git a/config/auth_ldap_backend/ldap.yaml b/config/auth_ldap_backend/ldap.yaml new file mode 100644 index 0000000..2555c98 --- /dev/null +++ b/config/auth_ldap_backend/ldap.yaml @@ -0,0 +1,10 @@ +userdn: "ou=people,ou=users,dc=main,dc=unkin,dc=net" +userattr: "uid" +upndomain: "users.main.unkin.net" +discoverdn: false +groupdn: "ou=users,dc=main,dc=unkin,dc=net" +groupfilter: "(&(objectClass=posixGroup)(memberUid={{.Username}}))" +groupattr: "uid" +username_as_alias: true +default_lease_ttl: 24h +max_lease_ttl: 168h diff --git a/config/auth_ldap_group/ldap/vault_access.yaml b/config/auth_ldap_group/ldap/vault_access.yaml new file mode 100644 index 0000000..e430d1a --- /dev/null +++ b/config/auth_ldap_group/ldap/vault_access.yaml @@ -0,0 +1,2 @@ +policies: + - "default_access" diff --git a/config/auth_ldap_group/ldap/vault_admin.yaml b/config/auth_ldap_group/ldap/vault_admin.yaml new file mode 100644 index 0000000..cd28bf2 --- /dev/null +++ b/config/auth_ldap_group/ldap/vault_admin.yaml @@ -0,0 +1,3 @@ +policies: + - "default_access" + - "global-admin" diff --git a/config/config.hcl b/config/config.hcl new file mode 100644 index 0000000..405d97e --- /dev/null +++ b/config/config.hcl @@ -0,0 +1,189 @@ +# ============================================================================= +# VAULT MODULE CONFIGURATION SYSTEM +# ============================================================================= +# +# This file automatically discovers and organizes YAML configuration files +# for Vault modules, creating structured configuration maps for Terraform. +# +# HOW IT WORKS: +# 1. Scans all subdirectories for *.yaml files +# 2. Groups files by module type based on directory structure +# 3. Creates unique resource keys to prevent naming conflicts +# 4. Adds computed fields like name, backend, etc. from file paths +# +# DIRECTORY STRUCTURE: +# config/ +# ├── auth_approle_role/ +# │ └── approle/ +# │ ├── certmanager.yaml # Creates key: "approle/certmanager" +# │ └── myapp.yaml # Creates key: "approle/myapp" +# ├── auth_kubernetes_role/ +# │ └── k8s/au/syd1/ +# │ ├── default.yaml # Creates key: "k8s/au/syd1/default" +# │ └── myapp.yaml # Creates key: "k8s/au/syd1/myapp" +# └── kv_secret_backend/ +# ├── kv.yaml # Creates key: "kv" +# └── secrets.yaml # Creates key: "secrets" +# +# EXAMPLE YAML FILE (config/auth_approle_role/approle/myapp.yaml): +# ```yaml +# token_ttl: 3600 +# token_max_ttl: 7200 +# bind_secret_id: true +# token_bound_cidrs: +# - "10.0.0.0/8" +# ``` +# +# This becomes: +# ```hcl +# auth_approle_role = { +# "approle/myapp" = { +# approle_name = "myapp" # Auto-computed from filename +# mount_path = "approle" # Auto-computed from directory +# token_ttl = 3600 # From YAML content +# token_max_ttl = 7200 # From YAML content +# bind_secret_id = true # From YAML content +# token_bound_cidrs = ["10.0.0.0/8"] +# } +# } +# ``` +# +# KEY NAMING PATTERNS: +# - Simple backends: filename only (e.g., "kv", "transit") +# - Role-based resources: full path without extension (e.g., "approle/myapp") +# - This ensures uniqueness when multiple backends have similar role names +# +# GENERATED OUTPUTS: +# - config.auth_approle_backend, config.auth_approle_role, etc. +# - Each module gets its own map with properly structured configuration +# +# ============================================================================= + +locals { + # Find all YAML files in subdirectories + config_files = fileset(".", "**/*.yaml") + + # Create a flat map of all files with their content + all_configs = { + for file_path in local.config_files : + file_path => yamldecode(file(file_path)) + } + + # Group by module directory (first part of path) + config = { + auth_approle_backend = { + for file_path, content in local.all_configs : + trimsuffix(basename(file_path), ".yaml") => content + if startswith(file_path, "auth_approle_backend/") + } + auth_approle_role = { + for file_path, content in local.all_configs : + trimsuffix(replace(file_path, "auth_approle_role/", ""), ".yaml") => merge(content, { + approle_name = trimsuffix(basename(file_path), ".yaml") + mount_path = split("/", replace(file_path, "auth_approle_role/", ""))[0] + }) + if startswith(file_path, "auth_approle_role/") + } + auth_ldap_backend = { + for file_path, content in local.all_configs : + trimsuffix(basename(file_path), ".yaml") => content + if startswith(file_path, "auth_ldap_backend/") + } + auth_ldap_group = { + for file_path, content in local.all_configs : + trimsuffix(replace(file_path, "auth_ldap_group/", ""), ".yaml") => merge(content, { + groupname = trimsuffix(basename(file_path), ".yaml") + backend = split("/", replace(file_path, "auth_ldap_group/", ""))[0] + }) + if startswith(file_path, "auth_ldap_group/") + } + auth_kubernetes_backend = { + for file_path, content in local.all_configs : + trimsuffix(replace(file_path, "auth_kubernetes_backend/", ""), ".yaml") => content + if startswith(file_path, "auth_kubernetes_backend/") + } + auth_kubernetes_role = { + for file_path, content in local.all_configs : + trimsuffix(replace(file_path, "auth_kubernetes_role/", ""), ".yaml") => merge(content, { + role_name = trimsuffix(basename(file_path), ".yaml") + backend = dirname(replace(file_path, "auth_kubernetes_role/", "")) + }) + if startswith(file_path, "auth_kubernetes_role/") + } + kv_secret_backend = { + for file_path, content in local.all_configs : + trimsuffix(basename(file_path), ".yaml") => content + if startswith(file_path, "kv_secret_backend/") + } + transit_secret_backend = { + for file_path, content in local.all_configs : + trimsuffix(basename(file_path), ".yaml") => content + if startswith(file_path, "transit_secret_backend/") + } + transit_secret_backend_key = { + for file_path, content in local.all_configs : + trimsuffix(replace(file_path, "transit_secret_backend_key/", ""), ".yaml") => merge(content, { + name = trimsuffix(basename(file_path), ".yaml") + backend = dirname(replace(file_path, "transit_secret_backend_key/", "")) + }) + if startswith(file_path, "transit_secret_backend_key/") + } + ssh_secret_backend = { + for file_path, content in local.all_configs : + trimsuffix(basename(file_path), ".yaml") => content + if startswith(file_path, "ssh_secret_backend/") + } + ssh_secret_backend_role = { + for file_path, content in local.all_configs : + trimsuffix(replace(file_path, "ssh_secret_backend_role/", ""), ".yaml") => merge(content, { + name = trimsuffix(basename(file_path), ".yaml") + backend = dirname(replace(file_path, "ssh_secret_backend_role/", "")) + }) + if startswith(file_path, "ssh_secret_backend_role/") + } + pki_secret_backend = { + for file_path, content in local.all_configs : + trimsuffix(replace(file_path, "pki_secret_backend/", ""), ".yaml") => content + if startswith(file_path, "pki_secret_backend/") + } + pki_secret_backend_role = { + for file_path, content in local.all_configs : + trimsuffix(replace(file_path, "pki_secret_backend_role/", ""), ".yaml") => merge(content, { + name = trimsuffix(basename(file_path), ".yaml") + backend = dirname(replace(file_path, "pki_secret_backend_role/", "")) + }) + if startswith(file_path, "pki_secret_backend_role/") + } + kubernetes_secret_backend = { + for file_path, content in local.all_configs : + trimsuffix(replace(file_path, "kubernetes_secret_backend/", ""), ".yaml") => content + if startswith(file_path, "kubernetes_secret_backend/") + } + kubernetes_secret_backend_role = { + for file_path, content in local.all_configs : + trimsuffix(replace(file_path, "kubernetes_secret_backend_role/", ""), ".yaml") => merge(content, { + name = trimsuffix(basename(file_path), ".yaml") + backend = dirname(replace(file_path, "kubernetes_secret_backend_role/", "")) + }) + if startswith(file_path, "kubernetes_secret_backend_role/") + } + consul_secret_backend = { + for file_path, content in local.all_configs : + trimsuffix(basename(file_path), ".yaml") => content + if startswith(file_path, "consul_secret_backend/") + } + consul_secret_backend_role = { + for file_path, content in local.all_configs : + trimsuffix(replace(file_path, "consul_secret_backend_role/", ""), ".yaml") => merge(content, { + name = trimsuffix(basename(file_path), ".yaml") + backend = dirname(replace(file_path, "consul_secret_backend_role/", "")) + }) + if startswith(file_path, "consul_secret_backend_role/") + } + pki_mount_only = { + for file_path, content in local.all_configs : + trimsuffix(basename(file_path), ".yaml") => content + if startswith(file_path, "pki_mount_only/") + } + } +} \ No newline at end of file diff --git a/config/kubernetes_secret_backend/kubernetes/au/syd1.yaml b/config/kubernetes_secret_backend/kubernetes/au/syd1.yaml new file mode 100644 index 0000000..6c45b6a --- /dev/null +++ b/config/kubernetes_secret_backend/kubernetes/au/syd1.yaml @@ -0,0 +1,5 @@ +description: "kubernetes secret engine for au-syd1 cluster" +default_lease_ttl_seconds: 600 +max_lease_ttl_seconds: 86400 +kubernetes_host: "https://api-k8s.service.consul:6443" +disable_local_ca_jwt: false diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-admin.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-admin.yaml new file mode 100644 index 0000000..0144c62 --- /dev/null +++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-admin.yaml @@ -0,0 +1,5 @@ +backend: "kubernetes/au/syd1" +allowed_kubernetes_namespaces: + - "*" +kubernetes_role_type: "ClusterRole" +extra_labels: {} diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-operator.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-operator.yaml new file mode 100644 index 0000000..0144c62 --- /dev/null +++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-operator.yaml @@ -0,0 +1,5 @@ +backend: "kubernetes/au/syd1" +allowed_kubernetes_namespaces: + - "*" +kubernetes_role_type: "ClusterRole" +extra_labels: {} diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-root.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-root.yaml new file mode 100644 index 0000000..0144c62 --- /dev/null +++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/cluster-root.yaml @@ -0,0 +1,5 @@ +backend: "kubernetes/au/syd1" +allowed_kubernetes_namespaces: + - "*" +kubernetes_role_type: "ClusterRole" +extra_labels: {} diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/media-apps-operator.