Merge pull request 'feat: major restructuring in migration to terragrunt' (#43) from benvin/vault_terragrunt into master
Reviewed-on: #43
This commit is contained in:
commit
cb1b383035
1
.gitignore
vendored
1
.gitignore
vendored
@ -1,3 +1,4 @@
|
||||
.terraform
|
||||
.terraform.lock.hcl
|
||||
env
|
||||
.terragrunt-cache
|
||||
|
||||
@ -1,4 +1,11 @@
|
||||
repos:
|
||||
- repo: https://github.com/pre-commit/pre-commit-hooks
|
||||
rev: v4.4.0
|
||||
hooks:
|
||||
- id: end-of-file-fixer
|
||||
types: [yaml]
|
||||
- id: trailing-whitespace
|
||||
types: [yaml]
|
||||
- repo: https://github.com/gruntwork-io/pre-commit
|
||||
rev: v0.1.30
|
||||
hooks:
|
||||
|
||||
39
Makefile
39
Makefile
@ -1,20 +1,29 @@
|
||||
.PHONY: init plan apply help
|
||||
.PHONY: init plan apply format
|
||||
|
||||
#init:
|
||||
# @echo "Sourcing environment and initializing Terraform..."
|
||||
# @source ./env && terraform init
|
||||
#
|
||||
#plan:
|
||||
# @echo "Sourcing environment and planning Terraform changes..."
|
||||
# @source ./env && terraform plan
|
||||
#
|
||||
#apply:
|
||||
# @echo "Sourcing environment and applying Terraform changes..."
|
||||
# @source ./env && terraform apply -auto-approve
|
||||
|
||||
# Default target
|
||||
help:
|
||||
@echo "Available targets:"
|
||||
@echo " init - Initialize Terraform"
|
||||
@echo " plan - Plan Terraform changes"
|
||||
@echo " apply - Apply Terraform changes"
|
||||
|
||||
init:
|
||||
@echo "Sourcing environment and initializing Terraform..."
|
||||
@source ./env && terraform init
|
||||
@terragrunt run --all --non-interactive init -- -upgrade
|
||||
|
||||
plan:
|
||||
@echo "Sourcing environment and planning Terraform changes..."
|
||||
@source ./env && terraform plan
|
||||
plan: init
|
||||
@terragrunt run --all --parallelism 4 --non-interactive plan
|
||||
|
||||
apply:
|
||||
@echo "Sourcing environment and applying Terraform changes..."
|
||||
@source ./env && terraform apply -auto-approve
|
||||
apply: init
|
||||
@terragrunt run --all --parallelism 2 --non-interactive apply
|
||||
|
||||
format:
|
||||
@echo "Formatting Terraform files..."
|
||||
@terraform fmt -recursive .
|
||||
@echo "Formatting Terragrunt files..."
|
||||
@terragrunt hcl fmt
|
||||
|
||||
@ -1,15 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "certmanager" {
|
||||
role_name = "certmanager"
|
||||
bind_secret_id = false
|
||||
token_policies = ["pki_int/certmanager"]
|
||||
token_ttl = 30
|
||||
token_max_ttl = 30
|
||||
token_bound_cidrs = [
|
||||
"198.18.25.5/32", # ausyd1nxvm2052.main.unkin.net
|
||||
"198.18.26.3/32", # ausyd1nxvm2053.main.unkin.net
|
||||
"198.18.27.89/32", # ausyd1nxvm2054.main.unkin.net
|
||||
"198.18.28.8/32", # ausyd1nxvm2055.main.unkin.net
|
||||
"198.18.29.33/32", # ausyd1nxvm2056.main.unkin.net
|
||||
"198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net
|
||||
]
|
||||
}
|
||||
@ -1,16 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "incus_cluster" {
|
||||
role_name = "incus_cluster"
|
||||
bind_secret_id = false
|
||||
token_policies = [
|
||||
"default_access",
|
||||
"kv/service/incus/incus-cluster-join-tokens"
|
||||
]
|
||||
token_ttl = 60
|
||||
token_max_ttl = 120
|
||||
token_bound_cidrs = [
|
||||
"10.10.12.200/32",
|
||||
"198.18.13.77/32",
|
||||
"198.18.13.78/32",
|
||||
"198.18.13.79/32"
|
||||
]
|
||||
}
|
||||
@ -1,16 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "packer_builder" {
|
||||
role_name = "packer_builder"
|
||||
bind_secret_id = false
|
||||
token_policies = [
|
||||
"default_access",
|
||||
"kv/service/packer/packer_builder",
|
||||
]
|
||||
token_ttl = 300 # builds can take a few minutes
|
||||
token_max_ttl = 600
|
||||
token_bound_cidrs = [
|
||||
"10.10.12.200/32",
|
||||
"198.18.25.102/32",
|
||||
"198.18.26.91/32",
|
||||
"198.18.27.40/32",
|
||||
]
|
||||
}
|
||||
@ -1,15 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "puppetapi" {
|
||||
role_name = "puppetapi"
|
||||
bind_secret_id = false
|
||||
token_policies = ["kv/service/puppetapi/puppetapi_read_tokens"]
|
||||
token_ttl = 30
|
||||
token_max_ttl = 30
|
||||
token_bound_cidrs = [
|
||||
"198.18.25.5/32", # ausyd1nxvm2052.main.unkin.net
|
||||
"198.18.26.3/32", # ausyd1nxvm2053.main.unkin.net
|
||||
"198.18.27.89/32", # ausyd1nxvm2054.main.unkin.net
|
||||
"198.18.28.8/32", # ausyd1nxvm2055.main.unkin.net
|
||||
"198.18.29.33/32", # ausyd1nxvm2056.main.unkin.net
|
||||
"198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net
|
||||
]
|
||||
}
|
||||
@ -1,16 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "rpmbuilder" {
|
||||
role_name = "rpmbuilder"
|
||||
bind_secret_id = false
|
||||
token_policies = [
|
||||
"kv/service/github/neoloc/tokens/read-only-token/read",
|
||||
"kv/service/gitea/unkinben/tokens/read-only-packages/read",
|
||||
]
|
||||
token_ttl = 30
|
||||
token_max_ttl = 30
|
||||
token_bound_cidrs = [
|
||||
"10.10.12.200/32",
|
||||
"198.18.25.102/32",
|
||||
"198.18.26.91/32",
|
||||
"198.18.27.40/32",
|
||||
]
|
||||
}
|
||||
@ -1,9 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "rundeck-role" {
|
||||
role_name = "rundeck-role"
|
||||
bind_secret_id = true
|
||||
token_policies = ["rundeck/rundeck"]
|
||||
token_ttl = 1 * 3600
|
||||
token_max_ttl = 4 * 3600
|
||||
token_bound_cidrs = ["198.18.13.59/32"]
|
||||
secret_id_bound_cidrs = ["198.18.13.59/32"]
|
||||
}
|
||||
@ -1,15 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "sshsign-host-role" {
|
||||
role_name = "sshsign-host-role"
|
||||
bind_secret_id = false
|
||||
token_policies = ["ssh-host-signer/sshsign-host-policy"]
|
||||
token_ttl = 30
|
||||
token_max_ttl = 30
|
||||
token_bound_cidrs = [
|
||||
"198.18.25.5/32", # ausyd1nxvm2052.main.unkin.net
|
||||
"198.18.26.3/32", # ausyd1nxvm2053.main.unkin.net
|
||||
"198.18.27.89/32", # ausyd1nxvm2054.main.unkin.net
|
||||
"198.18.28.8/32", # ausyd1nxvm2055.main.unkin.net
|
||||
"198.18.29.33/32", # ausyd1nxvm2056.main.unkin.net
|
||||
"198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net
|
||||
]
|
||||
}
|
||||
@ -1,18 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "sshsigner" {
|
||||
role_name = "sshsigner"
|
||||
bind_secret_id = false
|
||||
token_policies = [
|
||||
"ssh-host-signer/sshsigner",
|
||||
"sshca_signhost"
|
||||
]
|
||||
token_ttl = 30
|
||||
token_max_ttl = 30
|
||||
token_bound_cidrs = [
|
||||
"198.18.25.5/32", # ausyd1nxvm2052.main.unkin.net
|
||||
"198.18.26.3/32", # ausyd1nxvm2053.main.unkin.net
|
||||
"198.18.27.89/32", # ausyd1nxvm2054.main.unkin.net
|
||||
"198.18.28.8/32", # ausyd1nxvm2055.main.unkin.net
|
||||
"198.18.29.33/32", # ausyd1nxvm2056.main.unkin.net
|
||||
"198.18.29.239/32", # ausyd1nxvm2097.main.unkin.net
|
||||
]
|
||||
}
|
||||
@ -1,17 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "terraform_incus" {
|
||||
role_name = "terraform_incus"
|
||||
bind_secret_id = false
|
||||
token_policies = [
|
||||
"default_access",
|
||||
"kv/service/terraform/incus",
|
||||
"kv/service/puppet/certificates/terraform_puppet_cert",
|
||||
]
|
||||
token_ttl = 60
|
||||
token_max_ttl = 120
|
||||
token_bound_cidrs = [
|
||||
"10.10.12.200/32",
|
||||
"198.18.25.102/32",
|
||||
"198.18.26.91/32",
|
||||
"198.18.27.40/32",
|
||||
]
|
||||
}
|
||||
@ -1,16 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "terraform_nomad" {
|
||||
role_name = "terraform_nomad"
|
||||
bind_secret_id = false
|
||||
token_policies = [
|
||||
"default_access",
|
||||
"kv/service/terraform/nomad",
|
||||
]
|
||||
token_ttl = 60
|
||||
token_max_ttl = 120
|
||||
token_bound_cidrs = [
|
||||
"10.10.12.200/32",
|
||||
"198.18.25.102/32",
|
||||
"198.18.26.91/32",
|
||||
"198.18.27.40/32",
|
||||
]
|
||||
}
|
||||
@ -1,17 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "terraform_repoflow" {
|
||||
role_name = "terraform_repoflow"
|
||||
bind_secret_id = false
|
||||
token_policies = [
|
||||
"default_access",
|
||||
"kv/service/repoflow/unkinadmin/tokens/terraform/read",
|
||||
"kv/service/terraform/repoflow",
|
||||
]
|
||||
token_ttl = 60
|
||||
token_max_ttl = 120
|
||||
token_bound_cidrs = [
|
||||
"10.10.12.200/32",
|
||||
"198.18.25.102/32",
|
||||
"198.18.26.91/32",
|
||||
"198.18.27.40/32",
|
||||
]
|
||||
}
|
||||
@ -1,33 +0,0 @@
|
||||
resource "vault_approle_auth_backend_role" "tf_vault" {
|
||||
role_name = "tf_vault"
|
||||
bind_secret_id = false
|
||||
token_policies = [
|
||||
"default_access",
|
||||
"approle_token_create",
|
||||
"auth/approle/approle_role_admin",
|
||||
"auth/approle/approle_role_login",
|
||||
"auth/kubernetes/k8s_auth_admin",
|
||||
"auth/ldap/ldap_admin",
|
||||
"auth/token/auth_token_create",
|
||||
"auth/token/auth_token_self",
|
||||
"auth/token/auth_token_roles_admin",
|
||||
"kubernetes/au/config_admin",
|
||||
"kubernetes/au/roles_admin",
|
||||
"kv/service/glauth/services/svc_vault_read",
|
||||
"kv/service/kubernetes/au/syd1/token_reviewer_jwt/read",
|
||||
"kv/service/kubernetes/au/syd1/service_account_jwt/read",
|
||||
"pki_int/pki_int_roles_admin",
|
||||
"pki_root/pki_root_roles_admin",
|
||||
"ssh-host-signer/ssh-host-signer_roles_admin",
|
||||
"sshca/sshca_roles_admin",
|
||||
"sys/sys_auth_admin",
|
||||
"sys/sys_mounts_admin",
|
||||
"sys/sys_policy_admin",
|
||||
"transit/keys/admin",
|
||||
]
|
||||
token_ttl = 60
|
||||
token_max_ttl = 120
|
||||
token_bound_cidrs = [
|
||||
"10.10.12.200/32",
|
||||
]
|
||||
}
|
||||
@ -1,7 +0,0 @@
|
||||
#----------------------------
|
||||
# Enable approle auth method
|
||||
#----------------------------
|
||||
resource "vault_auth_backend" "approle" {
|
||||
type = "approle"
|
||||
path = "approle"
|
||||
}
|
||||
@ -1,23 +0,0 @@
|
||||
#-----------------------------------
|
||||
# Enable kubernetes auth method
|
||||
#-----------------------------------
|
||||
resource "vault_auth_backend" "kubernetes" {
|
||||
type = "kubernetes"
|
||||
path = "kubernetes"
|
||||
}
|
||||
|
||||
# Data source to read the token_reviewer_jwt from Vault KV
|
||||
data "vault_kv_secret_v2" "token_reviewer_jwt_au_syd1" {
|
||||
mount = "kv"
|
||||
name = "service/kubernetes/au/syd1/token_reviewer_jwt"
|
||||
}
|
||||
|
||||
# Configure Kubernetes auth backend
|
||||
resource "vault_kubernetes_auth_backend_config" "config" {
|
||||
backend = vault_auth_backend.kubernetes.path
|
||||
kubernetes_host = "https://api-k8s.service.consul:6443"
|
||||
kubernetes_ca_cert = local.kubernetes_ca_cert_au_syd1
|
||||
token_reviewer_jwt = data.vault_kv_secret_v2.token_reviewer_jwt_au_syd1.data["token"]
|
||||
disable_iss_validation = true
|
||||
use_annotations_as_alias_metadata = true
|
||||
}
|
||||
@ -1,40 +0,0 @@
|
||||
#--------------------------------
|
||||
# Enable ldap auth method
|
||||
#--------------------------------
|
||||
|
||||
# retrieve the bindpass from Vault
|
||||
data "vault_generic_secret" "svc_vault" {
|
||||
path = "kv/service/glauth/services/svc_vault"
|
||||
}
|
||||
|
||||
# create the ldap backend
|
||||
resource "vault_ldap_auth_backend" "ldap" {
|
||||
path = "ldap"
|
||||
url = "ldap://ldap.service.consul"
|
||||
userdn = "ou=people,ou=users,dc=main,dc=unkin,dc=net"
|
||||
userattr = "uid"
|
||||
upndomain = "users.main.unkin.net"
|
||||
discoverdn = false
|
||||
groupdn = "ou=users,dc=main,dc=unkin,dc=net"
|
||||
groupfilter = "(&(objectClass=posixGroup)(memberUid={{.Username}}))"
|
||||
groupattr = "uid"
|
||||
binddn = data.vault_generic_secret.svc_vault.data["distinguishedName"]
|
||||
bindpass = data.vault_generic_secret.svc_vault.data["pass"]
|
||||
}
|
||||
|
||||
resource "vault_ldap_auth_backend_group" "vault_access" {
|
||||
groupname = "vault_access"
|
||||
policies = [
|
||||
"default_access",
|
||||
]
|
||||
backend = vault_ldap_auth_backend.ldap.path
|
||||
}
|
||||
|
||||
resource "vault_ldap_auth_backend_group" "vault_admin" {
|
||||
groupname = "vault_admin"
|
||||
policies = [
|
||||
"default_access",
|
||||
"global-admin",
|
||||
]
|
||||
backend = vault_ldap_auth_backend.ldap.path
|
||||
}
|
||||
@ -1,119 +0,0 @@
|
||||
resource "vault_kubernetes_auth_backend_role" "default" {
|
||||
backend = vault_auth_backend.kubernetes.path
|
||||
role_name = "default"
|
||||
bound_service_account_names = ["default"]
|
||||
bound_service_account_namespaces = ["*"]
|
||||
token_ttl = 3600
|
||||
token_policies = [
|
||||
"default"
|
||||
]
|
||||
audience = "vault"
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "demo_default" {
|
||||
backend = vault_auth_backend.kubernetes.path
|
||||
role_name = "demo_default"
|
||||
bound_service_account_names = ["default"]
|
||||
bound_service_account_namespaces = ["demo"]
|
||||
token_ttl = 60
|
||||
token_policies = [
|
||||
"kv/service/terraform/nomad"
|
||||
]
|
||||
audience = "vault"
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "huntarr-default" {
|
||||
backend = vault_auth_backend.kubernetes.path
|
||||
role_name = "huntarr-default"
|
||||
bound_service_account_names = ["default"]
|
||||
bound_service_account_namespaces = ["huntarr"]
|
||||
token_ttl = 60
|
||||
token_policies = [
|
||||
"pki_int/sign/servers_default",
|
||||
"pki_int/issue/servers_default",
|
||||
]
|
||||
audience = "vault"
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "externaldns" {
|
||||
backend = vault_auth_backend.kubernetes.path
|
||||
role_name = "externaldns"
|
||||
bound_service_account_names = ["externaldns"]
|
||||
bound_service_account_namespaces = ["externaldns"]
|
||||
token_ttl = 60
|
||||
token_policies = [
|
||||
"kv/service/kubernetes/au/syd1/externaldns/tsig/read",
|
||||
]
|
||||
audience = "vault"
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "cert_manager_issuer" {
|
||||
backend = vault_auth_backend.kubernetes.path
|
||||
role_name = "cert-manager-issuer"
|
||||
bound_service_account_names = ["cert-manager-vault-issuer"]
|
||||
bound_service_account_namespaces = ["cert-manager"]
|
||||
token_ttl = 60
|
||||
token_policies = [
|
||||
"pki_int/sign/servers_default",
|
||||
"pki_int/issue/servers_default",
|
||||
]
|
||||
audience = "vault"
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "ceph-csi" {
|
||||
backend = vault_auth_backend.kubernetes.path
|
||||
role_name = "ceph-csi"
|
||||
bound_service_account_names = [
|
||||
"ceph-csi-rbd-csi-rbd-provisioner",
|
||||
"ceph-csi-cephfs-csi-cephfs-provisioner",
|
||||
]
|
||||
bound_service_account_namespaces = [
|
||||
"csi-cephrbd",
|
||||
"csi-cephfs",
|
||||
]
|
||||
token_ttl = 60
|
||||
token_policies = [
|
||||
"kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read",
|
||||
"kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read",
|
||||
]
|
||||
audience = "vault"
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "media-apps" {
|
||||
backend = vault_auth_backend.kubernetes.path
|
||||
role_name = "media-apps"
|
||||
bound_service_account_names = [
|
||||
"media-apps-vault-reader",
|
||||
]
|
||||
bound_service_account_namespaces = [
|
||||
"media-apps",
|
||||
]
|
||||
token_ttl = 60
|
||||
token_policies = [
|
||||
"kv/service/media-apps/nzbget/read",
|
||||
"kv/service/media-apps/prowlarr/read",
|
||||
"kv/service/media-apps/radarr/read",
|
||||
"kv/service/media-apps/sonarr/read",
|
||||
]
|
||||
audience = "vault"
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_role" "repoflow" {
|
||||
backend = vault_auth_backend.kubernetes.path
|
||||
role_name = "repoflow"
|
||||
bound_service_account_names = [