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/media-apps-operator.yaml new file mode 100644 index 0000000..e4b7130 --- /dev/null +++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/media-apps-operator.yaml @@ -0,0 +1,5 @@ +backend: "kubernetes/au/syd1" +allowed_kubernetes_namespaces: + - "media-apps" +kubernetes_role_type: "Role" +extra_labels: {} diff --git a/config/kv_secret_backend/kv.yaml b/config/kv_secret_backend/kv.yaml new file mode 100644 index 0000000..624cb25 --- /dev/null +++ b/config/kv_secret_backend/kv.yaml @@ -0,0 +1,4 @@ +type: kv-v2 +description: "Key-Value secrets engine" +version: "2" +max_versions: 10 diff --git a/config/kv_secret_backend/rundeck.yaml b/config/kv_secret_backend/rundeck.yaml new file mode 100644 index 0000000..4979e4b --- /dev/null +++ b/config/kv_secret_backend/rundeck.yaml @@ -0,0 +1,4 @@ +type: kv-v2 +description: "Rundeck secrets engine" +version: "2" +max_versions: 5 diff --git a/config/pki_mount_only/pki_int.yaml b/config/pki_mount_only/pki_int.yaml new file mode 100644 index 0000000..b7ab963 --- /dev/null +++ b/config/pki_mount_only/pki_int.yaml @@ -0,0 +1,17 @@ +description: "PKI Intermediate CA" +max_lease_ttl_seconds: 157680000 # 43800 hours * 3600 +issuer_ref: "default" +issuing_certificates: + - "https://vault.service.consul:8200/v1/pki_int/ca" +crl_distribution_points: + - "https://vault.service.consul:8200/v1/pki_int/crl" +ocsp_servers: [] +enable_templating: false +default_issuer_ref: null +default_follows_latest_issuer: false +crl_expiry: "72h" +crl_disable: false +ocsp_disable: false +auto_rebuild: false +enable_delta: false +delta_rebuild_interval: null diff --git a/config/pki_mount_only/pki_root.yaml b/config/pki_mount_only/pki_root.yaml new file mode 100644 index 0000000..499169e --- /dev/null +++ b/config/pki_mount_only/pki_root.yaml @@ -0,0 +1,17 @@ +description: "PKI Root CA" +max_lease_ttl_seconds: 315360000 # 10 years +issuer_ref: "default" +issuing_certificates: + - "https://vault.service.consul:8200/v1/pki_root/ca" +crl_distribution_points: + - "https://vault.service.consul:8200/v1/pki_root/crl" +ocsp_servers: [] +enable_templating: false +default_issuer_ref: null +default_follows_latest_issuer: false +crl_expiry: "72h" +crl_disable: false +ocsp_disable: false +auto_rebuild: false +enable_delta: false +delta_rebuild_interval: null diff --git a/config/pki_secret_backend/pki/au/syd1.yaml b/config/pki_secret_backend/pki/au/syd1.yaml new file mode 100644 index 0000000..fd3c6ef --- /dev/null +++ b/config/pki_secret_backend/pki/au/syd1.yaml @@ -0,0 +1,18 @@ +description: "PKI Root CA AU SYD1" +max_lease_ttl_seconds: 315360000 # 87600 * 3600 +common_name: "unkin.net AU SYD1 Root CA" +issuer_name: "UNKIN_AU_SYD1_ROOTCA_2024" +ttl: 315360000 # 87600 * 3600 +format: "pem" +issuing_certificates: + - "https://vault.service.consul:8200/v1/pki/au/syd1/ca" +crl_distribution_points: + - "https://vault.service.consul:8200/v1/pki/au/syd1/crl" +ocsp_servers: [] +enable_templating: false +default_follows_latest_issuer: false +crl_expiry: "72h" +crl_disable: false +ocsp_disable: false +auto_rebuild: false +enable_delta: false diff --git a/config/pki_secret_backend_role/pki/au/syd1/servers_default.yaml b/config/pki_secret_backend_role/pki/au/syd1/servers_default.yaml new file mode 100644 index 0000000..b742321 --- /dev/null +++ b/config/pki_secret_backend_role/pki/au/syd1/servers_default.yaml @@ -0,0 +1,17 @@ +backend: "pki/au/syd1" +allow_ip_sans: true +allowed_domains: + - "unkin.net" + - "*.unkin.net" + - "localhost" +allow_subdomains: true +allow_glob_domains: true +allow_bare_domains: true +enforce_hostnames: true +allow_any_name: true +max_ttl: 7776000 # 2160 * 3600 +key_bits: 4096 +country: + - "Australia" +use_csr_common_name: true +use_csr_sans: true diff --git a/config/pki_secret_backend_role/pki_int/servers_default.yaml b/config/pki_secret_backend_role/pki_int/servers_default.yaml new file mode 100644 index 0000000..e4f9ff0 --- /dev/null +++ b/config/pki_secret_backend_role/pki_int/servers_default.yaml @@ -0,0 +1,17 @@ +backend: "pki_int" +allow_ip_sans: true +allowed_domains: + - "unkin.net" + - "*.unkin.net" + - "localhost" +allow_subdomains: true +allow_glob_domains: true +allow_bare_domains: true +enforce_hostnames: true +allow_any_name: true +max_ttl: 7776000 # 2160 * 3600 +key_bits: 4096 +country: + - "Australia" +use_csr_common_name: true +use_csr_sans: true diff --git a/config/pki_secret_backend_role/pki_root/2024-servers.yaml b/config/pki_secret_backend_role/pki_root/2024-servers.yaml new file mode 100644 index 0000000..acdb7f1 --- /dev/null +++ b/config/pki_secret_backend_role/pki_root/2024-servers.yaml @@ -0,0 +1,15 @@ +backend: "pki_root" +allow_ip_sans: true +allowed_domains: + - "unkin.net" + - "unkin.local" +allow_subdomains: true +allow_glob_domains: false +allow_bare_domains: true +enforce_hostnames: false +allow_any_name: false +max_ttl: 31536000 # 8760h in seconds +key_bits: 2048 +country: [] +use_csr_common_name: true +use_csr_sans: true diff --git a/config/ssh_secret_backend/sshca.yaml b/config/ssh_secret_backend/sshca.yaml new file mode 100644 index 0000000..158fc5f --- /dev/null +++ b/config/ssh_secret_backend/sshca.yaml @@ -0,0 +1,4 @@ +description: "SSH CA Engine" +max_lease_ttl_seconds: 315360000 # 87600 * 3600 +generate_signing_key: true +key_type: ssh-rsa diff --git a/config/ssh_secret_backend_role/sshca/signhost.yaml b/config/ssh_secret_backend_role/sshca/signhost.yaml new file mode 100644 index 0000000..e3b71b4 --- /dev/null +++ b/config/ssh_secret_backend_role/sshca/signhost.yaml @@ -0,0 +1,8 @@ +key_type: ca +algorithm_signer: rsa-sha2-256 +ttl: 315360000 # 87600 * 3600 +allow_host_certificates: true +allow_user_certificates: false +allowed_domains: "main.unkin.net,consul" +allow_subdomains: true +allow_bare_domains: false diff --git a/config/transit_secret_backend/transit.yaml b/config/transit_secret_backend/transit.yaml new file mode 100644 index 0000000..8d0e898 --- /dev/null +++ b/config/transit_secret_backend/transit.yaml @@ -0,0 +1,3 @@ +description: "Transit Engine" +default_lease_ttl_seconds: 3600 +max_lease_ttl_seconds: 86400 diff --git a/config/transit_secret_backend_key/transit/au-syd1-k8s-vso.yaml b/config/transit_secret_backend_key/transit/au-syd1-k8s-vso.yaml new file mode 100644 index 0000000..71cf0e1 --- /dev/null +++ b/config/transit_secret_backend_key/transit/au-syd1-k8s-vso.yaml @@ -0,0 +1,5 @@ +type: aes256-gcm96 +deletion_allowed: false +derived: false +exportable: false +allow_plaintext_backup: false diff --git a/engine_k8s_au_syd1.tf b/engine_k8s_au_syd1.tf deleted file mode 100644 index 9db2435..0000000 --- a/engine_k8s_au_syd1.tf +++ /dev/null @@ -1,72 +0,0 @@ -# Data source to read the service_token_jwt from Vault KV -data "vault_kv_secret_v2" "service_account_jwt_au_syd1" { - mount = "kv" - name = "service/kubernetes/au/syd1/service_account_jwt" -} - -resource "vault_kubernetes_secret_backend" "kubernetes_au_syd1" { - path = "kubernetes/au/syd1" - description = "kubernetes secret engine for au-syd1 cluster" - default_lease_ttl_seconds = 600 - max_lease_ttl_seconds = 86400 - kubernetes_host = "https://api-k8s.service.consul:6443" - kubernetes_ca_cert = local.kubernetes_ca_cert_au_syd1 - service_account_jwt = data.vault_kv_secret_v2.service_account_jwt_au_syd1.data["token"] - disable_local_ca_jwt = false -} - -resource "vault_kubernetes_secret_backend_role" "media_apps_operator" { - backend = vault_kubernetes_secret_backend.kubernetes_au_syd1.path - name = "vault-media-apps-operator" - allowed_kubernetes_namespaces = ["media-apps"] - kubernetes_role_type = "Role" - - generated_role_rules = file("${path.module}/resources/k8s/syd1/au/generated_role_rules/media-apps-operator.yaml") - - extra_labels = { - vault-region = "au-syd1" - vault-role = "vault-media-apps-operator" - } -} - -resource "vault_kubernetes_secret_backend_role" "cluster_operator" { - backend = vault_kubernetes_secret_backend.kubernetes_au_syd1.path - name = "vault-cluster-operator" - allowed_kubernetes_namespaces = ["*"] - kubernetes_role_type = "ClusterRole" - - generated_role_rules = file("${path.module}/resources/k8s/syd1/au/generated_role_rules/cluster-operator.yaml") - - extra_labels = { - vault-region = "au-syd1" - vault-role = "vault-cluster-operator" - } -} - -resource "vault_kubernetes_secret_backend_role" "cluster_admin" { - backend = vault_kubernetes_secret_backend.kubernetes_au_syd1.path - name = "vault-cluster-admin" - allowed_kubernetes_namespaces = ["*"] - kubernetes_role_type = "ClusterRole" - - generated_role_rules = file("${path.module}/resources/k8s/syd1/au/generated_role_rules/cluster-admin.yaml") - - extra_labels = { - vault-region = "au-syd1" - vault-role = "vault-cluster-admin" - } -} - -resource "vault_kubernetes_secret_backend_role" "cluster_root" { - backend = vault_kubernetes_secret_backend.kubernetes_au_syd1.path - name = "vault-cluster-root" - allowed_kubernetes_namespaces = ["*"] - kubernetes_role_type = "ClusterRole" - - generated_role_rules = file("${path.module}/resources/k8s/syd1/au/generated_role_rules/cluster-root.yaml") - - extra_labels = { - vault-region = "au-syd1" - vault-role = "vault-cluster-root" - } -} diff --git a/engine_kv.tf b/engine_kv.tf deleted file mode 100644 index 5b1f11e..0000000 --- a/engine_kv.tf +++ /dev/null @@ -1,15 +0,0 @@ -#-------------------------------------------------------------- -# kv -# create engine -#-------------------------------------------------------------- -resource "vault_mount" "kv" { - path = "kv" - type = "kv" - listing_visibility = "hidden" - max_lease_ttl_seconds = 0 - external_entropy_access = false - seal_wrap = false - options = { - version = "2" - } -} diff --git a/engine_pki_int.tf b/engine_pki_int.tf deleted file mode 100644 index a2d5a54..0000000 --- a/engine_pki_int.tf +++ /dev/null @@ -1,49 +0,0 @@ -#-------------------------------------------------------------- -# pki_int -# create engine -# generate intermediate csa -# sign the intermediate against rootca -# set the signed intermediate cert in the pki_int engine -#-------------------------------------------------------------- -resource "vault_mount" "pki_int" { - path = "pki_int" - type = "pki" - description = "PKI Intermediate CA" - max_lease_ttl_seconds = 43800 * 3600 # 43800 hours -} - -## Generate the intermediate CSR -#resource "vault_pki_secret_backend_intermediate_cert_request" "pki_int_intermediate" { -# backend = vault_mount.pki_int.path -# common_name = "unkin.net Intermediate Authority" -# format = "pem" -# type = "internal" -#} -# -## Sign the intermediate CSR using the root CA -#resource "vault_generic_endpoint" "pki_root_sign_intermediate" { -# path = "${vault_mount.pki_root.path}/root/sign-intermediate" -# -# data_json = jsonencode({ -# csr = vault_pki_secret_backend_intermediate_cert_request.pki_int_intermediate.csr, -# format = "pem_bundle", -# ttl = "43800h", -# issuer_ref = "UNKIN_ROOTCA_2024" -# }) -#} -# -## Decode the certificate from the response -#locals { -# intermediate_signed_cert = vault_generic_endpoint.pki_root_sign_intermediate.write_data["certificate"] -#} -# -## Set the signed intermediate certificate -#resource "vault_pki_secret_backend_intermediate_set_signed" "pki_int_set_signed" { -# backend = vault_mount.pki_int.path -# certificate = local.intermediate_signed_cert -#} - -#data "vault_pki_secret_backend_issuer" "pki_int_issuer" { -# backend = vault_mount.pki_int.path -# issuer_ref = data.vault_pki_secret_backend_root_cert.root.issuer_id -#} diff --git a/engine_pki_root.tf b/engine_pki_root.tf deleted file mode 100644 index 576fd80..0000000 --- a/engine_pki_root.tf +++ /dev/null @@ -1,39 +0,0 @@ -#------------------------------------------- -# pki_root: -# create engine -# generate rootca certificate -# read the issuer -# configure the pki urls -#------------------------------------------- -resource "vault_mount" "pki_root" { - path = "pki_root" - type = "pki" - description = "PKI Root CA" - max_lease_ttl_seconds = 87600 * 3600 # 87600h -} - -#resource "vault_pki_secret_backend_root_cert" "pki_root_root_cert" { -# backend = vault_mount.pki_root.path -# common_name = "unkin.net" -# issuer_name = "UNKIN_ROOTCA_2024" -# ttl = 87600 * 3600 -# format = "pem" -# type = "internal" -#} -# -#output "root_certificate" { -# value = vault_pki_secret_backend_root_cert.pki_root_root_cert.certificate -# sensitive = true -#} - -data "vault_pki_secret_backend_issuer" "pki_root_issuer" { - backend = vault_mount.pki_root.path - issuer_ref = "default" -} - -resource "vault_pki_secret_backend_config_urls" "pki_root_urls" { - backend = vault_mount.pki_root.path - - issuing_certificates = ["${local.vault_addr}/v1/pki_root/ca"] - crl_distribution_points = ["${local.vault_addr}/v1/pki_root/crl"] -} diff --git a/engine_rundeck.tf b/engine_rundeck.tf deleted file mode 100644 index b368c99..0000000 --- a/engine_rundeck.tf +++ /dev/null @@ -1,14 +0,0 @@ -#-------------------------------------------------------------- -# rundeck -# create engine -#-------------------------------------------------------------- -resource "vault_mount" "rundeck" { - path = "rundeck" - type = "kv" - max_lease_ttl_seconds = 0 - external_entropy_access = false - seal_wrap = false - options = { - version = "2" - } -} diff --git a/engine_ssh-host-signer.tf b/engine_ssh-host-signer.tf deleted file mode 100644 index c64de19..0000000 --- a/engine_ssh-host-signer.tf +++ /dev/null @@ -1,18 +0,0 @@ -#-------------------------------------------------------------- -# ssh-host-signer -# create engine -# generate ca cert -# tune the ssh engine -#-------------------------------------------------------------- -#resource "vault_mount" "ssh_host_signer" { -# path = "ssh-host-signer" -# type = "ssh" -# description = "SSH Host Signing Engine" -# max_lease_ttl_seconds = 87600 * 3600 -#} -# -#resource "vault_ssh_secret_backend_ca" "ssh_host_signer_ca" { -# backend = vault_mount.ssh_host_signer.path -# generate_signing_key = false # change to true for new configuration -# key_type = "ssh-rsa" -#} diff --git a/engine_sshca.tf b/engine_sshca.tf deleted file mode 100644 index 8fdb483..0000000 --- a/engine_sshca.tf +++ /dev/null @@ -1,18 +0,0 @@ -#-------------------------------------------------------------- -# ssh -# create engine -# generate ca cert -# tune the ssh engine -#-------------------------------------------------------------- -resource "vault_mount" "sshca" { - path = "sshca" - type = "ssh" - description = "SSH CA Engine" - max_lease_ttl_seconds = 87600 * 3600 -} - -resource "vault_ssh_secret_backend_ca" "ssh_ca" { - backend = vault_mount.sshca.path - generate_signing_key = true - key_type = "ssh-rsa" -} diff --git a/engine_transit.tf b/engine_transit.tf deleted file mode 100644 index c596b9b..0000000 --- a/engine_transit.tf +++ /dev/null @@ -1,13 +0,0 @@ -resource "vault_mount" "transit" { - path = "transit" - type = "transit" - description = "Transit Engine" - default_lease_ttl_seconds = 3600 - max_lease_ttl_seconds = 86400 -} - -resource "vault_transit_secret_backend_key" "key" { - backend = vault_mount.transit.path - name = "au-syd1-k8s-vso" - type = "aes256-gcm96" -} diff --git a/environments/au/syd1/terragrunt.hcl b/environments/au/syd1/terragrunt.hcl new file mode 100644 index 0000000..6549cee --- /dev/null +++ b/environments/au/syd1/terragrunt.hcl @@ -0,0 +1,60 @@ +include "root" { + path = find_in_parent_folders("root.hcl") + expose = true +} + +include "config" { + path = "${get_repo_root()}/config/config.hcl" + expose = true +} + +include "policies" { + path = "${get_repo_root()}/policies/policies.hcl" + expose = true +} + +locals { + # Extract country and region from path + path_parts = split("/", dirname(get_terragrunt_dir())) + country = basename(dirname(get_terragrunt_dir())) # "au" + region = basename(get_terragrunt_dir()) # "syd1" + + # Include configuration from config.hcl + config = include.config.locals.config + + # Include policies from policies.hcl + policies = include.policies.locals +} + +terraform { + source = "../../../modules/vault_cluster" +} + +inputs = { + country = local.country + region = local.region + + # Pass configuration maps to vault_cluster module + auth_approle_backend = local.config.auth_approle_backend + auth_approle_role = local.config.auth_approle_role + auth_ldap_backend = local.config.auth_ldap_backend + auth_ldap_group = local.config.auth_ldap_group + auth_kubernetes_backend = local.config.auth_kubernetes_backend + auth_kubernetes_role = local.config.auth_kubernetes_role + kv_secret_backend = local.config.kv_secret_backend + transit_secret_backend = local.config.transit_secret_backend + transit_secret_backend_key = local.config.transit_secret_backend_key + ssh_secret_backend = local.config.ssh_secret_backend + ssh_secret_backend_role = local.config.ssh_secret_backend_role + pki_secret_backend = local.config.pki_secret_backend + pki_secret_backend_role = local.config.pki_secret_backend_role + consul_secret_backend = local.config.consul_secret_backend + consul_secret_backend_role = local.config.consul_secret_backend_role + kubernetes_secret_backend = local.config.kubernetes_secret_backend + kubernetes_secret_backend_role = local.config.kubernetes_secret_backend_role + pki_mount_only = local.config.pki_mount_only + + # Pass policy maps to vault_cluster module + policy_auth_map = local.policies.policy_auth_map + policy_rules_map = local.policies.policy_rules_map +} diff --git a/main.tf b/environments/root.hcl similarity index 82% rename from main.tf rename to environments/root.hcl index dc249c3..43e86bf 100644 --- a/main.tf +++ b/environments/root.hcl @@ -1,3 +1,8 @@ +# Generate root backend.tf +generate "backend" { + path = "backend.tf" + if_exists = "overwrite" + contents = < p } - - name = each.key - policy = file(each.value.path) -} diff --git a/policies/auth/approle/admin.yaml b/policies/auth/approle/admin.yaml new file mode 100644 index 0000000..e61852c --- /dev/null +++ b/policies/auth/approle/admin.yaml @@ -0,0 +1,14 @@ +# Allow full administration of AppRole roles +--- +rules: + - path: "auth/approle/role/*" + capabilities: + - create + - update + - read + - delete + - list + +auth: + approle: + - tf_vault diff --git a/policies/auth/approle/approle_role_admin.hcl b/policies/auth/approle/approle_role_admin.hcl deleted file mode 100644 index 7ebf64f..0000000 --- a/policies/auth/approle/approle_role_admin.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "auth/approle/role/*" { - capabilities = ["create", "update", "read", "delete", "list"] -} diff --git a/policies/auth/approle/approle_role_login.hcl b/policies/auth/approle/approle_role_login.hcl deleted file mode 100644 index f548494..0000000 --- a/policies/auth/approle/approle_role_login.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "auth/approle/login" { - capabilities = ["create"] -} diff --git a/policies/auth/approle/login.yaml b/policies/auth/approle/login.yaml new file mode 100644 index 0000000..b4fb933 --- /dev/null +++ b/policies/auth/approle/login.yaml @@ -0,0 +1,10 @@ +# Allow AppRole login +--- +rules: + - path: "auth/approle/login" + capabilities: + - create + +auth: + approle: + - tf_vault diff --git a/policies/auth/k8s/au/syd1/admin.yaml b/policies/auth/k8s/au/syd1/admin.yaml new file mode 100644 index 0000000..2754b5a --- /dev/null +++ b/policies/auth/k8s/au/syd1/admin.yaml @@ -0,0 +1,23 @@ +# Allow administration of Kubernetes authentication backend +--- +rules: + - path: "auth/k8s/au/syd1/config" + capabilities: + - create + - update + - read + - delete + - path: "auth/k8s/au/syd1/role/*" + capabilities: + - create + - update + - read + - delete + - list + - path: "auth/k8s/au/syd1/role" + capabilities: + - list + +auth: + approle: + - tf_vault diff --git a/policies/auth/kubernetes/k8s_auth_admin.hcl b/policies/auth/kubernetes/k8s_auth_admin.hcl deleted file mode 100644 index 83d484c..0000000 --- a/policies/auth/kubernetes/k8s_auth_admin.hcl +++ /dev/null @@ -1,14 +0,0 @@ -# Allow configuration of Kubernetes authentication backend -path "auth/kubernetes/config" { - capabilities = ["create", "update", "read", "delete"] -} - -# Allow management of Kubernetes auth roles -path "auth/kubernetes/role/*" { - capabilities = ["create", "update", "read", "delete", "list"] -} - -# Allow listing auth/kubernetes/role -path "auth/kubernetes/role" { - capabilities = ["list"] -} \ No newline at end of file diff --git a/policies/auth/ldap/admin.yaml b/policies/auth/ldap/admin.yaml new file mode 100644 index 0000000..9d3637c --- /dev/null +++ b/policies/auth/ldap/admin.yaml @@ -0,0 +1,14 @@ +# Allow full administration of LDAP auth backend +--- +rules: + - path: "auth/ldap/*" + capabilities: + - create + - update + - read + - delete + - list + +auth: + approle: + - tf_vault diff --git a/policies/auth/ldap/ldap_admin.hcl b/policies/auth/ldap/ldap_admin.hcl deleted file mode 100644 index 5a790b8..0000000 --- a/policies/auth/ldap/ldap_admin.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "auth/ldap/*" { - capabilities = ["create", "update", "read", "delete", "list"] -} diff --git a/policies/auth/token/auth_token_create.hcl b/policies/auth/token/auth_token_create.hcl deleted file mode 100644 index ff3d7f8..0000000 --- a/policies/auth/token/auth_token_create.hcl +++ /dev/null @@ -1,7 +0,0 @@ -path "auth/token/create" { - capabilities = ["create", "read", "update", "list"] -} - -path "auth/token/*" { - capabilities = ["create", "update"] -} diff --git a/policies/auth/token/auth_token_lookup.hcl b/policies/auth/token/auth_token_lookup.hcl deleted file mode 100644 index d33244c..0000000 --- a/policies/auth/token/auth_token_lookup.hcl +++ /dev/null @@ -1,4 +0,0 @@ -# Allow listing and reading tokens -path "auth/token/lookup" { - capabilities = ["read", "list"] -} diff --git a/policies/auth/token/auth_token_renew.hcl b/policies/auth/token/auth_token_renew.hcl deleted file mode 100644 index 92e5ca3..0000000 --- a/policies/auth/token/auth_token_renew.hcl +++ /dev/null @@ -1,4 +0,0 @@ -# Allow renewing tokens -path "auth/token/renew" { - capabilities = ["update"] -} diff --git a/policies/auth/token/auth_token_roles_admin.hcl b/policies/auth/token/auth_token_roles_admin.hcl deleted file mode 100644 index 7bc329f..0000000 --- a/policies/auth/token/auth_token_roles_admin.