|
||||
"default",
|
||||
]
|
||||
bound_service_account_namespaces = [
|
||||
"repoflow",
|
||||
]
|
||||
token_ttl = 60
|
||||
token_policies = [
|
||||
"kv/service/repoflow/au/syd1/ceph-s3/read",
|
||||
"kv/service/repoflow/au/syd1/elasticsearch/read",
|
||||
"kv/service/repoflow/au/syd1/hasura/read",
|
||||
"kv/service/repoflow/au/syd1/postgres/read",
|
||||
"kv/service/repoflow/au/syd1/repoflow-server/read",
|
||||
]
|
||||
audience = "vault"
|
||||
}
|
||||
2
config/auth_approle_backend/approle.yaml
Normal file
2
config/auth_approle_backend/approle.yaml
Normal file
@ -0,0 +1,2 @@
|
||||
default_lease_ttl: 60s
|
||||
max_lease_ttl: 24h
|
||||
11
config/auth_approle_role/approle/certmanager.yaml
Normal file
11
config/auth_approle_role/approle/certmanager.yaml
Normal file
@ -0,0 +1,11 @@
|
||||
token_ttl: 30
|
||||
token_max_ttl: 30
|
||||
bind_secret_id: false
|
||||
token_bound_cidrs:
|
||||
- "198.18.25.5/32"
|
||||
- "198.18.26.3/32"
|
||||
- "198.18.27.89/32"
|
||||
- "198.18.28.8/32"
|
||||
- "198.18.29.33/32"
|
||||
- "198.18.29.239/32"
|
||||
use_deterministic_role_id: false
|
||||
9
config/auth_approle_role/approle/incus_cluster.yaml
Normal file
9
config/auth_approle_role/approle/incus_cluster.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
token_ttl: 60
|
||||
token_max_ttl: 120
|
||||
bind_secret_id: false
|
||||
token_bound_cidrs:
|
||||
- "10.10.12.200/32"
|
||||
- "198.18.13.77/32"
|
||||
- "198.18.13.78/32"
|
||||
- "198.18.13.79/32"
|
||||
use_deterministic_role_id: false
|
||||
9
config/auth_approle_role/approle/packer_builder.yaml
Normal file
9
config/auth_approle_role/approle/packer_builder.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
token_ttl: 300
|
||||
token_max_ttl: 600
|
||||
bind_secret_id: false
|
||||
token_bound_cidrs:
|
||||
- "10.10.12.200/32"
|
||||
- "198.18.25.102/32"
|
||||
- "198.18.26.91/32"
|
||||
- "198.18.27.40/32"
|
||||
use_deterministic_role_id: false
|
||||
11
config/auth_approle_role/approle/puppetapi.yaml
Normal file
11
config/auth_approle_role/approle/puppetapi.yaml
Normal file
@ -0,0 +1,11 @@
|
||||
token_ttl: 30
|
||||
token_max_ttl: 30
|
||||
bind_secret_id: false
|
||||
token_bound_cidrs:
|
||||
- "198.18.25.5/32"
|
||||
- "198.18.26.3/32"
|
||||
- "198.18.27.89/32"
|
||||
- "198.18.28.8/32"
|
||||
- "198.18.29.33/32"
|
||||
- "198.18.29.239/32"
|
||||
use_deterministic_role_id: false
|
||||
9
config/auth_approle_role/approle/rpmbuilder.yaml
Normal file
9
config/auth_approle_role/approle/rpmbuilder.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
token_ttl: 30
|
||||
token_max_ttl: 30
|
||||
bind_secret_id: false
|
||||
token_bound_cidrs:
|
||||
- "10.10.12.200/32"
|
||||
- "198.18.25.102/32"
|
||||
- "198.18.26.91/32"
|
||||
- "198.18.27.40/32"
|
||||
use_deterministic_role_id: false
|
||||
6
config/auth_approle_role/approle/rundeck-role.yaml
Normal file
6
config/auth_approle_role/approle/rundeck-role.yaml
Normal file
@ -0,0 +1,6 @@
|
||||
token_ttl: 3600
|
||||
token_max_ttl: 14400
|
||||
bind_secret_id: true
|
||||
token_bound_cidrs:
|
||||
- "198.18.13.59/32"
|
||||
use_deterministic_role_id: false
|
||||
11
config/auth_approle_role/approle/sshsigner.yaml
Normal file
11
config/auth_approle_role/approle/sshsigner.yaml
Normal file
@ -0,0 +1,11 @@
|
||||
token_ttl: 30
|
||||
token_max_ttl: 30
|
||||
bind_secret_id: false
|
||||
token_bound_cidrs:
|
||||
- "198.18.25.5/32"
|
||||
- "198.18.26.3/32"
|
||||
- "198.18.27.89/32"
|
||||
- "198.18.28.8/32"
|
||||
- "198.18.29.33/32"
|
||||
- "198.18.29.239/32"
|
||||
use_deterministic_role_id: false
|
||||
9
config/auth_approle_role/approle/terraform_incus.yaml
Normal file
9
config/auth_approle_role/approle/terraform_incus.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
token_ttl: 60
|
||||
token_max_ttl: 120
|
||||
bind_secret_id: false
|
||||
token_bound_cidrs:
|
||||
- "10.10.12.200/32"
|
||||
- "198.18.25.102/32"
|
||||
- "198.18.26.91/32"
|
||||
- "198.18.27.40/32"
|
||||
use_deterministic_role_id: false
|
||||
9
config/auth_approle_role/approle/terraform_nomad.yaml
Normal file
9
config/auth_approle_role/approle/terraform_nomad.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
token_ttl: 60
|
||||
token_max_ttl: 120
|
||||
bind_secret_id: false
|
||||
token_bound_cidrs:
|
||||
- "10.10.12.200/32"
|
||||
- "198.18.25.102/32"
|
||||
- "198.18.26.91/32"
|
||||
- "198.18.27.40/32"
|
||||
use_deterministic_role_id: false
|
||||
9
config/auth_approle_role/approle/terraform_repoflow.yaml
Normal file
9
config/auth_approle_role/approle/terraform_repoflow.yaml
Normal file
@ -0,0 +1,9 @@
|
||||
token_ttl: 60
|
||||
token_max_ttl: 120
|
||||
bind_secret_id: false
|
||||
token_bound_cidrs:
|
||||
- "10.10.12.200/32"
|
||||
- "198.18.25.102/32"
|
||||
- "198.18.26.91/32"
|
||||
- "198.18.27.40/32"
|
||||
use_deterministic_role_id: false
|
||||
6
config/auth_approle_role/approle/tf_vault.yaml
Normal file
6
config/auth_approle_role/approle/tf_vault.yaml
Normal file
@ -0,0 +1,6 @@
|
||||
token_ttl: 60
|
||||
token_max_ttl: 120
|
||||
bind_secret_id: false
|
||||
token_bound_cidrs:
|
||||
- "10.10.12.200/32"
|
||||
use_deterministic_role_id: false
|
||||
5
config/auth_kubernetes_backend/k8s/au/syd1.yaml
Normal file
5
config/auth_kubernetes_backend/k8s/au/syd1.yaml
Normal file
@ -0,0 +1,5 @@
|
||||
kubernetes_host: https://api-k8s.service.consul:6443
|
||||
disable_iss_validation: true
|
||||
use_annotations_as_alias_metadata: true
|
||||
default_lease_ttl: 1h
|
||||
max_lease_ttl: 24h
|
||||
8
config/auth_kubernetes_role/k8s/au/syd1/ceph-csi.yaml
Normal file
8
config/auth_kubernetes_role/k8s/au/syd1/ceph-csi.yaml
Normal file
@ -0,0 +1,8 @@
|
||||
bound_service_account_names:
|
||||
- ceph-csi-rbd-csi-rbd-provisioner
|
||||
- ceph-csi-cephfs-csi-cephfs-provisioner
|
||||
bound_service_account_namespaces:
|
||||
- csi-cephrbd
|
||||
- csi-cephfs
|
||||
token_ttl: 60
|
||||
audience: vault
|
||||
@ -0,0 +1,6 @@
|
||||
bound_service_account_names:
|
||||
- cert-manager-vault-issuer
|
||||
bound_service_account_namespaces:
|
||||
- cert-manager
|
||||
token_ttl: 60
|
||||
audience: vault
|
||||
6
config/auth_kubernetes_role/k8s/au/syd1/externaldns.yaml
Normal file
6
config/auth_kubernetes_role/k8s/au/syd1/externaldns.yaml
Normal file
@ -0,0 +1,6 @@
|
||||
bound_service_account_names:
|
||||
- externaldns
|
||||
bound_service_account_namespaces:
|
||||
- externaldns
|
||||
token_ttl: 60
|
||||
audience: vault
|
||||
@ -0,0 +1,6 @@
|
||||
bound_service_account_names:
|
||||
- default
|
||||
bound_service_account_namespaces:
|
||||
- huntarr
|
||||
token_ttl: 60
|
||||
audience: vault
|
||||
6
config/auth_kubernetes_role/k8s/au/syd1/media-apps.yaml
Normal file
6
config/auth_kubernetes_role/k8s/au/syd1/media-apps.yaml
Normal file
@ -0,0 +1,6 @@
|
||||
bound_service_account_names:
|
||||
- media-apps-vault-reader
|
||||
bound_service_account_namespaces:
|
||||
- media-apps
|
||||
token_ttl: 60
|
||||
audience: vault
|
||||
6
config/auth_kubernetes_role/k8s/au/syd1/repoflow.yaml
Normal file
6
config/auth_kubernetes_role/k8s/au/syd1/repoflow.yaml
Normal file
@ -0,0 +1,6 @@
|
||||
bound_service_account_names:
|
||||
- default
|
||||
bound_service_account_namespaces:
|
||||
- repoflow
|
||||
token_ttl: 60
|
||||
audience: vault
|
||||
10
config/auth_ldap_backend/ldap.yaml
Normal file
10
config/auth_ldap_backend/ldap.yaml
Normal file
@ -0,0 +1,10 @@
|
||||
userdn: "ou=people,ou=users,dc=main,dc=unkin,dc=net"
|
||||
userattr: "uid"
|
||||
upndomain: "users.main.unkin.net"
|
||||
discoverdn: false
|
||||
groupdn: "ou=users,dc=main,dc=unkin,dc=net"
|
||||
groupfilter: "(&(objectClass=posixGroup)(memberUid={{.Username}}))"
|
||||
groupattr: "uid"
|
||||
username_as_alias: true
|
||||
default_lease_ttl: 24h
|
||||
max_lease_ttl: 168h
|
||||
3
config/auth_ldap_group/ldap/vault_admin.yaml
Normal file
3
config/auth_ldap_group/ldap/vault_admin.yaml
Normal file
@ -0,0 +1,3 @@
|
||||
---
|
||||
# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
|
||||
description: foo
|
||||
189
config/config.hcl
Normal file
189
config/config.hcl
Normal file
@ -0,0 +1,189 @@
|
||||
# =============================================================================
|
||||
# VAULT MODULE CONFIGURATION SYSTEM
|
||||
# =============================================================================
|
||||
#
|
||||
# This file automatically discovers and organizes YAML configuration files
|
||||
# for Vault modules, creating structured configuration maps for Terraform.
|
||||
#
|
||||
# HOW IT WORKS:
|
||||
# 1. Scans all subdirectories for *.yaml files
|
||||
# 2. Groups files by module type based on directory structure
|
||||
# 3. Creates unique resource keys to prevent naming conflicts
|
||||
# 4. Adds computed fields like name, backend, etc. from file paths
|
||||
#
|
||||
# DIRECTORY STRUCTURE:
|
||||
# config/
|
||||
# ├── auth_approle_role/
|
||||
# │ └── approle/
|
||||
# │ ├── certmanager.yaml # Creates key: "approle/certmanager"
|
||||
# │ └── myapp.yaml # Creates key: "approle/myapp"
|
||||
# ├── auth_kubernetes_role/
|
||||
# │ └── k8s/au/syd1/
|
||||
# │ ├── default.yaml # Creates key: "k8s/au/syd1/default"
|
||||
# │ └── myapp.yaml # Creates key: "k8s/au/syd1/myapp"
|
||||
# └── kv_secret_backend/
|
||||
# ├── kv.yaml # Creates key: "kv"
|
||||
# └── secrets.yaml # Creates key: "secrets"
|
||||
#
|
||||
# EXAMPLE YAML FILE (config/auth_approle_role/approle/myapp.yaml):
|
||||
# ```yaml
|
||||
# token_ttl: 3600
|
||||
# token_max_ttl: 7200
|
||||
# bind_secret_id: true
|
||||
# token_bound_cidrs:
|
||||
# - "10.0.0.0/8"
|
||||
# ```
|
||||
#
|
||||
# This becomes:
|
||||
# ```hcl
|
||||
# auth_approle_role = {
|
||||
# "approle/myapp" = {
|
||||
# approle_name = "myapp" # Auto-computed from filename
|
||||
# mount_path = "approle" # Auto-computed from directory
|
||||
# token_ttl = 3600 # From YAML content
|
||||
# token_max_ttl = 7200 # From YAML content
|
||||
# bind_secret_id = true # From YAML content
|
||||
# token_bound_cidrs = ["10.0.0.0/8"]
|
||||
# }
|
||||
# }
|
||||
# ```
|
||||
#
|
||||
# KEY NAMING PATTERNS:
|
||||
# - Simple backends: filename only (e.g., "kv", "transit")
|
||||
# - Role-based resources: full path without extension (e.g., "approle/myapp")
|
||||
# - This ensures uniqueness when multiple backends have similar role names
|
||||
#
|
||||
# GENERATED OUTPUTS:
|
||||
# - config.auth_approle_backend, config.auth_approle_role, etc.
|
||||
# - Each module gets its own map with properly structured configuration
|
||||
#
|
||||
# =============================================================================
|
||||
|
||||
locals {
|
||||
# Find all YAML files in subdirectories
|
||||
config_files = fileset(".", "**/*.yaml")
|
||||
|
||||
# Create a flat map of all files with their content
|
||||
all_configs = {
|
||||
for file_path in local.config_files :
|
||||
file_path => yamldecode(file(file_path))
|
||||
}
|
||||
|
||||
# Group by module directory (first part of path)
|
||||
config = {
|
||||
auth_approle_backend = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(basename(file_path), ".yaml") => content
|
||||
if startswith(file_path, "auth_approle_backend/")
|
||||
}
|
||||
auth_approle_role = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(replace(file_path, "auth_approle_role/", ""), ".yaml") => merge(content, {
|
||||
approle_name = trimsuffix(basename(file_path), ".yaml")
|
||||
mount_path = split("/", replace(file_path, "auth_approle_role/", ""))[0]
|
||||
})
|
||||
if startswith(file_path, "auth_approle_role/")
|
||||
}
|
||||
auth_ldap_backend = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(basename(file_path), ".yaml") => content
|
||||
if startswith(file_path, "auth_ldap_backend/")
|
||||
}
|
||||
auth_ldap_group = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(replace(file_path, "auth_ldap_group/", ""), ".yaml") => merge(content, {
|
||||
groupname = trimsuffix(basename(file_path), ".yaml")
|
||||
backend = split("/", replace(file_path, "auth_ldap_group/", ""))[0]
|
||||
})
|
||||
if startswith(file_path, "auth_ldap_group/")
|
||||
}
|
||||
auth_kubernetes_backend = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(replace(file_path, "auth_kubernetes_backend/", ""), ".yaml") => content
|
||||
if startswith(file_path, "auth_kubernetes_backend/")
|
||||
}
|
||||
auth_kubernetes_role = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(replace(file_path, "auth_kubernetes_role/", ""), ".yaml") => merge(content, {
|
||||
role_name = trimsuffix(basename(file_path), ".yaml")
|
||||
backend = dirname(replace(file_path, "auth_kubernetes_role/", ""))
|
||||
})
|
||||
if startswith(file_path, "auth_kubernetes_role/")
|
||||
}
|
||||
kv_secret_backend = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(basename(file_path), ".yaml") => content
|
||||
if startswith(file_path, "kv_secret_backend/")
|
||||
}
|
||||
transit_secret_backend = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(basename(file_path), ".yaml") => content
|
||||
if startswith(file_path, "transit_secret_backend/")
|
||||
}
|
||||
transit_secret_backend_key = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(replace(file_path, "transit_secret_backend_key/", ""), ".yaml") => merge(content, {
|
||||
name = trimsuffix(basename(file_path), ".yaml")
|
||||
backend = dirname(replace(file_path, "transit_secret_backend_key/", ""))
|
||||
})
|
||||
if startswith(file_path, "transit_secret_backend_key/")
|
||||
}
|
||||
ssh_secret_backend = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(basename(file_path), ".yaml") => content
|
||||
if startswith(file_path, "ssh_secret_backend/")
|
||||
}
|
||||
ssh_secret_backend_role = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(replace(file_path, "ssh_secret_backend_role/", ""), ".yaml") => merge(content, {
|
||||
name = trimsuffix(basename(file_path), ".yaml")
|
||||
backend = dirname(replace(file_path, "ssh_secret_backend_role/", ""))
|
||||
})
|
||||
if startswith(file_path, "ssh_secret_backend_role/")
|
||||
}
|
||||
pki_secret_backend = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(replace(file_path, "pki_secret_backend/", ""), ".yaml") => content
|
||||
if startswith(file_path, "pki_secret_backend/")
|
||||
}
|
||||
pki_secret_backend_role = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(replace(file_path, "pki_secret_backend_role/", ""), ".yaml") => merge(content, {
|
||||
name = trimsuffix(basename(file_path), ".yaml")
|
||||
backend = dirname(replace(file_path, "pki_secret_backend_role/", ""))
|
||||
})
|
||||
if startswith(file_path, "pki_secret_backend_role/")
|
||||
}
|
||||
kubernetes_secret_backend = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(replace(file_path, "kubernetes_secret_backend/", ""), ".yaml") => content
|
||||
if startswith(file_path, "kubernetes_secret_backend/")
|
||||
}
|
||||
kubernetes_secret_backend_role = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(replace(file_path, "kubernetes_secret_backend_role/", ""), ".yaml") => merge(content, {
|
||||
name = trimsuffix(basename(file_path), ".yaml")
|
||||
backend = dirname(replace(file_path, "kubernetes_secret_backend_role/", ""))
|
||||
})
|
||||
if startswith(file_path, "kubernetes_secret_backend_role/")
|
||||
}
|
||||
consul_secret_backend = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(basename(file_path), ".yaml") => content
|
||||
if startswith(file_path, "consul_secret_backend/")
|
||||
}
|
||||
consul_secret_backend_role = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(replace(file_path, "consul_secret_backend_role/", ""), ".yaml") => merge(content, {
|
||||
name = trimsuffix(basename(file_path), ".yaml")
|
||||
backend = dirname(replace(file_path, "consul_secret_backend_role/", ""))
|
||||
})
|
||||
if startswith(file_path, "consul_secret_backend_role/")
|
||||
}
|
||||
pki_mount_only = {
|
||||
for file_path, content in local.all_configs :
|
||||
trimsuffix(basename(file_path), ".yaml") => content
|
||||
if startswith(file_path, "pki_mount_only/")
|
||||
}
|
||||
}
|
||||
}
|
||||
5
config/kubernetes_secret_backend/kubernetes/au/syd1.yaml
Normal file
5
config/kubernetes_secret_backend/kubernetes/au/syd1.yaml
Normal file
@ -0,0 +1,5 @@
|
||||
description: "kubernetes secret engine for au-syd1 cluster"
|
||||
default_lease_ttl_seconds: 600
|
||||
max_lease_ttl_seconds: 86400
|
||||
kubernetes_host: "https://api-k8s.service.consul:6443"
|
||||
disable_local_ca_jwt: false
|
||||
@ -0,0 +1,4 @@
|
||||
allowed_kubernetes_namespaces:
|
||||
- "*"
|
||||
kubernetes_role_type: "ClusterRole"
|
||||
extra_labels: {}
|
||||
@ -0,0 +1,4 @@
|
||||
allowed_kubernetes_namespaces:
|
||||
- "*"
|
||||
kubernetes_role_type: "ClusterRole"
|
||||
extra_labels: {}
|
||||
@ -0,0 +1,4 @@
|
||||
allowed_kubernetes_namespaces:
|
||||
- "*"
|
||||
kubernetes_role_type: "ClusterRole"
|
||||
extra_labels: {}
|
||||
@ -0,0 +1,4 @@
|
||||
allowed_kubernetes_namespaces:
|
||||
- "media-apps"
|
||||
kubernetes_role_type: "Role"
|
||||
extra_labels: {}
|
||||
4
config/kv_secret_backend/kv.yaml
Normal file
4
config/kv_secret_backend/kv.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
type: kv-v2
|
||||
description: "Key-Value secrets engine"
|
||||
version: "2"
|
||||
max_versions: 10
|
||||
4
config/kv_secret_backend/rundeck.yaml
Normal file
4
config/kv_secret_backend/rundeck.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
type: kv-v2
|
||||
description: "Rundeck secrets engine"
|
||||
version: "2"
|
||||
max_versions: 5
|
||||
17
config/pki_mount_only/pki_int.yaml
Normal file
17
config/pki_mount_only/pki_int.yaml
Normal file
@ -0,0 +1,17 @@
|
||||
description: "PKI Intermediate CA"
|