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "auth/token/roles/*" { - capabilities = ["create", "read", "update", "delete", "list"] -} diff --git a/policies/auth/token/auth_token_self.hcl b/policies/auth/token/auth_token_self.hcl deleted file mode 100644 index 4e80d4c..0000000 --- a/policies/auth/token/auth_token_self.hcl +++ /dev/null @@ -1,14 +0,0 @@ -# Allow tokens to query themselves -path "auth/token/lookup-self" { - capabilities = ["read"] -} - -# Allow tokens to renew themselves -path "auth/token/renew-self" { - capabilities = ["update"] -} - -# Allow tokens to revoke themselves -path "auth/token/revoke-self" { - capabilities = ["update"] -} diff --git a/policies/auth/token/create.yaml b/policies/auth/token/create.yaml new file mode 100644 index 0000000..e9cdaf9 --- /dev/null +++ b/policies/auth/token/create.yaml @@ -0,0 +1,17 @@ +# Allow token creation and management +--- +rules: + - path: "auth/token/create" + capabilities: + - create + - read + - update + - list + - path: "auth/token/*" + capabilities: + - create + - update + +auth: + approle: + - tf_vault diff --git a/policies/auth/token/lookup.yaml b/policies/auth/token/lookup.yaml new file mode 100644 index 0000000..4f883bb --- /dev/null +++ b/policies/auth/token/lookup.yaml @@ -0,0 +1,11 @@ +# Allow listing and reading tokens +--- +rules: + - path: "auth/token/lookup" + capabilities: + - read + - list + +auth: + approle: + - tf_vault diff --git a/policies/auth/token/renew.yaml b/policies/auth/token/renew.yaml new file mode 100644 index 0000000..2699f8a --- /dev/null +++ b/policies/auth/token/renew.yaml @@ -0,0 +1,10 @@ +# Allow renewing tokens +--- +rules: + - path: "auth/token/renew" + capabilities: + - update + +auth: + approle: + - tf_vault diff --git a/policies/auth/token/roles/admin.yaml b/policies/auth/token/roles/admin.yaml new file mode 100644 index 0000000..dcf1ba7 --- /dev/null +++ b/policies/auth/token/roles/admin.yaml @@ -0,0 +1,14 @@ +# Allow administration of token roles +--- +rules: + - path: "auth/token/roles/*" + capabilities: + - create + - read + - update + - delete + - list + +auth: + approle: + - tf_vault diff --git a/policies/auth/token/self.yaml b/policies/auth/token/self.yaml new file mode 100644 index 0000000..4d94d9a --- /dev/null +++ b/policies/auth/token/self.yaml @@ -0,0 +1,16 @@ +# Allow tokens to query themselves +--- +rules: + - path: "auth/token/lookup-self" + capabilities: + - read + - path: "auth/token/renew-self" + capabilities: + - update + - path: "auth/token/revoke-self" + capabilities: + - update + +auth: + approle: + - tf_vault diff --git a/policies/default_access.hcl b/policies/default_access.hcl deleted file mode 100644 index f981711..0000000 --- a/policies/default_access.hcl +++ /dev/null @@ -1,15 +0,0 @@ -path "pki_int/*" { - capabilities = ["list", "read"] -} - -path "pki_root/*" { - capabilities = ["list", "read"] -} - -path "ssh-host-signer/*" { - capabilities = ["list", "read"] -} - -path "sshca/*" { - capabilities = ["list", "read"] -} diff --git a/policies/global-root.yaml b/policies/global-root.yaml new file mode 100644 index 0000000..62e4e3a --- /dev/null +++ b/policies/global-root.yaml @@ -0,0 +1,15 @@ +# Global root policy with full access to all paths +--- +rules: + - path: "*" + capabilities: + - create + - read + - update + - delete + - list + - sudo + +auth: + ldap: + - vault_admin diff --git a/policies/kubernetes/au/config_admin.hcl b/policies/kubernetes/au/config_admin.hcl deleted file mode 100644 index fa245ed..0000000 --- a/policies/kubernetes/au/config_admin.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kubernetes/au/+/config" { - capabilities = ["create", "update", "read", "delete", "list"] -} diff --git a/policies/kubernetes/au/config_admin.yaml b/policies/kubernetes/au/config_admin.yaml new file mode 100644 index 0000000..64387f3 --- /dev/null +++ b/policies/kubernetes/au/config_admin.yaml @@ -0,0 +1,14 @@ +# Allow administration of Kubernetes secret backend config +--- +rules: + - path: "kubernetes/au/+/config" + capabilities: + - create + - update + - read + - delete + - list + +auth: + approle: + - tf_vault diff --git a/policies/kubernetes/au/roles_admin.hcl b/policies/kubernetes/au/roles_admin.hcl deleted file mode 100644 index cff7bd2..0000000 --- a/policies/kubernetes/au/roles_admin.hcl +++ /dev/null @@ -1,6 +0,0 @@ -path "kubernetes/au/+/roles" { - capabilities = ["list"] -} -path "kubernetes/au/+/roles/*" { - capabilities = ["create", "update", "read", "delete", "list"] -} diff --git a/policies/kubernetes/au/roles_admin.yaml b/policies/kubernetes/au/roles_admin.yaml new file mode 100644 index 0000000..d540655 --- /dev/null +++ b/policies/kubernetes/au/roles_admin.yaml @@ -0,0 +1,17 @@ +# Allow administration of Kubernetes secret backend roles +--- +rules: + - path: "kubernetes/au/+/roles" + capabilities: + - list + - path: "kubernetes/au/+/roles/*" + capabilities: + - create + - update + - read + - delete + - list + +auth: + approle: + - tf_vault diff --git a/policies/kubernetes/au/syd1/creds/cluster-admin.hcl b/policies/kubernetes/au/syd1/creds/cluster-admin.hcl deleted file mode 100644 index e7aa0cb..0000000 --- a/policies/kubernetes/au/syd1/creds/cluster-admin.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kubernetes/au/syd1/creds/cluster-admin" { - capabilities = ["update"] -} \ No newline at end of file diff --git a/policies/kubernetes/au/syd1/creds/cluster-admin.yaml b/policies/kubernetes/au/syd1/creds/cluster-admin.yaml new file mode 100644 index 0000000..68a3781 --- /dev/null +++ b/policies/kubernetes/au/syd1/creds/cluster-admin.yaml @@ -0,0 +1,10 @@ +# Allow access to cluster-admin Kubernetes credentials +--- +rules: + - path: "kubernetes/au/syd1/creds/cluster-admin" + capabilities: + - update + +auth: + approle: + - tf_vault diff --git a/policies/kubernetes/au/syd1/creds/cluster-operator.hcl b/policies/kubernetes/au/syd1/creds/cluster-operator.hcl deleted file mode 100644 index b0d507a..0000000 --- a/policies/kubernetes/au/syd1/creds/cluster-operator.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kubernetes/au/syd1/creds/cluster-operator" { - capabilities = ["update"] -} \ No newline at end of file diff --git a/policies/kubernetes/au/syd1/creds/cluster-operator.yaml b/policies/kubernetes/au/syd1/creds/cluster-operator.yaml new file mode 100644 index 0000000..7f5dde7 --- /dev/null +++ b/policies/kubernetes/au/syd1/creds/cluster-operator.yaml @@ -0,0 +1,10 @@ +# Allow access to cluster-operator Kubernetes credentials +--- +rules: + - path: "kubernetes/au/syd1/creds/cluster-operator" + capabilities: + - update + +auth: + approle: + - tf_vault diff --git a/policies/kubernetes/au/syd1/creds/cluster-root.hcl b/policies/kubernetes/au/syd1/creds/cluster-root.hcl deleted file mode 100644 index 6dd2f14..0000000 --- a/policies/kubernetes/au/syd1/creds/cluster-root.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kubernetes/au/syd1/creds/cluster-root" { - capabilities = ["update"] -} \ No newline at end of file diff --git a/policies/kubernetes/au/syd1/creds/cluster-root.yaml b/policies/kubernetes/au/syd1/creds/cluster-root.yaml new file mode 100644 index 0000000..42400f4 --- /dev/null +++ b/policies/kubernetes/au/syd1/creds/cluster-root.yaml @@ -0,0 +1,10 @@ +# Allow access to cluster-root Kubernetes credentials +--- +rules: + - path: "kubernetes/au/syd1/creds/cluster-root" + capabilities: + - update + +auth: + approle: + - tf_vault diff --git a/policies/kubernetes/au/syd1/creds/media-apps-operator.hcl b/policies/kubernetes/au/syd1/creds/media-apps-operator.hcl deleted file mode 100644 index 7ebabbb..0000000 --- a/policies/kubernetes/au/syd1/creds/media-apps-operator.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kubernetes/au/syd1/creds/media-apps-operator" { - capabilities = ["update"] -} \ No newline at end of file diff --git a/policies/kubernetes/au/syd1/creds/media-apps-operator.yaml b/policies/kubernetes/au/syd1/creds/media-apps-operator.yaml new file mode 100644 index 0000000..cd1604f --- /dev/null +++ b/policies/kubernetes/au/syd1/creds/media-apps-operator.yaml @@ -0,0 +1,10 @@ +# Allow access to media-apps-operator Kubernetes credentials +--- +rules: + - path: "kubernetes/au/syd1/creds/media-apps-operator" + capabilities: + - update + +auth: + approle: + - tf_vault diff --git a/policies/kv/service/gitea/unkinben/tokens/read-only-packages/read.hcl b/policies/kv/service/gitea/unkinben/tokens/read-only-packages/read.hcl deleted file mode 100644 index e848288..0000000 --- a/policies/kv/service/gitea/unkinben/tokens/read-only-packages/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/gitea/unkinben/tokens/read-only-packages" { - capabilities = ["read"] -} diff --git a/policies/kv/service/gitea/unkinben/tokens/read-only-packages/read.yaml b/policies/kv/service/gitea/unkinben/tokens/read-only-packages/read.yaml new file mode 100644 index 0000000..a667cb7 --- /dev/null +++ b/policies/kv/service/gitea/unkinben/tokens/read-only-packages/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Gitea read-only package tokens +--- +rules: + - path: "kv/data/service/gitea/unkinben/tokens/read-only-packages" + capabilities: + - read + +auth: + approle: + - rpmbuilder diff --git a/policies/kv/service/github/neoloc/tokens/read-only-token/read.hcl b/policies/kv/service/github/neoloc/tokens/read-only-token/read.hcl deleted file mode 100644 index 0ff450c..0000000 --- a/policies/kv/service/github/neoloc/tokens/read-only-token/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/github/neoloc/tokens/read-only-token" { - capabilities = ["read"] -} diff --git a/policies/kv/service/github/neoloc/tokens/read-only-token/read.yaml b/policies/kv/service/github/neoloc/tokens/read-only-token/read.yaml new file mode 100644 index 0000000..2194dca --- /dev/null +++ b/policies/kv/service/github/neoloc/tokens/read-only-token/read.yaml @@ -0,0 +1,10 @@ +# Allow reading GitHub read-only tokens +--- +rules: + - path: "kv/data/service/github/neoloc/tokens/read-only-token" + capabilities: + - read + +auth: + approle: + - rpmbuilder diff --git a/policies/kv/service/glauth/services/svc_vault/read.yaml b/policies/kv/service/glauth/services/svc_vault/read.yaml new file mode 100644 index 0000000..a9cf6c7 --- /dev/null +++ b/policies/kv/service/glauth/services/svc_vault/read.yaml @@ -0,0 +1,11 @@ +# Allow reading GLAuth service vault configuration +--- +rules: + - path: "kv/data/service/glauth/services/svc_vault" + capabilities: + - list + - read + +auth: + approle: + - tf_vault diff --git a/policies/kv/service/glauth/services/svc_vault_read.hcl b/policies/kv/service/glauth/services/svc_vault_read.hcl deleted file mode 100644 index e34e98d..0000000 --- a/policies/kv/service/glauth/services/svc_vault_read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/glauth/services/svc_vault" { - capabilities = ["list", "read"] -} diff --git a/policies/kv/service/incus/cluster-join-tokens/crud.yaml b/policies/kv/service/incus/cluster-join-tokens/crud.yaml new file mode 100644 index 0000000..7e12ef3 --- /dev/null +++ b/policies/kv/service/incus/cluster-join-tokens/crud.yaml @@ -0,0 +1,13 @@ +# Allow access to Incus cluster join tokens +--- +rules: + - path: "kv/data/service/incus/cluster-join-tokens" + capabilities: + - create + - read + - update + - delete + +auth: + approle: + - incus_cluster diff --git a/policies/kv/service/incus/incus-cluster-join-tokens.hcl b/policies/kv/service/incus/incus-cluster-join-tokens.hcl deleted file mode 100644 index 4e47c0e..0000000 --- a/policies/kv/service/incus/incus-cluster-join-tokens.