||||
max_lease_ttl_seconds: 157680000 # 43800 hours * 3600
|
||||
issuer_ref: "default"
|
||||
issuing_certificates:
|
||||
- "https://vault.service.consul:8200/v1/pki_int/ca"
|
||||
crl_distribution_points:
|
||||
- "https://vault.service.consul:8200/v1/pki_int/crl"
|
||||
ocsp_servers: []
|
||||
enable_templating: false
|
||||
default_issuer_ref: null
|
||||
default_follows_latest_issuer: false
|
||||
crl_expiry: "72h"
|
||||
crl_disable: false
|
||||
ocsp_disable: false
|
||||
auto_rebuild: false
|
||||
enable_delta: false
|
||||
delta_rebuild_interval: null
|
||||
17
config/pki_mount_only/pki_root.yaml
Normal file
17
config/pki_mount_only/pki_root.yaml
Normal file
@ -0,0 +1,17 @@
|
||||
description: "PKI Root CA"
|
||||
max_lease_ttl_seconds: 315360000 # 10 years
|
||||
issuer_ref: "default"
|
||||
issuing_certificates:
|
||||
- "https://vault.service.consul:8200/v1/pki_root/ca"
|
||||
crl_distribution_points:
|
||||
- "https://vault.service.consul:8200/v1/pki_root/crl"
|
||||
ocsp_servers: []
|
||||
enable_templating: false
|
||||
default_issuer_ref: null
|
||||
default_follows_latest_issuer: false
|
||||
crl_expiry: "72h"
|
||||
crl_disable: false
|
||||
ocsp_disable: false
|
||||
auto_rebuild: false
|
||||
enable_delta: false
|
||||
delta_rebuild_interval: null
|
||||
18
config/pki_secret_backend/pki/au/syd1.yaml
Normal file
18
config/pki_secret_backend/pki/au/syd1.yaml
Normal file
@ -0,0 +1,18 @@
|
||||
description: "PKI Root CA AU SYD1"
|
||||
max_lease_ttl_seconds: 315360000 # 87600 * 3600
|
||||
common_name: "unkin.net AU SYD1 Root CA"
|
||||
issuer_name: "UNKIN_AU_SYD1_ROOTCA_2024"
|
||||
ttl: 315360000 # 87600 * 3600
|
||||
format: "pem"
|
||||
issuing_certificates:
|
||||
- "https://vault.service.consul:8200/v1/pki/au/syd1/ca"
|
||||
crl_distribution_points:
|
||||
- "https://vault.service.consul:8200/v1/pki/au/syd1/crl"
|
||||
ocsp_servers: []
|
||||
enable_templating: false
|
||||
default_follows_latest_issuer: false
|
||||
crl_expiry: "72h"
|
||||
crl_disable: false
|
||||
ocsp_disable: false
|
||||
auto_rebuild: false
|
||||
enable_delta: false
|
||||
@ -0,0 +1,16 @@
|
||||
allow_ip_sans: true
|
||||
allowed_domains:
|
||||
- "unkin.net"
|
||||
- "*.unkin.net"
|
||||
- "localhost"
|
||||
allow_subdomains: true
|
||||
allow_glob_domains: true
|
||||
allow_bare_domains: true
|
||||
enforce_hostnames: true
|
||||
allow_any_name: true
|
||||
max_ttl: 7776000 # 2160 * 3600
|
||||
key_bits: 4096
|
||||
country:
|
||||
- "Australia"
|
||||
use_csr_common_name: true
|
||||
use_csr_sans: true
|
||||
16
config/pki_secret_backend_role/pki_int/servers_default.yaml
Normal file
16
config/pki_secret_backend_role/pki_int/servers_default.yaml
Normal file
@ -0,0 +1,16 @@
|
||||
allow_ip_sans: true
|
||||
allowed_domains:
|
||||
- "unkin.net"
|
||||
- "*.unkin.net"
|
||||
- "localhost"
|
||||
allow_subdomains: true
|
||||
allow_glob_domains: true
|
||||
allow_bare_domains: true
|
||||
enforce_hostnames: true
|
||||
allow_any_name: true
|
||||
max_ttl: 7776000 # 2160 * 3600
|
||||
key_bits: 4096
|
||||
country:
|
||||
- "Australia"
|
||||
use_csr_common_name: true
|
||||
use_csr_sans: true
|
||||
14
config/pki_secret_backend_role/pki_root/2024-servers.yaml
Normal file
14
config/pki_secret_backend_role/pki_root/2024-servers.yaml
Normal file
@ -0,0 +1,14 @@
|
||||
allow_ip_sans: true
|
||||
allowed_domains:
|
||||
- "unkin.net"
|
||||
- "unkin.local"
|
||||
allow_subdomains: true
|
||||
allow_glob_domains: false
|
||||
allow_bare_domains: true
|
||||
enforce_hostnames: false
|
||||
allow_any_name: false
|
||||
max_ttl: 31536000 # 8760h in seconds
|
||||
key_bits: 2048
|
||||
country: []
|
||||
use_csr_common_name: true
|
||||
use_csr_sans: true
|
||||
4
config/ssh_secret_backend/sshca.yaml
Normal file
4
config/ssh_secret_backend/sshca.yaml
Normal file
@ -0,0 +1,4 @@
|
||||
description: "SSH CA Engine"
|
||||
max_lease_ttl_seconds: 315360000 # 87600 * 3600
|
||||
generate_signing_key: true
|
||||
key_type: ssh-rsa
|
||||
8
config/ssh_secret_backend_role/sshca/signhost.yaml
Normal file
8
config/ssh_secret_backend_role/sshca/signhost.yaml
Normal file
@ -0,0 +1,8 @@
|
||||
key_type: ca
|
||||
algorithm_signer: rsa-sha2-256
|
||||
ttl: 315360000 # 87600 * 3600
|
||||
allow_host_certificates: true
|
||||
allow_user_certificates: false
|
||||
allowed_domains: "main.unkin.net,consul"
|
||||
allow_subdomains: true
|
||||
allow_bare_domains: false
|
||||
3
config/transit_secret_backend/transit.yaml
Normal file
3
config/transit_secret_backend/transit.yaml
Normal file
@ -0,0 +1,3 @@
|
||||
description: "Transit Engine"
|
||||
default_lease_ttl_seconds: 3600
|
||||
max_lease_ttl_seconds: 86400
|
||||
@ -0,0 +1,5 @@
|
||||
type: aes256-gcm96
|
||||
deletion_allowed: false
|
||||
derived: false
|
||||
exportable: false
|
||||
allow_plaintext_backup: false
|
||||
@ -1,72 +0,0 @@
|
||||
# Data source to read the service_token_jwt from Vault KV
|
||||
data "vault_kv_secret_v2" "service_account_jwt_au_syd1" {
|
||||
mount = "kv"
|
||||
name = "service/kubernetes/au/syd1/service_account_jwt"
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_secret_backend" "kubernetes_au_syd1" {
|
||||
path = "kubernetes/au/syd1"
|
||||
description = "kubernetes secret engine for au-syd1 cluster"
|
||||
default_lease_ttl_seconds = 600
|
||||
max_lease_ttl_seconds = 86400
|
||||
kubernetes_host = "https://api-k8s.service.consul:6443"
|
||||
kubernetes_ca_cert = local.kubernetes_ca_cert_au_syd1
|
||||
service_account_jwt = data.vault_kv_secret_v2.service_account_jwt_au_syd1.data["token"]
|
||||
disable_local_ca_jwt = false
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_secret_backend_role" "media_apps_operator" {
|
||||
backend = vault_kubernetes_secret_backend.kubernetes_au_syd1.path
|
||||
name = "vault-media-apps-operator"
|
||||
allowed_kubernetes_namespaces = ["media-apps"]
|
||||
kubernetes_role_type = "Role"
|
||||
|
||||
generated_role_rules = file("${path.module}/resources/k8s/syd1/au/generated_role_rules/media-apps-operator.yaml")
|
||||
|
||||
extra_labels = {
|
||||
vault-region = "au-syd1"
|
||||
vault-role = "vault-media-apps-operator"
|
||||
}
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_secret_backend_role" "cluster_operator" {
|
||||
backend = vault_kubernetes_secret_backend.kubernetes_au_syd1.path
|
||||
name = "vault-cluster-operator"
|
||||
allowed_kubernetes_namespaces = ["*"]
|
||||
kubernetes_role_type = "ClusterRole"
|
||||
|
||||
generated_role_rules = file("${path.module}/resources/k8s/syd1/au/generated_role_rules/cluster-operator.yaml")
|
||||
|
||||
extra_labels = {
|
||||
vault-region = "au-syd1"
|
||||
vault-role = "vault-cluster-operator"
|
||||
}
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_secret_backend_role" "cluster_admin" {
|
||||
backend = vault_kubernetes_secret_backend.kubernetes_au_syd1.path
|
||||
name = "vault-cluster-admin"
|
||||
allowed_kubernetes_namespaces = ["*"]
|
||||
kubernetes_role_type = "ClusterRole"
|
||||
|
||||
generated_role_rules = file("${path.module}/resources/k8s/syd1/au/generated_role_rules/cluster-admin.yaml")
|
||||
|
||||
extra_labels = {
|
||||
vault-region = "au-syd1"
|
||||
vault-role = "vault-cluster-admin"
|
||||
}
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_secret_backend_role" "cluster_root" {
|
||||
backend = vault_kubernetes_secret_backend.kubernetes_au_syd1.path
|
||||
name = "vault-cluster-root"
|
||||
allowed_kubernetes_namespaces = ["*"]
|
||||
kubernetes_role_type = "ClusterRole"
|
||||
|
||||
generated_role_rules = file("${path.module}/resources/k8s/syd1/au/generated_role_rules/cluster-root.yaml")
|
||||
|
||||
extra_labels = {
|
||||
vault-region = "au-syd1"
|
||||
vault-role = "vault-cluster-root"
|
||||
}
|
||||
}
|
||||
15
engine_kv.tf
15
engine_kv.tf
@ -1,15 +0,0 @@
|
||||
#--------------------------------------------------------------
|
||||
# kv
|
||||
# create engine
|
||||
#--------------------------------------------------------------
|
||||
resource "vault_mount" "kv" {
|
||||
path = "kv"
|
||||
type = "kv"
|
||||
listing_visibility = "hidden"
|
||||
max_lease_ttl_seconds = 0
|
||||
external_entropy_access = false
|
||||
seal_wrap = false
|
||||
options = {
|
||||
version = "2"
|
||||
}
|
||||
}
|
||||
@ -1,49 +0,0 @@
|
||||
#--------------------------------------------------------------
|
||||
# pki_int
|
||||
# create engine
|
||||
# generate intermediate csa
|
||||
# sign the intermediate against rootca
|
||||
# set the signed intermediate cert in the pki_int engine
|
||||
#--------------------------------------------------------------
|
||||
resource "vault_mount" "pki_int" {
|
||||
path = "pki_int"
|
||||
type = "pki"
|
||||
description = "PKI Intermediate CA"
|
||||
max_lease_ttl_seconds = 43800 * 3600 # 43800 hours
|
||||
}
|
||||
|
||||
## Generate the intermediate CSR
|
||||
#resource "vault_pki_secret_backend_intermediate_cert_request" "pki_int_intermediate" {
|
||||
# backend = vault_mount.pki_int.path
|
||||
# common_name = "unkin.net Intermediate Authority"
|
||||
# format = "pem"
|
||||
# type = "internal"
|
||||
#}
|
||||
#
|
||||
## Sign the intermediate CSR using the root CA
|
||||
#resource "vault_generic_endpoint" "pki_root_sign_intermediate" {
|
||||
# path = "${vault_mount.pki_root.path}/root/sign-intermediate"
|
||||
#
|
||||
# data_json = jsonencode({
|
||||
# csr = vault_pki_secret_backend_intermediate_cert_request.pki_int_intermediate.csr,
|
||||
# format = "pem_bundle",
|
||||
# ttl = "43800h",
|
||||
# issuer_ref = "UNKIN_ROOTCA_2024"
|
||||
# })
|
||||
#}
|
||||
#
|
||||
## Decode the certificate from the response
|
||||
#locals {
|
||||
# intermediate_signed_cert = vault_generic_endpoint.pki_root_sign_intermediate.write_data["certificate"]
|
||||
#}
|
||||
#
|
||||
## Set the signed intermediate certificate
|
||||
#resource "vault_pki_secret_backend_intermediate_set_signed" "pki_int_set_signed" {
|
||||
# backend = vault_mount.pki_int.path
|
||||
# certificate = local.intermediate_signed_cert
|