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/incus/cluster-join-tokens" { - capabilities = ["create", "read", "update", "delete"] -} diff --git a/policies/kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read.hcl b/policies/kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read.hcl deleted file mode 100644 index b937320..0000000 --- a/policies/kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/kubernetes/au/syd1/csi/ceph-cephfs-secret" { - capabilities = ["read"] -} diff --git a/policies/kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read.yaml b/policies/kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read.yaml new file mode 100644 index 0000000..fb07a50 --- /dev/null +++ b/policies/kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Ceph CephFS CSI secrets +--- +rules: + - path: "kv/data/service/kubernetes/au/syd1/csi/ceph-cephfs-secret" + capabilities: + - read + +auth: + k8s/au/syd1: + - ceph-csi diff --git a/policies/kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read.hcl b/policies/kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read.hcl deleted file mode 100644 index b80913b..0000000 --- a/policies/kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/kubernetes/au/syd1/csi/ceph-rbd-secret" { - capabilities = ["read"] -} diff --git a/policies/kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read.yaml b/policies/kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read.yaml new file mode 100644 index 0000000..93ff084 --- /dev/null +++ b/policies/kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Ceph RBD CSI secrets +--- +rules: + - path: "kv/data/service/kubernetes/au/syd1/csi/ceph-rbd-secret" + capabilities: + - read + +auth: + k8s/au/syd1: + - ceph-csi diff --git a/policies/kv/service/kubernetes/au/syd1/externaldns/tsig/read.hcl b/policies/kv/service/kubernetes/au/syd1/externaldns/tsig/read.hcl deleted file mode 100644 index fba1b64..0000000 --- a/policies/kv/service/kubernetes/au/syd1/externaldns/tsig/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/kubernetes/au/syd1/externaldns/tsig" { - capabilities = ["read"] -} diff --git a/policies/kv/service/kubernetes/au/syd1/externaldns/tsig/read.yaml b/policies/kv/service/kubernetes/au/syd1/externaldns/tsig/read.yaml new file mode 100644 index 0000000..044669c --- /dev/null +++ b/policies/kv/service/kubernetes/au/syd1/externaldns/tsig/read.yaml @@ -0,0 +1,10 @@ +# Allow reading ExternalDNS TSIG keys +--- +rules: + - path: "kv/data/service/kubernetes/au/syd1/externaldns/tsig" + capabilities: + - read + +auth: + k8s/au/syd1: + - externaldns diff --git a/policies/kv/service/kubernetes/au/syd1/service_account_jwt/read.hcl b/policies/kv/service/kubernetes/au/syd1/service_account_jwt/read.hcl deleted file mode 100644 index 4712a2a..0000000 --- a/policies/kv/service/kubernetes/au/syd1/service_account_jwt/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/kubernetes/au/syd1/service_account_jwt" { - capabilities = ["read"] -} diff --git a/policies/kv/service/kubernetes/au/syd1/service_account_jwt/read.yaml b/policies/kv/service/kubernetes/au/syd1/service_account_jwt/read.yaml new file mode 100644 index 0000000..74a3493 --- /dev/null +++ b/policies/kv/service/kubernetes/au/syd1/service_account_jwt/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Kubernetes service account JWT +--- +rules: + - path: "kv/data/service/kubernetes/au/syd1/service_account_jwt" + capabilities: + - read + +auth: + approle: + - tf_vault diff --git a/policies/kv/service/kubernetes/au/syd1/token_reviewer_jwt/read.hcl b/policies/kv/service/kubernetes/au/syd1/token_reviewer_jwt/read.hcl deleted file mode 100644 index 85cc6b9..0000000 --- a/policies/kv/service/kubernetes/au/syd1/token_reviewer_jwt/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/kubernetes/au/syd1/token_reviewer_jwt" { - capabilities = ["read"] -} \ No newline at end of file diff --git a/policies/kv/service/kubernetes/au/syd1/token_reviewer_jwt/read.yaml b/policies/kv/service/kubernetes/au/syd1/token_reviewer_jwt/read.yaml new file mode 100644 index 0000000..1cdfae5 --- /dev/null +++ b/policies/kv/service/kubernetes/au/syd1/token_reviewer_jwt/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Kubernetes token reviewer JWT +--- +rules: + - path: "kv/data/service/kubernetes/au/syd1/token_reviewer_jwt" + capabilities: + - read + +auth: + approle: + - tf_vault diff --git a/policies/kv/service/media-apps/nzbget/read.yaml b/policies/kv/service/media-apps/nzbget/read.yaml new file mode 100644 index 0000000..fe85562 --- /dev/null +++ b/policies/kv/service/media-apps/nzbget/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Prowlarr configuration +--- +rules: + - path: "kv/data/service/media-apps/nzbget" + capabilities: + - read + +auth: + k8s/au/syd1: + - media-apps diff --git a/policies/kv/service/media-apps/prowlarr/read.yaml b/policies/kv/service/media-apps/prowlarr/read.yaml new file mode 100644 index 0000000..c794f0d --- /dev/null +++ b/policies/kv/service/media-apps/prowlarr/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Prowlarr configuration +--- +rules: + - path: "kv/data/service/media-apps/prowlarr" + capabilities: + - read + +auth: + k8s/au/syd1: + - media-apps diff --git a/policies/kv/service/media-apps/radarr/read.hcl b/policies/kv/service/media-apps/radarr/read.hcl deleted file mode 100644 index 073161f..0000000 --- a/policies/kv/service/media-apps/radarr/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/media-apps/radarr" { - capabilities = ["read"] -} diff --git a/policies/kv/service/media-apps/radarr/read.yaml b/policies/kv/service/media-apps/radarr/read.yaml new file mode 100644 index 0000000..8f7185b --- /dev/null +++ b/policies/kv/service/media-apps/radarr/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Radarr configuration +--- +rules: + - path: "kv/data/service/media-apps/radarr" + capabilities: + - read + +auth: + k8s/au/syd1: + - media-apps diff --git a/policies/kv/service/media-apps/sonarr/read.hcl b/policies/kv/service/media-apps/sonarr/read.hcl deleted file mode 100644 index e67c3a7..0000000 --- a/policies/kv/service/media-apps/sonarr/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/media-apps/sonarr" { - capabilities = ["read"] -} diff --git a/policies/kv/service/media-apps/sonarr/read.yaml b/policies/kv/service/media-apps/sonarr/read.yaml new file mode 100644 index 0000000..7b20780 --- /dev/null +++ b/policies/kv/service/media-apps/sonarr/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Sonarr configuration +--- +rules: + - path: "kv/data/service/media-apps/sonarr" + capabilities: + - read + +auth: + k8s/au/syd1: + - media-apps diff --git a/policies/kv/service/packer/builder/read.yaml b/policies/kv/service/packer/builder/read.yaml new file mode 100644 index 0000000..755bac7 --- /dev/null +++ b/policies/kv/service/packer/builder/read.yaml @@ -0,0 +1,13 @@ +# Allow Packer builder to read configuration +--- +rules: + - path: "kv/data/service/packer/builder/env" + capabilities: + - read + - path: "kv/data/service/packer/builder/docker-incus-client" + capabilities: + - read + +auth: + approle: + - packer_builder diff --git a/policies/kv/service/packer/packer_builder.hcl b/policies/kv/service/packer/packer_builder.hcl deleted file mode 100644 index f36d0d3..0000000 --- a/policies/kv/service/packer/packer_builder.hcl +++ /dev/null @@ -1,6 +0,0 @@ -path "kv/data/service/packer/builder/env" { - capabilities = ["read"] -} -path "kv/data/service/packer/builder/docker-incus-client" { - capabilities = ["read"] -} diff --git a/policies/kv/service/puppet/certificates/ca/read.yaml b/policies/kv/service/puppet/certificates/ca/read.yaml new file mode 100644 index 0000000..a69d7f6 --- /dev/null +++ b/policies/kv/service/puppet/certificates/ca/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Puppet CA Certificate +--- +rules: + - path: "kv/data/service/puppet/certificates/ca" + capabilities: + - read + +auth: + approle: + - terraform_incus diff --git a/policies/kv/service/puppet/certificates/terraform/read.yaml b/policies/kv/service/puppet/certificates/terraform/read.yaml new file mode 100644 index 0000000..291637b --- /dev/null +++ b/policies/kv/service/puppet/certificates/terraform/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Puppet certificates for Terraform +--- +rules: + - path: "kv/data/service/puppet/certificates/terraform" + capabilities: + - read + +auth: + approle: + - terraform_incus diff --git a/policies/kv/service/puppet/certificates/terraform_puppet_cert.hcl b/policies/kv/service/puppet/certificates/terraform_puppet_cert.hcl deleted file mode 100644 index 736758f..0000000 --- a/policies/kv/service/puppet/certificates/terraform_puppet_cert.hcl +++ /dev/null @@ -1,6 +0,0 @@ -path "kv/data/service/puppet/certificates/terraform" { - capabilities = ["read"] -} -path "kv/data/service/puppet/certificates/ca" { - capabilities = ["read"] -} diff --git a/policies/kv/service/puppetapi/puppetapi_read_tokens.hcl b/policies/kv/service/puppetapi/puppetapi_read_tokens.hcl deleted file mode 100644 index 465a81e..0000000 --- a/policies/kv/service/puppetapi/puppetapi_read_tokens.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/puppetapi/tokens" { - capabilities = ["read"] -} diff --git a/policies/kv/service/puppetapi/tokens/read.yaml b/policies/kv/service/puppetapi/tokens/read.yaml new file mode 100644 index 0000000..c887ba6 --- /dev/null +++ b/policies/kv/service/puppetapi/tokens/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Puppet API tokens +--- +rules: + - path: "kv/data/service/puppetapi/tokens" + capabilities: + - read + +auth: + approle: + - puppetapi diff --git a/policies/kv/service/repoflow/au/syd1/ceph-s3/read.hcl b/policies/kv/service/repoflow/au/syd1/ceph-s3/read.hcl deleted file mode 100644 index c9382bf..0000000 --- a/policies/kv/service/repoflow/au/syd1/ceph-s3/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/repoflow/au/syd1/ceph-s3" { - capabilities = ["read"] -} diff --git a/policies/kv/service/repoflow/au/syd1/ceph-s3/read.yaml b/policies/kv/service/repoflow/au/syd1/ceph-s3/read.yaml new file mode 100644 index 0000000..fb99bfe --- /dev/null +++ b/policies/kv/service/repoflow/au/syd1/ceph-s3/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Repoflow Ceph S3 configuration +--- +rules: + - path: "kv/data/service/repoflow/au/syd1/ceph-s3" + capabilities: + - read + +auth: + k8s/au/syd1: + - repoflow diff --git a/policies/kv/service/repoflow/au/syd1/elasticsearch/read.hcl b/policies/kv/service/repoflow/au/syd1/elasticsearch/read.hcl deleted file mode 100644 index ca884b6..0000000 --- a/policies/kv/service/repoflow/au/syd1/elasticsearch/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/repoflow/au/syd1/elasticsearch" { - capabilities = ["read"] -} diff --git a/policies/kv/service/repoflow/au/syd1/elasticsearch/read.yaml b/policies/kv/service/repoflow/au/syd1/elasticsearch/read.yaml new file mode 100644 index 0000000..6ae5d0f --- /dev/null +++ b/policies/kv/service/repoflow/au/syd1/elasticsearch/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Repoflow Elasticsearch configuration +--- +rules: + - path: "kv/data/service/repoflow/au/syd1/elasticsearch" + capabilities: + - read + +auth: + k8s/au/syd1: + - repoflow diff --git a/policies/kv/service/repoflow/au/syd1/hasura/read.hcl b/policies/kv/service/repoflow/au/syd1/hasura/read.hcl deleted file mode 100644 index dc09fe5..0000000 --- a/policies/kv/service/repoflow/au/syd1/hasura/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/repoflow/au/syd1/hasura" { - capabilities = ["read"] -} diff --git a/policies/kv/service/repoflow/au/syd1/hasura/read.yaml b/policies/kv/service/repoflow/au/syd1/hasura/read.yaml new file mode 100644 index 0000000..804989c --- /dev/null +++ b/policies/kv/service/repoflow/au/syd1/hasura/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Repoflow Hasura configuration +--- +rules: + - path: "kv/data/service/repoflow/au/syd1/hasura" + capabilities: + - read + +auth: + k8s/au/syd1: + - repoflow diff --git a/policies/kv/service/repoflow/au/syd1/postgres/read.hcl b/policies/kv/service/repoflow/au/syd1/postgres/read.hcl deleted file mode 100644 index a84fa8d..0000000 --- a/policies/kv/service/repoflow/au/syd1/postgres/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/repoflow/au/syd1/postgres" { - capabilities = ["read"] -} diff --git a/policies/kv/service/repoflow/au/syd1/postgres/read.yaml b/policies/kv/service/repoflow/au/syd1/postgres/read.yaml new file mode 100644 index 0000000..059867a --- /dev/null +++ b/policies/kv/service/repoflow/au/syd1/postgres/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Repoflow PostgreSQL configuration +--- +rules: + - path: "kv/data/service/repoflow/au/syd1/postgres" + capabilities: + - read + +auth: + k8s/au/syd1: + - repoflow diff --git a/policies/kv/service/repoflow/au/syd1/repoflow-server/read.hcl b/policies/kv/service/repoflow/au/syd1/repoflow-server/read.hcl deleted file mode 100644 index d29383c..0000000 --- a/policies/kv/service/repoflow/au/syd1/repoflow-server/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/repoflow/au/syd1/repoflow-server" { - capabilities = ["read"] -} diff --git a/policies/kv/service/repoflow/au/syd1/repoflow-server/read.yaml b/policies/kv/service/repoflow/au/syd1/repoflow-server/read.yaml new file mode 100644 index 0000000..1ae1c67 --- /dev/null +++ b/policies/kv/service/repoflow/au/syd1/repoflow-server/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Repoflow server configuration +--- +rules: + - path: "kv/data/service/repoflow/au/syd1/repoflow-server" + capabilities: + - read + +auth: + k8s/au/syd1: + - repoflow diff --git a/policies/kv/service/repoflow/unkinadmin/tokens/terraform/read.hcl b/policies/kv/service/repoflow/unkinadmin/tokens/terraform/read.hcl deleted file mode 100644 index e482516..0000000 --- a/policies/kv/service/repoflow/unkinadmin/tokens/terraform/read.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/repoflow/unkinadmin/tokens/terraform" { - capabilities = ["read"] -} diff --git a/policies/kv/service/repoflow/unkinadmin/tokens/terraform/read.yaml b/policies/kv/service/repoflow/unkinadmin/tokens/terraform/read.yaml new file mode 100644 index 0000000..f0677da --- /dev/null +++ b/policies/kv/service/repoflow/unkinadmin/tokens/terraform/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Repoflow admin Terraform tokens +--- +rules: + - path: "kv/data/service/repoflow/unkinadmin/tokens/terraform" + capabilities: + - read + +auth: + approle: + - terraform_repoflow diff --git a/policies/kv/service/terraform/incus.hcl b/policies/kv/service/terraform/incus.hcl deleted file mode 100644 index 4708a89..0000000 --- a/policies/kv/service/terraform/incus.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/terraform/incus" { - capabilities = ["read"] -} diff --git a/policies/kv/service/terraform/incus.yaml b/policies/kv/service/terraform/incus.yaml new file mode 100644 index 0000000..61688d8 --- /dev/null +++ b/policies/kv/service/terraform/incus.yaml @@ -0,0 +1,10 @@ +# Allow reading Terraform Incus configuration +--- +rules: + - path: "kv/data/service/terraform/incus" + capabilities: + - read + +auth: + approle: + - terraform_incus diff --git a/policies/kv/service/terraform/nomad.hcl b/policies/kv/service/terraform/nomad.hcl deleted file mode 100644 index c3118ba..0000000 --- a/policies/kv/service/terraform/nomad.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/terraform/nomad" { - capabilities = ["read"] -} diff --git a/policies/kv/service/terraform/nomad.yaml b/policies/kv/service/terraform/nomad.yaml new file mode 100644 index 0000000..6e8c0a9 --- /dev/null +++ b/policies/kv/service/terraform/nomad.yaml @@ -0,0 +1,10 @@ +# Allow reading Terraform Nomad configuration +--- +rules: + - path: "kv/data/service/terraform/nomad" + capabilities: + - read + +auth: + approle: + - terraform_nomad diff --git a/policies/kv/service/terraform/repoflow.hcl b/policies/kv/service/terraform/repoflow.hcl deleted file mode 100644 index d07a5bd..0000000 --- a/policies/kv/service/terraform/repoflow.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "kv/data/service/terraform/repoflow" { - capabilities = ["read"] -} diff --git a/policies/kv/service/terraform/repoflow.yaml b/policies/kv/service/terraform/repoflow.yaml new file mode 100644 index 0000000..1a26028 --- /dev/null +++ b/policies/kv/service/terraform/repoflow.yaml @@ -0,0 +1,10 @@ +# Allow reading Terraform Repoflow configuration +--- +rules: + - path: "kv/data/service/terraform/repoflow" + capabilities: + - read + +auth: + approle: + - terraform_repoflow diff --git a/policies/kv/service/vault/auth_approle_roles_read.yaml b/policies/kv/service/vault/auth_approle_roles_read.yaml new file mode 100644 index 0000000..fb743a8 --- /dev/null +++ b/policies/kv/service/vault/auth_approle_roles_read.yaml @@ -0,0 +1,11 @@ +# Allow reading Vault auth AppRole role configuration +--- +rules: + - path: "kv/data/service/vault/+/+/auth_approle_role/*" + capabilities: + - list + - read + +auth: + approle: + - tf_vault diff --git a/policies/kv/service/vault/auth_backends_read.yaml b/policies/kv/service/vault/auth_backends_read.yaml new file mode 100644 index 0000000..91e9451 --- /dev/null +++ b/policies/kv/service/vault/auth_backends_read.yaml @@ -0,0 +1,11 @@ +# Allow reading Vault auth backend configuration +--- +rules: + - path: "kv/data/service/vault/+/+/auth_backend/*" + capabilities: + - list + - read + +auth: + approle: + - tf_vault diff --git a/policies/kv/service/vault/secret_backends_read.yaml b/policies/kv/service/vault/secret_backends_read.yaml new file mode 100644 index 0000000..a6f9259 --- /dev/null +++ b/policies/kv/service/vault/secret_backends_read.yaml @@ -0,0 +1,11 @@ +# Allow reading Vault secret backend configuration +--- +rules: + - path: "kv/data/service/vault/+/+/secret_backend/*" + capabilities: + - list + - read + +auth: + approle: + - tf_vault diff --git a/policies/pki/au/syd1/certmanager.yaml b/policies/pki/au/syd1/certmanager.yaml new file mode 100644 index 0000000..2d29ac0 --- /dev/null +++ b/policies/pki/au/syd1/certmanager.yaml @@ -0,0 +1,19 @@ +# Allow cert-manager to issue and manage certificates +# used by the puppet autossl role +--- +rules: + - path: "pki/au/syd1/issue/*" + capabilities: + - create + - update + - read + - path: "pki/au/syd1/renew/*" + capabilities: + - update + - path: "pki/au/syd1/cert/*" + capabilities: + - read + +auth: + approle: + - certmanager diff --git a/policies/pki/au/syd1/issue/servers_default.yaml b/policies/pki/au/syd1/issue/servers_default.yaml new file mode 100644 index 0000000..7e49b81 --- /dev/null +++ b/policies/pki/au/syd1/issue/servers_default.yaml @@ -0,0 +1,11 @@ +# Allow issuing server certificates from servers_default role +--- +rules: + - path: "pki/au/syd1/issue/servers_default" + capabilities: + - update + +auth: + k8s/au/syd1: + - huntarr-default + - cert_manager_issuer diff --git a/policies/pki/au/syd1/roles/admin.yaml b/policies/pki/au/syd1/roles/admin.yaml new file mode 100644 index 0000000..aff865d --- /dev/null +++ b/policies/pki/au/syd1/roles/admin.yaml @@ -0,0 +1,14 @@ +# Allow administration of PKI roles +--- +rules: + - path: "pki/au/syd1/roles/*" + capabilities: + - create + - update + - read + - delete + - list + +auth: + approle: + - tf_vault diff --git a/policies/pki/au/syd1/sign/servers_default.yaml b/policies/pki/au/syd1/sign/servers_default.yaml new file mode 100644 index 0000000..e4e6de0 --- /dev/null +++ b/policies/pki/au/syd1/sign/servers_default.yaml @@ -0,0 +1,11 @@ +# Allow signing server certificates with servers_default role +--- +rules: + - path: "pki/au/syd1/sign/servers_default" + capabilities: + - update + +auth: + k8s/au/syd1: + - huntarr-default + - cert_manager_issuer diff --git a/policies/pki_int/certmanager.hcl b/policies/pki_int/certmanager.hcl deleted file mode 100644 index c1b38d5..0000000 --- a/policies/pki_int/certmanager.hcl +++ /dev/null @@ -1,9 +0,0 @@ -path "pki_int/issue/*" { - capabilities = ["create", "update", "read"] -} -path "pki_int/renew/*" { - capabilities = ["update"] -} -path "pki_int/cert/*" { - capabilities = ["read"] -} diff --git a/policies/pki_int/certmanager.yaml b/policies/pki_int/certmanager.yaml new file mode 100644 index 0000000..362ff75 --- /dev/null +++ b/policies/pki_int/certmanager.yaml @@ -0,0 +1,19 @@ +# Allow cert-manager to issue and manage certificates +# used by the puppet autossl role +--- +rules: + - path: "pki_int/issue/*" + capabilities: + - create + - update + - read + - path: "pki_int/renew/*" + capabilities: + - update + - path: "pki_int/cert/*" + capabilities: + - read + +auth: + approle: + - certmanager diff --git a/policies/pki_int/issue/servers_default.hcl b/policies/pki_int/issue/servers_default.hcl deleted file mode 100644 index 14200c8..0000000 --- a/policies/pki_int/issue/servers_default.