||||
#}
|
||||
|
||||
#data "vault_pki_secret_backend_issuer" "pki_int_issuer" {
|
||||
# backend = vault_mount.pki_int.path
|
||||
# issuer_ref = data.vault_pki_secret_backend_root_cert.root.issuer_id
|
||||
#}
|
||||
@ -1,39 +0,0 @@
|
||||
#-------------------------------------------
|
||||
# pki_root:
|
||||
# create engine
|
||||
# generate rootca certificate
|
||||
# read the issuer
|
||||
# configure the pki urls
|
||||
#-------------------------------------------
|
||||
resource "vault_mount" "pki_root" {
|
||||
path = "pki_root"
|
||||
type = "pki"
|
||||
description = "PKI Root CA"
|
||||
max_lease_ttl_seconds = 87600 * 3600 # 87600h
|
||||
}
|
||||
|
||||
#resource "vault_pki_secret_backend_root_cert" "pki_root_root_cert" {
|
||||
# backend = vault_mount.pki_root.path
|
||||
# common_name = "unkin.net"
|
||||
# issuer_name = "UNKIN_ROOTCA_2024"
|
||||
# ttl = 87600 * 3600
|
||||
# format = "pem"
|
||||
# type = "internal"
|
||||
#}
|
||||
#
|
||||
#output "root_certificate" {
|
||||
# value = vault_pki_secret_backend_root_cert.pki_root_root_cert.certificate
|
||||
# sensitive = true
|
||||
#}
|
||||
|
||||
data "vault_pki_secret_backend_issuer" "pki_root_issuer" {
|
||||
backend = vault_mount.pki_root.path
|
||||
issuer_ref = "default"
|
||||
}
|
||||
|
||||
resource "vault_pki_secret_backend_config_urls" "pki_root_urls" {
|
||||
backend = vault_mount.pki_root.path
|
||||
|
||||
issuing_certificates = ["${local.vault_addr}/v1/pki_root/ca"]
|
||||
crl_distribution_points = ["${local.vault_addr}/v1/pki_root/crl"]
|
||||
}
|
||||
@ -1,14 +0,0 @@
|
||||
#--------------------------------------------------------------
|
||||
# rundeck
|
||||
# create engine
|
||||
#--------------------------------------------------------------
|
||||
resource "vault_mount" "rundeck" {
|
||||
path = "rundeck"
|
||||
type = "kv"
|
||||
max_lease_ttl_seconds = 0
|
||||
external_entropy_access = false
|
||||
seal_wrap = false
|
||||
options = {
|
||||
version = "2"
|
||||
}
|
||||
}
|
||||
@ -1,18 +0,0 @@
|
||||
#--------------------------------------------------------------
|
||||
# ssh-host-signer
|
||||
# create engine
|
||||
# generate ca cert
|
||||
# tune the ssh engine
|
||||
#--------------------------------------------------------------
|
||||
#resource "vault_mount" "ssh_host_signer" {
|
||||
# path = "ssh-host-signer"
|
||||
# type = "ssh"
|
||||
# description = "SSH Host Signing Engine"
|
||||
# max_lease_ttl_seconds = 87600 * 3600
|
||||
#}
|
||||
#
|
||||
#resource "vault_ssh_secret_backend_ca" "ssh_host_signer_ca" {
|
||||
# backend = vault_mount.ssh_host_signer.path
|
||||
# generate_signing_key = false # change to true for new configuration
|
||||
# key_type = "ssh-rsa"
|
||||
#}
|
||||
@ -1,18 +0,0 @@
|
||||
#--------------------------------------------------------------
|
||||
# ssh
|
||||
# create engine
|
||||
# generate ca cert
|
||||
# tune the ssh engine
|
||||
#--------------------------------------------------------------
|
||||
resource "vault_mount" "sshca" {
|
||||
path = "sshca"
|
||||
type = "ssh"
|
||||
description = "SSH CA Engine"
|
||||
max_lease_ttl_seconds = 87600 * 3600
|
||||
}
|
||||
|
||||
resource "vault_ssh_secret_backend_ca" "ssh_ca" {
|
||||
backend = vault_mount.sshca.path
|
||||
generate_signing_key = true
|
||||
key_type = "ssh-rsa"
|
||||
}
|
||||
@ -1,13 +0,0 @@
|
||||
resource "vault_mount" "transit" {
|
||||
path = "transit"
|
||||
type = "transit"
|
||||
description = "Transit Engine"
|
||||
default_lease_ttl_seconds = 3600
|
||||
max_lease_ttl_seconds = 86400
|
||||
}
|
||||
|
||||
resource "vault_transit_secret_backend_key" "key" {
|
||||
backend = vault_mount.transit.path
|
||||
name = "au-syd1-k8s-vso"
|
||||
type = "aes256-gcm96"
|
||||
}
|
||||
60
environments/au/syd1/terragrunt.hcl
Normal file
60
environments/au/syd1/terragrunt.hcl
Normal file
@ -0,0 +1,60 @@
|
||||
include "root" {
|
||||
path = find_in_parent_folders("root.hcl")
|
||||
expose = true
|
||||
}
|
||||
|
||||
include "config" {
|
||||
path = "${get_repo_root()}/config/config.hcl"
|
||||
expose = true
|
||||
}
|
||||
|
||||
include "policies" {
|
||||
path = "${get_repo_root()}/policies/policies.hcl"
|
||||
expose = true
|
||||
}
|
||||
|
||||
locals {
|
||||
# Extract country and region from path
|
||||
path_parts = split("/", dirname(get_terragrunt_dir()))
|
||||
country = basename(dirname(get_terragrunt_dir())) # "au"
|
||||
region = basename(get_terragrunt_dir()) # "syd1"
|
||||
|
||||
# Include configuration from config.hcl
|
||||
config = include.config.locals.config
|
||||
|
||||
# Include policies from policies.hcl
|
||||
policies = include.policies.locals
|
||||
}
|
||||
|
||||
terraform {
|
||||
source = "../../../modules/vault_cluster"
|
||||
}
|
||||
|
||||
inputs = {
|
||||
country = local.country
|
||||
region = local.region
|
||||
|
||||
# Pass configuration maps to vault_cluster module
|
||||
auth_approle_backend = local.config.auth_approle_backend
|
||||
auth_approle_role = local.config.auth_approle_role
|
||||
auth_ldap_backend = local.config.auth_ldap_backend
|
||||
auth_ldap_group = local.config.auth_ldap_group
|
||||
auth_kubernetes_backend = local.config.auth_kubernetes_backend
|
||||
auth_kubernetes_role = local.config.auth_kubernetes_role
|
||||
kv_secret_backend = local.config.kv_secret_backend
|
||||
transit_secret_backend = local.config.transit_secret_backend
|
||||
transit_secret_backend_key = local.config.transit_secret_backend_key
|
||||
ssh_secret_backend = local.config.ssh_secret_backend
|
||||
ssh_secret_backend_role = local.config.ssh_secret_backend_role
|
||||
pki_secret_backend = local.config.pki_secret_backend
|
||||
pki_secret_backend_role = local.config.pki_secret_backend_role
|
||||
consul_secret_backend = local.config.consul_secret_backend
|
||||
consul_secret_backend_role = local.config.consul_secret_backend_role
|
||||
kubernetes_secret_backend = local.config.kubernetes_secret_backend
|
||||
kubernetes_secret_backend_role = local.config.kubernetes_secret_backend_role
|
||||
pki_mount_only = local.config.pki_mount_only
|
||||
|
||||
# Pass policy maps to vault_cluster module
|
||||
policy_auth_map = local.policies.policy_auth_map
|
||||
policy_rules_map = local.policies.policy_rules_map
|
||||
}
|
||||
@ -1,3 +1,8 @@
|
||||
# Generate root backend.tf
|
||||
generate "backend" {
|
||||
path = "backend.tf"
|
||||
if_exists = "overwrite"
|
||||
contents = <<EOF
|
||||
#-------------------------------------------
|
||||
# locals
|
||||
#-------------------------------------------
|
||||
@ -22,7 +27,7 @@ provider "vault" {
|
||||
terraform {
|
||||
backend "consul" {
|
||||
address = "https://consul.service.consul"
|
||||
path = "infra/terraform/vault/state"
|
||||
path = "infra/terraform/vault/${path_relative_to_include()}/state"
|
||||
scheme = "https"
|
||||
lock = true
|
||||
ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
|
||||
@ -31,7 +36,9 @@ terraform {
|
||||
required_providers {
|
||||
vault = {
|
||||
source = "hashicorp/vault"
|
||||
version = "5.4.0"
|
||||
version = "5.6.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
}
|
||||
316
modules/vault_cluster/main.tf
Normal file
316
modules/vault_cluster/main.tf
Normal file
@ -0,0 +1,316 @@
|
||||
module "auth_approle_backend" {
|
||||
source = "./modules/auth_approle_backend"
|
||||
|
||||
for_each = var.auth_approle_backend
|
||||
|
||||
country = var.country
|
||||
region = var.region
|
||||
path = each.key
|
||||
listing_visibility = each.value.listing_visibility
|
||||
default_lease_ttl = each.value.default_lease_ttl
|
||||
max_lease_ttl = each.value.max_lease_ttl
|
||||
}
|
||||
|
||||
module "auth_approle_role" {
|
||||
source = "./modules/auth_approle_role"
|
||||
|
||||
for_each = var.auth_approle_role
|
||||
|
||||
country = var.country
|
||||
region = var.region
|
||||
approle_name = each.value.approle_name
|
||||
mount_path = each.value.mount_path
|
||||
token_policies = var.policy_auth_map[each.value.mount_path][each.value.approle_name]
|
||||
token_ttl = each.value.token_ttl
|
||||
token_max_ttl = each.value.token_max_ttl
|
||||
bind_secret_id = each.value.bind_secret_id
|
||||
secret_id_ttl = each.value.secret_id_ttl
|
||||
token_bound_cidrs = each.value.token_bound_cidrs
|
||||
alias_metadata = each.value.alias_metadata
|
||||
use_deterministic_role_id = each.value.use_deterministic_role_id
|
||||
|
||||
depends_on = [module.auth_approle_backend]
|
||||
}
|
||||
|
||||
module "auth_ldap_backend" {
|
||||
source = "./modules/auth_ldap_backend"
|
||||
|
||||
for_each = var.auth_ldap_backend
|
||||
|
||||
country = var.country
|
||||
region = var.region
|
||||
path = each.key
|
||||
userdn = each.value.userdn
|
||||
userattr = each.value.userattr
|
||||
upndomain = each.value.upndomain
|
||||
discoverdn = each.value.discoverdn
|
||||
groupdn = each.value.groupdn
|
||||
groupfilter = each.value.groupfilter
|
||||
groupattr = each.value.groupattr
|
||||
alias_metadata = each.value.alias_metadata
|
||||
username_as_alias = each.value.username_as_alias
|
||||
listing_visibility = each.value.listing_visibility
|
||||
default_lease_ttl = each.value.default_lease_ttl
|
||||
max_lease_ttl = each.value.max_lease_ttl
|
||||
}
|
||||
|
||||
module "auth_ldap_group" {
|
||||
source = "./modules/auth_ldap_group"
|
||||
|
||||
for_each = var.auth_ldap_group
|
||||
|
||||
groupname = each.value.groupname
|
||||
backend = each.value.backend
|
||||
policies = var.policy_auth_map[each.value.backend][each.value.groupname]
|
||||
|
||||
depends_on = [module.auth_ldap_backend]
|
||||
}
|
||||
|
||||
module "auth_kubernetes_backend" {
|
||||
source = "./modules/auth_kubernetes_backend"
|
||||
|
||||
for_each = var.auth_kubernetes_backend
|
||||
|
||||
country = var.country
|
||||
region = var.region
|
||||
path = each.key
|
||||
kubernetes_host = each.value.kubernetes_host
|
||||
disable_iss_validation = each.value.disable_iss_validation
|
||||