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "pki_int/issue/servers_default" { - capabilities = ["update"] -} diff --git a/policies/pki_int/issue/servers_default.yaml b/policies/pki_int/issue/servers_default.yaml new file mode 100644 index 0000000..01ecda1 --- /dev/null +++ b/policies/pki_int/issue/servers_default.yaml @@ -0,0 +1,11 @@ +# Allow issuing server certificates from servers_default role +--- +rules: + - path: "pki_int/issue/servers_default" + capabilities: + - update + +auth: + k8s/au/syd1: + - huntarr-default + - cert_manager_issuer diff --git a/policies/pki_int/pki_int_roles_admin.hcl b/policies/pki_int/pki_int_roles_admin.hcl deleted file mode 100644 index ffbab59..0000000 --- a/policies/pki_int/pki_int_roles_admin.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "pki_int/roles/*" { - capabilities = ["create", "update", "read", "delete", "list"] -} diff --git a/policies/pki_int/roles/admin.yaml b/policies/pki_int/roles/admin.yaml new file mode 100644 index 0000000..a0892a8 --- /dev/null +++ b/policies/pki_int/roles/admin.yaml @@ -0,0 +1,14 @@ +# Allow administration of PKI roles +--- +rules: + - path: "pki_int/roles/*" + capabilities: + - create + - update + - read + - delete + - list + +auth: + approle: + - tf_vault diff --git a/policies/pki_int/sign/servers_default.hcl b/policies/pki_int/sign/servers_default.hcl deleted file mode 100644 index 84749e8..0000000 --- a/policies/pki_int/sign/servers_default.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "pki_int/sign/servers_default" { - capabilities = ["update"] -} diff --git a/policies/pki_int/sign/servers_default.yaml b/policies/pki_int/sign/servers_default.yaml new file mode 100644 index 0000000..6e1df50 --- /dev/null +++ b/policies/pki_int/sign/servers_default.yaml @@ -0,0 +1,11 @@ +# Allow signing server certificates with servers_default role +--- +rules: + - path: "pki_int/sign/servers_default" + capabilities: + - update + +auth: + k8s/au/syd1: + - huntarr-default + - cert_manager_issuer diff --git a/policies/pki_root/pki_root_roles_admin.hcl b/policies/pki_root/pki_root_roles_admin.hcl deleted file mode 100644 index 11ec94b..0000000 --- a/policies/pki_root/pki_root_roles_admin.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "pki_root/roles/*" { - capabilities = ["create", "update", "read", "delete", "list"] -} diff --git a/policies/policies.hcl b/policies/policies.hcl new file mode 100644 index 0000000..01079f4 --- /dev/null +++ b/policies/policies.hcl @@ -0,0 +1,76 @@ +# ============================================================================= +# VAULT POLICY CONFIGURATION SYSTEM +# ============================================================================= +# +# This file automatically discovers and processes all YAML policy files from +# subdirectories, creating a unified policy configuration for Vault. +# +# HOW IT WORKS: +# 1. Scans all subdirectories for *.yaml files +# 2. Parses each YAML file to extract policy rules and auth assignments +# 3. Creates mappings for auth methods -> roles -> assigned policies +# +# YAML STRUCTURE: +# Each policy YAML file should contain: +# - rules: List of Vault policy rules (path + capabilities) +# - auth: Map of auth methods to roles that should have this policy +# +# EXAMPLE YAML FILE (policies/kv/service/myapp/read.yaml): +# ```yaml +# rules: +# - path: "kv/data/service/myapp/*" +# capabilities: +# - read +# +# auth: +# approle: +# - myapp-service +# k8s/au/syd1: +# - myapp-pod +# ``` +# +# This creates a policy that allows reading secrets under kv/service/myapp/ +# and assigns it to: +# - AppRole role "myapp-service" in the "approle" mount +# - Kubernetes role "myapp-pod" in the "k8s/au/syd1" mount +# +# GENERATED OUTPUTS: +# - policy_rules_map: policy_name -> [rules] +# - policy_auth_map: auth_mount -> role_name -> [policy_names] +# +# ============================================================================= + +locals { + # Find all YAML files in subdirectories + policy_files = fileset(".", "**/*.yaml") + + # Create a flat map of all files with their content + all_policies = { + for file_path in local.policy_files : + trimsuffix(file_path, ".yaml") => yamldecode(file(file_path)) + } + + # Create a map of just the rules for each policy + policy_rules_map = { + for file_path in local.policy_files : + trimsuffix(file_path, ".yaml") => yamldecode(file(file_path)).rules + } + + # Create a map of auth mounts -> auth roles -> policy names + policy_auth_map = { + for auth_mount in distinct(flatten([ + for file_path in local.policy_files : [ + for auth_type, roles in yamldecode(file(file_path)).auth : auth_type + ] + ])) : auth_mount => { + for auth_role in distinct(flatten([ + for file_path in local.policy_files : [ + for role in try(yamldecode(file(file_path)).auth[auth_mount], []) : role + ] + ])) : auth_role => [ + for file_path in local.policy_files : trimsuffix(file_path, ".yaml") + if contains(try(yamldecode(file(file_path)).auth[auth_mount], []), auth_role) + ] + } + } +} \ No newline at end of file diff --git a/policies/rundeck/rundeck.hcl b/policies/rundeck/rundeck.hcl deleted file mode 100644 index ea4c523..0000000 --- a/policies/rundeck/rundeck.hcl +++ /dev/null @@ -1,7 +0,0 @@ -path "rundeck/data/*" { - capabilities = ["create", "read", "update", "delete", "list"] -} - -path "rundeck/metadata/*" { - capabilities = ["list"] -} diff --git a/policies/rundeck/rundeck.yaml b/policies/rundeck/rundeck.yaml new file mode 100644 index 0000000..489fd01 --- /dev/null +++ b/policies/rundeck/rundeck.yaml @@ -0,0 +1,17 @@ +# Allow Rundeck access to its KV secrets +--- +rules: + - path: "rundeck/data/*" + capabilities: + - create + - read + - update + - delete + - list + - path: "rundeck/metadata/*" + capabilities: + - list + +auth: + approle: + - rundeck-role diff --git a/policies/ssh-host-signer/ssh-host-signer_roles_admin.hcl b/policies/ssh-host-signer/ssh-host-signer_roles_admin.hcl deleted file mode 100644 index a6e723f..0000000 --- a/policies/ssh-host-signer/ssh-host-signer_roles_admin.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "ssh-host-signer/roles/*" { - capabilities = ["create", "read", "update", "delete", "list"] -} diff --git a/policies/ssh-host-signer/sshsign-host-policy.hcl b/policies/ssh-host-signer/sshsign-host-policy.hcl deleted file mode 100644 index 7709b99..0000000 --- a/policies/ssh-host-signer/sshsign-host-policy.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "ssh-host-signer/sign/hostrole" { - capabilities = ["create", "update"] -} diff --git a/policies/ssh-host-signer/sshsigner.hcl b/policies/ssh-host-signer/sshsigner.hcl deleted file mode 100644 index 7709b99..0000000 --- a/policies/ssh-host-signer/sshsigner.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "ssh-host-signer/sign/hostrole" { - capabilities = ["create", "update"] -} diff --git a/policies/sshca/roles/admin.yaml b/policies/sshca/roles/admin.yaml new file mode 100644 index 0000000..491998d --- /dev/null +++ b/policies/sshca/roles/admin.yaml @@ -0,0 +1,14 @@ +# Allow administration of SSH CA roles +--- +rules: + - path: "sshca/roles/*" + capabilities: + - create + - update + - read + - delete + - list + +auth: + approle: + - tf_vault diff --git a/policies/sshca/sign/host.yaml b/policies/sshca/sign/host.yaml new file mode 100644 index 0000000..8c1e978 --- /dev/null +++ b/policies/sshca/sign/host.yaml @@ -0,0 +1,11 @@ +# Allow signing SSH host certificates +--- +rules: + - path: "sshca/sign/host" + capabilities: + - create + - update + +auth: + approle: + - sshsigner diff --git a/policies/sshca/sign/user.yaml b/policies/sshca/sign/user.yaml new file mode 100644 index 0000000..8b41c4e --- /dev/null +++ b/policies/sshca/sign/user.yaml @@ -0,0 +1,11 @@ +# Allow signing SSH user certificates +--- +rules: + - path: "sshca/sign/user" + capabilities: + - create + - update + +auth: + approle: + - sshsigner diff --git a/policies/sshca/sshca_roles_admin.hcl b/policies/sshca/sshca_roles_admin.hcl deleted file mode 100644 index ac09136..0000000 --- a/policies/sshca/sshca_roles_admin.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "sshca/roles/*" { - capabilities = ["create", "update", "read", "delete", "list"] -} diff --git a/policies/sshca/sshca_signhost.hcl b/policies/sshca/sshca_signhost.hcl deleted file mode 100644 index 436eea1..0000000 --- a/policies/sshca/sshca_signhost.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "sshca/sign/host" { - capabilities = ["create", "update"] -} diff --git a/policies/sshca/sshca_signuser.hcl b/policies/sshca/sshca_signuser.hcl deleted file mode 100644 index 6450b2c..0000000 --- a/policies/sshca/sshca_signuser.hcl +++ /dev/null @@ -1,3 +0,0 @@ -path "sshca/sign/user" { - capabilities = ["create", "update"] -} diff --git a/policies/sys/audit/read.yaml b/policies/sys/audit/read.yaml new file mode 100644 index 0000000..1c136bb --- /dev/null +++ b/policies/sys/audit/read.yaml @@ -0,0 +1,9 @@ +# Allow reading audit logs related to secret engines +--- +rules: + - path: "sys/audit" + capabilities: + - read + - list + +auth: {} diff --git a/policies/sys/auth/admin.yaml b/policies/sys/auth/admin.yaml new file mode 100644 index 0000000..a8c9e1f --- /dev/null +++ b/policies/sys/auth/admin.yaml @@ -0,0 +1,14 @@ +# Allow creating and management of authentication backends (AppRole, LDAP, etc.) +--- +rules: + - path: "sys/auth/*" + capabilities: + - create + - update + - delete + - read + - list + +auth: + approle: + - tf_vault diff --git a/policies/sys/mounts/admin.yaml b/policies/sys/mounts/admin.yaml new file mode 100644 index 0000000..6176a09 --- /dev/null +++ b/policies/sys/mounts/admin.yaml @@ -0,0 +1,22 @@ +# Allow access to manage secret engines (mount, unmount, update) +--- +rules: + - path: "sys/mounts/*" + capabilities: + - create + - update + - delete + - read + - list + - path: "sys/mounts-tune/*" + capabilities: + - update + - read + - path: "sys/mounts" + capabilities: + - read + - list + +auth: + approle: + - tf_vault diff --git a/policies/sys/policy/admin.yaml b/policies/sys/policy/admin.yaml new file mode 100644 index 0000000..6c86dd7 --- /dev/null +++ b/policies/sys/policy/admin.yaml @@ -0,0 +1,18 @@ +# Allow management of policies (create, update, delete, list, and read) +--- +rules: + - path: "sys/policies/acl/*" + capabilities: + - create + - update + - delete + - read + - list + - path: "sys/policies/acl" + capabilities: + - read + - list + +auth: + approle: + - tf_vault diff --git a/policies/sys/sys_audit_read.hcl b/policies/sys/sys_audit_read.hcl deleted file mode 100644 index b294013..0000000 --- a/policies/sys/sys_audit_read.hcl +++ /dev/null @@ -1,4 +0,0 @@ -# Allow reading audit logs related to secret engines -path "sys/audit" { - capabilities = ["read", "list"] -} diff --git a/policies/sys/sys_auth_admin.hcl b/policies/sys/sys_auth_admin.hcl deleted file mode 100644 index b07492e..0000000 --- a/policies/sys/sys_auth_admin.hcl +++ /dev/null @@ -1,4 +0,0 @@ -# Allow creating and management of authentication backends (AppRole, LDAP, etc.) -path "sys/auth/*" { - capabilities = ["create", "update", "delete", "read", "list"] -} diff --git a/policies/sys/sys_mounts_admin.hcl b/policies/sys/sys_mounts_admin.hcl deleted file mode 100644 index 4383e1e..0000000 --- a/policies/sys/sys_mounts_admin.hcl +++ /dev/null @@ -1,14 +0,0 @@ -# Allow access to manage secret engines (mount, unmount, update) -path "sys/mounts/*" { - capabilities = ["create", "update", "delete", "read", "list"] -} - -# Allow tuning existing secret engines -path "sys/mounts-tune/*" { - capabilities = ["update", "read"] -} - -# Allow reaing and listing of enabled secret engines -path "sys/mounts" { - capabilities = ["read", "list"] -} diff --git a/policies/sys/sys_policy_admin.hcl b/policies/sys/sys_policy_admin.hcl deleted file mode 100644 index 43d2310..0000000 --- a/policies/sys/sys_policy_admin.hcl +++ /dev/null @@ -1,9 +0,0 @@ -# Allow management of policies (create, update, delete, list, and read) -path "sys/policies/acl/*" { - capabilities = ["create", "update", "delete", "read", "list"] -} - -# Allow listing of available policies -path "sys/policies/acl" { - capabilities = ["read", "list"] -} diff --git a/policies/transit/decrypt/au-syd1-k8s-vso.hcl b/policies/transit/decrypt/au-syd1-k8s-vso.hcl deleted file mode 100644 index e345e7e..0000000 --- a/policies/transit/decrypt/au-syd1-k8s-vso.hcl +++ /dev/null @@ -1,4 +0,0 @@ -# Allow decryption with the au-syd1-k8s-vso key -path "transit/decrypt/au-syd1-k8s-vso" { - capabilities = ["create", "update"] -} diff --git a/policies/transit/decrypt/au-syd1-k8s-vso.yaml b/policies/transit/decrypt/au-syd1-k8s-vso.yaml new file mode 100644 index 0000000..cc52f24 --- /dev/null +++ b/policies/transit/decrypt/au-syd1-k8s-vso.yaml @@ -0,0 +1,10 @@ +# Allow decryption with the au-syd1-k8s-vso key +--- +rules: + - path: "transit/decrypt/au-syd1-k8s-vso" + capabilities: + - create + - update + +auth: {} +# Add specific roles here when needed diff --git a/policies/transit/encrypt/au-syd1-k8s-vso.hcl b/policies/transit/encrypt/au-syd1-k8s-vso.hcl deleted file mode 100644 index bc9b4ac..0000000 --- a/policies/transit/encrypt/au-syd1-k8s-vso.hcl +++ /dev/null @@ -1,4 +0,0 @@ -# Allow encryption with the au-syd1-k8s-vso key -path "transit/encrypt/au-syd1-k8s-vso" { - capabilities = ["create", "update"] -} diff --git a/policies/transit/encrypt/au-syd1-k8s-vso.yaml b/policies/transit/encrypt/au-syd1-k8s-vso.yaml new file mode 100644 index 0000000..3696bcf --- /dev/null +++ b/policies/transit/encrypt/au-syd1-k8s-vso.yaml @@ -0,0 +1,10 @@ +# Allow encryption with the au-syd1-k8s-vso key +--- +rules: + - path: "transit/encrypt/au-syd1-k8s-vso" + capabilities: + - create + - update + +auth: {} +# Add specific roles here when needed diff --git a/policies/transit/keys/admin.hcl b/policies/transit/keys/admin.hcl deleted file mode 100644 index 59f8d1a..0000000 --- a/policies/transit/keys/admin.hcl +++ /dev/null @@ -1,8 +0,0 @@ -# Allow management of keys (create, update, delete, list, and read) -path "transit/keys/*" { - capabilities = ["create", "update", "delete", "read", "list"] -} -# Allow listing of available keys -path "transit/keys" { - capabilities = ["read", "list"] -} diff --git a/policies/transit/keys/admin.yaml b/policies/transit/keys/admin.yaml new file mode 100644 index 0000000..c1ce9dd --- /dev/null +++ b/policies/transit/keys/admin.yaml @@ -0,0 +1,18 @@ +# Allow management of keys (create, update, delete, list, and read) +--- +rules: + - path: "transit/keys/*" + capabilities: + - create + - update + - delete + - read + - list + - path: "transit/keys" + capabilities: + - read + - list + +auth: + approle: + - tf_vault diff --git a/resources/resources.hcl b/resources/resources.hcl new file mode 100644 index 0000000..b3de11c --- /dev/null +++ b/resources/resources.hcl @@ -0,0 +1,62 @@ +# ============================================================================= +# VAULT RESOURCES CONFIGURATION SYSTEM +# ============================================================================= +# +# This file automatically discovers and processes all YAML resource files from +# the resources/ directory, creating a unified resource configuration for Vault. +# +# HOW IT WORKS: +# 1. Scans all subdirectories under resources/ for *.yaml files +# 2. Parses each YAML file to extract resource rules and configuration +# 3. Creates structured mappings for backend types -> paths -> resource names +# +# YAML STRUCTURE: +# Each resource YAML file should contain Kubernetes RBAC rules or similar +# resource definitions that will be used by Vault secret backends. +# +# EXAMPLE YAML FILE (resources/secret_backend/kubernetes/au/syd1/roles/admin.yaml): +# ```yaml +# rules: +# - apiGroups: [""] +# resources: ["*"] +# verbs: ["*"] +# ``` +# +# DIRECTORY STRUCTURE: +# resources/ +# └── secret_backend/ +# └── {backend_type}/ +# └── {country}/ +# └── {region}/ +# └── roles/ +# └── {role_name}.yaml +# +# GENERATED OUTPUTS: +# - resources: [resources][secret_backend\auth_backend][path-between][yaml-file-name] +# +# ============================================================================= + +locals { + # Find all YAML files in current directory and subdirectories + resource_files = fileset(".", "**/*.yaml") + + # Create the desired nested structure: resources -> backend_type -> middle_path -> filename + resources = { + resources = { + for backend_type in distinct([ + for file_path in local.resource_files : split("/", file_path)[0] + ]) : backend_type => { + for middle_path in distinct([ + for file_path in local.resource_files : + length(split("/", file_path)) > 2 ? join("/", slice(split("/", file_path), 1, length(split("/", file_path)) - 1)) : "" + if split("/", file_path)[0] == backend_type + ]) : middle_path => { + for file_path in local.resource_files : + trimsuffix(basename(file_path), ".yaml") => yamldecode(file(file_path)) + if split("/", file_path)[0] == backend_type && + (length(split("/", file_path)) > 2 ? join("/", slice(split("/", file_path), 1, length(split("/", file_path)) - 1)) : "") == middle_path + } + } + } + } +} \ No newline at end of file diff --git a/resources/k8s/syd1/au/generated_role_rules/cluster-admin.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/cluster-admin.yaml similarity index 100% rename from resources/k8s/syd1/au/generated_role_rules/cluster-admin.yaml rename to resources/secret_backend/kubernetes/au/syd1/roles/cluster-admin.yaml diff --git a/resources/k8s/syd1/au/generated_role_rules/cluster-operator.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml similarity index 100% rename from resources/k8s/syd1/au/generated_role_rules/cluster-operator.yaml rename to resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml diff --git a/resources/k8s/syd1/au/generated_role_rules/cluster-root.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/cluster-root.yaml similarity index 100% rename from resources/k8s/syd1/au/generated_role_rules/cluster-root.yaml rename to resources/secret_backend/kubernetes/au/syd1/roles/cluster-root.yaml diff --git a/resources/k8s/syd1/au/generated_role_rules/media-apps-operator.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/media-apps-operator.yaml similarity index 100% rename from resources/k8s/syd1/au/generated_role_rules/media-apps-operator.yaml rename to resources/secret_backend/kubernetes/au/syd1/roles/media-apps-operator.yaml diff --git a/role_pki_int_servers_default.tf b/role_pki_int_servers_default.tf deleted file mode 100644 index e095c86..0000000 --- a/role_pki_int_servers_default.tf +++ /dev/null @@ -1,21 +0,0 @@ -resource "vault_pki_secret_backend_role" "servers_default" { - backend = "pki_int" - name = "servers_default" - #issuer_ref = data.vault_pki_secret_backend_issuer.pki_int_issuer.default - allow_ip_sans = true - allowed_domains = [ - "unkin.net", - "*.unkin.net", - "localhost" - ] - allow_subdomains = true - allow_glob_domains = true - allow_bare_domains = true - enforce_hostnames = true - allow_any_name = true - max_ttl = 2160 * 3600 - key_bits = 4096 - country = ["Australia"] - use_csr_common_name = true - use_csr_sans = true -} diff --git a/role_pki_root_2024_servers.tf b/role_pki_root_2024_servers.tf deleted file mode 100644 index 6e2975b..0000000 --- a/role_pki_root_2024_servers.tf +++ /dev/null @@ -1,6 +0,0 @@ -resource "vault_pki_secret_backend_role" "pki_root_2024_servers" { - backend = vault_mount.pki_root.path - name = "2024-servers" - issuer_ref = data.vault_pki_secret_backend_issuer.pki_root_issuer.issuer_ref - allow_any_name = true -} diff --git a/role_ssh-host-signer_hostrole.tf b/role_ssh-host-signer_hostrole.tf deleted file mode 100644 index 71ff4db..0000000 --- a/role_ssh-host-signer_hostrole.tf +++ /dev/null @@ -1,11 +0,0 @@ -resource "vault_ssh_secret_backend_role" "hostrole" { - backend = "ssh-host-signer" - name = "hostrole" - key_type = "ca" - algorithm_signer = "rsa-sha2-256" - ttl = 87600 * 3600 - allow_host_certificates = true - allowed_domains = "*" - allow_subdomains = true - allow_bare_domains = false -} diff --git a/role_sshca_signhost.tf b/role_sshca_signhost.tf deleted file mode 100644 index 1b4dd3b..0000000 --- a/role_sshca_signhost.tf +++ /dev/null @@ -1,12 +0,0 @@ -resource "vault_ssh_secret_backend_role" "sshca_signhost" { - backend = vault_mount.sshca.path - name = "sshca_signhost" - key_type = "ca" - algorithm_signer = "rsa-sha2-256" - ttl = 87600 * 3600 - allow_host_certificates = true - allow_subdomains = true - allow_bare_domains = false - allowed_domains = "main.unkin.net,consul" -} - diff --git a/shared_locals.tf b/shared_locals.tf deleted file mode 100644 index ef4d839..0000000 --- a/shared_locals.tf +++ /dev/null @@ -1,14 +0,0 @@ -locals { - kubernetes_ca_cert_au_syd1 = <<-EOT ------BEGIN CERTIFICATE----- -MIIBejCCAR+gAwIBAgIBADAKBggqhkjOPQQDAjAkMSIwIAYDVQQDDBlya2UyLXNl -cnZlci1jYUAxNzU5MDI3NTg0MB4XDTI1MDkyODAyNDYyNFoXDTM1MDkyNjAyNDYy -NFowJDEiMCAGA1UEAwwZcmtlMi1zZXJ2ZXItY2FAMTc1OTAyNzU4NDBZMBMGByqG -SM49AgEGCCqGSM49AwEHA0IABKfsTD4tKzKcnHyubWseKjlIPphBVveV1n6RUxmi -a3H6s9qMmT3dldYJyaalZI0NctSdW4ucPhBN5THCUr8sOmejQjBAMA4GA1UdDwEB -/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRFb0pf+pC/voWvbs1z -fU/dqB0RxjAKBggqhkjOPQQDAgNJADBGAiEA/0zeJRrgwpHFPRsqgO+EhmwBx1Y8 -NH3FcktF9J6PfPQCIQD4/IpOhdjf9rmo0ckG1npNEx5V8+OQ8ZTM7s1DL6+DfA== ------END CERTIFICATE----- -EOT -}