use_annotations_as_alias_metadata = each.value.use_annotations_as_alias_metadata
|
||||
listing_visibility = each.value.listing_visibility
|
||||
default_lease_ttl = each.value.default_lease_ttl
|
||||
max_lease_ttl = each.value.max_lease_ttl
|
||||
}
|
||||
|
||||
module "auth_kubernetes_role" {
|
||||
source = "./modules/auth_kubernetes_role"
|
||||
|
||||
for_each = var.auth_kubernetes_role
|
||||
|
||||
role_name = each.value.role_name
|
||||
backend = each.value.backend
|
||||
bound_service_account_names = each.value.bound_service_account_names
|
||||
bound_service_account_namespaces = each.value.bound_service_account_namespaces
|
||||
token_ttl = each.value.token_ttl
|
||||
token_policies = var.policy_auth_map[each.value.backend][each.value.role_name]
|
||||
audience = each.value.audience
|
||||
|
||||
depends_on = [module.auth_kubernetes_backend]
|
||||
}
|
||||
|
||||
module "kv_secret_backend" {
|
||||
source = "./modules/kv_secret_backend"
|
||||
|
||||
for_each = var.kv_secret_backend
|
||||
|
||||
path = each.key
|
||||
type = each.value.type
|
||||
description = each.value.description
|
||||
kv_version = each.value.version
|
||||
max_versions = each.value.max_versions
|
||||
}
|
||||
|
||||
module "transit_secret_backend" {
|
||||
source = "./modules/transit_secret_backend"
|
||||
|
||||
for_each = var.transit_secret_backend
|
||||
|
||||
path = each.key
|
||||
description = each.value.description
|
||||
default_lease_ttl_seconds = each.value.default_lease_ttl_seconds
|
||||
max_lease_ttl_seconds = each.value.max_lease_ttl_seconds
|
||||
}
|
||||
|
||||
module "transit_secret_backend_key" {
|
||||
source = "./modules/transit_secret_backend_key"
|
||||
|
||||
for_each = var.transit_secret_backend_key
|
||||
|
||||
name = each.value.name
|
||||
backend = each.value.backend
|
||||
type = each.value.type
|
||||
deletion_allowed = each.value.deletion_allowed
|
||||
derived = each.value.derived
|
||||
exportable = each.value.exportable
|
||||
allow_plaintext_backup = each.value.allow_plaintext_backup
|
||||
auto_rotate_period = each.value.auto_rotate_period
|
||||
|
||||
depends_on = [module.transit_secret_backend]
|
||||
}
|
||||
|
||||
module "ssh_secret_backend" {
|
||||
source = "./modules/ssh_secret_backend"
|
||||
|
||||
for_each = var.ssh_secret_backend
|
||||
|
||||
path = each.key
|
||||
description = each.value.description
|
||||
max_lease_ttl_seconds = each.value.max_lease_ttl_seconds
|
||||
generate_signing_key = each.value.generate_signing_key
|
||||
key_type = each.value.key_type
|
||||
}
|
||||
|
||||
module "ssh_secret_backend_role" {
|
||||
source = "./modules/ssh_secret_backend_role"
|
||||
|
||||
for_each = var.ssh_secret_backend_role
|
||||
|
||||
name = each.value.name
|
||||
backend = each.value.backend
|
||||
key_type = each.value.key_type
|
||||
algorithm_signer = each.value.algorithm_signer
|
||||
ttl = each.value.ttl
|
||||
allow_host_certificates = each.value.allow_host_certificates
|
||||
allow_user_certificates = each.value.allow_user_certificates
|
||||
allowed_domains = each.value.allowed_domains
|
||||
allow_subdomains = each.value.allow_subdomains
|
||||
allow_bare_domains = each.value.allow_bare_domains
|
||||
|
||||
depends_on = [module.ssh_secret_backend]
|
||||
}
|
||||
|
||||
module "pki_secret_backend" {
|
||||
source = "./modules/pki_secret_backend"
|
||||
|
||||
for_each = var.pki_secret_backend
|
||||
|
||||
path = each.key
|
||||
description = each.value.description
|
||||
max_lease_ttl_seconds = each.value.max_lease_ttl_seconds
|
||||
common_name = each.value.common_name
|
||||
issuer_name = each.value.issuer_name
|
||||
ttl = each.value.ttl
|
||||
format = each.value.format
|
||||
issuing_certificates = each.value.issuing_certificates
|
||||
crl_distribution_points = each.value.crl_distribution_points
|
||||
ocsp_servers = each.value.ocsp_servers
|
||||
enable_templating = each.value.enable_templating
|
||||
default_issuer_ref = each.value.default_issuer_ref
|
||||
default_follows_latest_issuer = each.value.default_follows_latest_issuer
|
||||
crl_expiry = each.value.crl_expiry
|
||||
crl_disable = each.value.crl_disable
|
||||
ocsp_disable = each.value.ocsp_disable
|
||||
auto_rebuild = each.value.auto_rebuild
|
||||
enable_delta = each.value.enable_delta
|
||||
delta_rebuild_interval = each.value.delta_rebuild_interval
|
||||
}
|
||||
|
||||
module "pki_secret_backend_role" {
|
||||
source = "./modules/pki_secret_backend_role"
|
||||
|
||||
for_each = var.pki_secret_backend_role
|
||||
|
||||
name = each.value.name
|
||||
backend = each.value.backend
|
||||
allow_ip_sans = each.value.allow_ip_sans
|
||||
allowed_domains = each.value.allowed_domains
|
||||
allow_subdomains = each.value.allow_subdomains
|
||||
allow_glob_domains = each.value.allow_glob_domains
|
||||
allow_bare_domains = each.value.allow_bare_domains
|
||||
enforce_hostnames = each.value.enforce_hostnames
|
||||
allow_any_name = each.value.allow_any_name
|
||||
max_ttl = each.value.max_ttl
|
||||
key_bits = each.value.key_bits
|
||||
country = each.value.country
|
||||
use_csr_common_name = each.value.use_csr_common_name
|
||||
use_csr_sans = each.value.use_csr_sans
|
||||
|
||||
depends_on = [module.pki_secret_backend]
|
||||
}
|
||||
|
||||
module "consul_secret_backend" {
|
||||
source = "./modules/consul_secret_backend"
|
||||
|
||||
for_each = var.consul_secret_backend
|
||||
|
||||
country = var.country
|
||||
region = var.region
|
||||
path = each.key
|
||||
description = each.value.description
|
||||
address = each.value.address
|
||||
bootstrap = each.value.bootstrap
|
||||
scheme = each.value.scheme
|
||||
ca_cert = each.value.ca_cert
|
||||
client_cert = each.value.client_cert
|
||||
client_key = each.value.client_key
|
||||
default_lease_ttl_seconds = each.value.default_lease_ttl_seconds
|
||||
max_lease_ttl_seconds = each.value.max_lease_ttl_seconds
|
||||
}
|
||||
|
||||
module "consul_secret_backend_role" {
|
||||
source = "./modules/consul_secret_backend_role"
|
||||
|
||||
for_each = var.consul_secret_backend_role
|
||||
|
||||
name = each.value.name
|
||||
backend = each.value.backend
|
||||
consul_roles = each.value.consul_roles
|
||||
ttl = each.value.ttl
|
||||
max_ttl = each.value.max_ttl
|
||||
local = each.value.local
|
||||
|
||||
depends_on = [module.consul_secret_backend]
|
||||
}
|
||||
|
||||
module "kubernetes_secret_backend" {
|
||||
source = "./modules/kubernetes_secret_backend"
|
||||
|
||||
for_each = var.kubernetes_secret_backend
|
||||
|
||||
country = var.country
|
||||
region = var.region
|
||||
path = each.key
|
||||
description = each.value.description
|
||||
default_lease_ttl_seconds = each.value.default_lease_ttl_seconds
|
||||
max_lease_ttl_seconds = each.value.max_lease_ttl_seconds
|
||||
kubernetes_host = each.value.kubernetes_host
|
||||
disable_local_ca_jwt = each.value.disable_local_ca_jwt
|
||||
}
|
||||
|
||||
module "kubernetes_secret_backend_role" {
|
||||
source = "./modules/kubernetes_secret_backend_role"
|
||||
|
||||
for_each = var.kubernetes_secret_backend_role
|
||||
|
||||
country = var.country
|
||||
region = var.region
|
||||
name = each.value.name
|
||||
backend = each.value.backend
|
||||
allowed_kubernetes_namespaces = each.value.allowed_kubernetes_namespaces
|
||||
kubernetes_role_type = each.value.kubernetes_role_type
|
||||
extra_labels = each.value.extra_labels
|
||||
|
||||
depends_on = [module.kubernetes_secret_backend]
|
||||
}
|
||||
|
||||
module "vault_policy" {
|
||||
source = "./modules/vault_policy"
|
||||
|
||||
for_each = var.policy_rules_map
|
||||
|
||||
policy_name = each.key
|
||||
policy_rules = each.value
|
||||
}
|
||||
|
||||
module "pki_mount_only" {
|
||||
source = "./modules/pki_mount_only"
|
||||
|
||||
for_each = var.pki_mount_only
|
||||
|
||||
path = each.key
|
||||
description = each.value.description
|
||||
max_lease_ttl_seconds = each.value.max_lease_ttl_seconds
|
||||
issuer_ref = each.value.issuer_ref
|
||||
issuing_certificates = each.value.issuing_certificates
|
||||
crl_distribution_points = each.value.crl_distribution_points
|
||||
ocsp_servers = each.value.ocsp_servers
|
||||
enable_templating = each.value.enable_templating
|
||||
default_issuer_ref = each.value.default_issuer_ref
|
||||
default_follows_latest_issuer = each.value.default_follows_latest_issuer
|
||||
crl_expiry = each.value.crl_expiry
|
||||
crl_disable = each.value.crl_disable
|
||||
ocsp_disable = each.value.ocsp_disable
|
||||
auto_rebuild = each.value.auto_rebuild
|
||||
enable_delta = each.value.enable_delta
|
||||
delta_rebuild_interval = each.value.delta_rebuild_interval
|
||||
}
|
||||
11
modules/vault_cluster/modules/auth_approle_backend/main.tf
Normal file
11
modules/vault_cluster/modules/auth_approle_backend/main.tf
Normal file
@ -0,0 +1,11 @@
|
||||
|
||||
resource "vault_auth_backend" "approle" {
|
||||
type = "approle"
|
||||
path = var.path
|
||||
|
||||
tune {
|
||||
default_lease_ttl = var.default_lease_ttl
|
||||
max_lease_ttl = var.max_lease_ttl
|
||||
listing_visibility = var.listing_visibility
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,4 @@
|
||||
output "backend" {
|
||||
description = "The created auth backend"
|
||||
value = vault_auth_backend.approle
|
||||
}
|
||||
@ -0,0 +1,37 @@
|
||||
variable "country" {
|
||||
description = "Country identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "Region identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "path" {
|
||||
description = "Mount path of the AppRole auth backend"
|
||||
type = string
|
||||
default = "approle"
|
||||
}
|
||||
|
||||
variable "listing_visibility" {
|
||||
description = "Specifies whether to show this mount in the UI-specific listing endpoint. Valid values are 'unauth' or 'hidden'"
|
||||
type = string
|
||||
default = null
|
||||
validation {
|
||||
condition = var.listing_visibility == null || contains(["unauth", "hidden"], var.listing_visibility)
|
||||
error_message = "listing_visibility must be either 'unauth' or 'hidden'."
|
||||
}
|
||||
}
|
||||
|
||||
variable "default_lease_ttl" {
|
||||
description = "Specifies the default time-to-live. If set, this overrides the global default. Must be a valid duration string"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "max_lease_ttl" {
|
||||
description = "Specifies the maximum time-to-live. If set, this overrides the global default. Must be a valid duration string"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
36
modules/vault_cluster/modules/auth_approle_role/main.tf
Normal file
36
modules/vault_cluster/modules/auth_approle_role/main.tf
Normal file
@ -0,0 +1,36 @@
|
||||
|
||||
# Expected keys in KV secret for salt: salt
|
||||
data "vault_kv_secret_v2" "salt_config" {
|
||||
mount = "kv"
|
||||
name = "service/vault/${var.country}/${var.region}/auth_backend/${var.mount_path}"
|
||||
}
|
||||
|
||||
# Expected keys in KV secret for role_id: role_id (when use_deterministic_role_id = false)
|
||||
data "vault_kv_secret_v2" "role_config" {
|
||||
count = var.use_deterministic_role_id ? 0 : 1
|
||||
|
||||
mount = "kv"
|
||||
name = "service/vault/${var.country}/${var.region}/auth_approle_role/${var.mount_path}/${var.approle_name}"
|
||||
}
|
||||
|
||||
locals {
|
||||
salt = data.vault_kv_secret_v2.salt_config.data["salt"]
|
||||
role_id_input = "${local.salt}-${var.approle_name}-${var.mount_path}"
|
||||
deterministic_role_id = uuidv5("dns", "${local.role_id_input}")
|
||||
|
||||
# Use deterministic role-id by default, or read from KV if specified
|
||||
role_id = var.use_deterministic_role_id ? local.deterministic_role_id : data.vault_kv_secret_v2.role_config[0].data["role_id"]
|
||||
}
|
||||
|
||||
resource "vault_approle_auth_backend_role" "role" {
|
||||
backend = var.mount_path
|
||||
role_name = var.approle_name
|
||||
role_id = local.role_id
|
||||
token_policies = var.token_policies
|
||||
token_ttl = var.token_ttl
|
||||
token_max_ttl = var.token_max_ttl
|
||||
bind_secret_id = var.bind_secret_id
|
||||
secret_id_ttl = var.secret_id_ttl
|
||||
token_bound_cidrs = var.token_bound_cidrs
|
||||
alias_metadata = var.alias_metadata
|
||||
}
|
||||
68
modules/vault_cluster/modules/auth_approle_role/variables.tf
Normal file
68
modules/vault_cluster/modules/auth_approle_role/variables.tf
Normal file
@ -0,0 +1,68 @@
|
||||
variable "country" {
|
||||
description = "Country identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "Region identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
|
||||
variable "approle_name" {
|
||||
description = "Name of the AppRole role"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "mount_path" {
|
||||
description = "Mount path of the AppRole auth backend"
|
||||
type = string
|
||||
default = "approle"
|
||||
}
|
||||
|
||||
variable "token_policies" {
|
||||
description = "List of policies to assign to the role (passed from policy_auth_map)"
|
||||
type = list(string)
|
||||
}
|
||||
|
||||
variable "token_ttl" {
|
||||
description = "The TTL period of tokens issued using this role"
|
||||
type = number
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "token_max_ttl" {
|
||||
description = "The maximum TTL period of tokens issued using this role"
|
||||
type = number
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "bind_secret_id" {
|
||||
description = "Whether or not to require secret_id to be presented when logging in using this AppRole"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "secret_id_ttl" {
|
||||
description = "The TTL period of SecretIDs generated against this AppRole"
|
||||
type = number
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "token_bound_cidrs" {
|
||||
description = "List of CIDR blocks that can authenticate using this role"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "alias_metadata" {
|
||||
description = "The metadata to be tied to generated entity alias. This should be a list or map containing the metadata in key value pairs"
|
||||
type = map(string)
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "use_deterministic_role_id" {
|
||||
description = "Whether to use deterministic role-id generation (true) or read pre-generated role-id from KV (false)"
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
@ -0,0 +1,25 @@
|
||||
# Expected keys in KV secret: kubernetes_ca_cert, token_reviewer_jwt
|
||||
data "vault_kv_secret_v2" "auth_backend_config" {
|
||||
mount = "kv"
|
||||
name = "service/vault/${var.country}/${var.region}/auth_backend/${var.path}"
|
||||
}
|
||||
|
||||
resource "vault_auth_backend" "kubernetes" {
|
||||
type = "kubernetes"
|
||||
path = var.path
|
||||
|
||||
tune {
|
||||
default_lease_ttl = var.default_lease_ttl
|
||||
max_lease_ttl = var.max_lease_ttl
|
||||
listing_visibility = var.listing_visibility
|
||||
}
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_auth_backend_config" "config" {
|
||||
backend = vault_auth_backend.kubernetes.path
|
||||
kubernetes_host = var.kubernetes_host
|
||||
kubernetes_ca_cert = data.vault_kv_secret_v2.auth_backend_config.data["kubernetes_ca_cert"]
|
||||
token_reviewer_jwt = data.vault_kv_secret_v2.auth_backend_config.data["token_reviewer_jwt"]
|
||||
disable_iss_validation = var.disable_iss_validation
|
||||
use_annotations_as_alias_metadata = var.use_annotations_as_alias_metadata
|
||||
}
|
||||
@ -0,0 +1,54 @@
|
||||
variable "country" {
|
||||
description = "Country identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "Region identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "path" {
|
||||
description = "Mount path of the Kubernetes auth backend"
|
||||
type = string
|
||||
default = "kubernetes"
|
||||
}
|
||||
|
||||
variable "disable_iss_validation" {
|
||||
description = "Disable JWT issuer validation"
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "use_annotations_as_alias_metadata" {
|
||||
description = "Use annotations as alias metadata"
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "listing_visibility" {
|
||||
description = "Specifies whether to show this mount in the UI-specific listing endpoint. Valid values are 'unauth' or 'hidden'"
|
||||
type = string
|
||||
default = null
|
||||
validation {
|
||||
condition = var.listing_visibility == null || contains(["unauth", "hidden"], var.listing_visibility)
|
||||
error_message = "listing_visibility must be either 'unauth' or 'hidden'."
|
||||
}
|
||||
}
|
||||
|
||||
variable "default_lease_ttl" {
|
||||
description = "Specifies the default time-to-live. If set, this overrides the global default. Must be a valid duration string"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "max_lease_ttl" {
|
||||
description = "Specifies the maximum time-to-live. If set, this overrides the global default. Must be a valid duration string"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "kubernetes_host" {
|
||||
description = "Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server"
|
||||
type = string
|
||||
}
|
||||
@ -0,0 +1,9 @@
|
||||
resource "vault_kubernetes_auth_backend_role" "role" {
|
||||
backend = var.backend
|
||||
role_name = var.role_name
|
||||
bound_service_account_names = var.bound_service_account_names
|
||||
bound_service_account_namespaces = var.bound_service_account_namespaces
|
||||
token_ttl = var.token_ttl
|
||||
token_policies = var.token_policies
|
||||
audience = var.audience
|
||||
}
|
||||
@ -0,0 +1,36 @@
|
||||
variable "backend" {
|
||||
description = "The unique path of the Kubernetes auth backend to configure"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "role_name" {
|
||||
description = "The name of the role"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "bound_service_account_names" {
|
||||
description = "List of service account names able to access this role"
|
||||
type = list(string)
|
||||
}
|
||||
|
||||
variable "bound_service_account_namespaces" {
|
||||
description = "List of namespaces allowed to access this role"
|
||||
type = list(string)
|
||||
}
|
||||
|
||||
variable "token_ttl" {
|
||||
description = "The TTL period of tokens issued using this role, in seconds"
|
||||
type = number
|
||||
default = 3600
|
||||
}
|
||||
|
||||
variable "token_policies" {
|
||||
description = "List of policies to assign to the role (passed from policy_auth_map)"
|
||||
type = list(string)
|
||||
}
|
||||
|
||||
variable "audience" {
|
||||
description = "Audience claim to verify in the JWT"
|
||||
type = string
|
||||
default = "vault"
|
||||
}
|
||||
27
modules/vault_cluster/modules/auth_ldap_backend/main.tf
Normal file
27
modules/vault_cluster/modules/auth_ldap_backend/main.tf
Normal file
@ -0,0 +1,27 @@
|
||||
# Expected keys in KV secret: url, binddn, bindpass
|
||||
data "vault_kv_secret_v2" "auth_backend_config" {
|
||||
mount = "kv"
|
||||
name = "service/vault/${var.country}/${var.region}/auth_backend/${var.path}"
|
||||
}
|
||||
|
||||
resource "vault_ldap_auth_backend" "ldap" {
|
||||
path = var.path
|
||||
url = data.vault_kv_secret_v2.auth_backend_config.data["url"]
|
||||
userdn = var.userdn
|
||||
userattr = var.userattr
|
||||
upndomain = var.upndomain
|
||||
discoverdn = var.discoverdn
|
||||
groupdn = var.groupdn
|
||||
groupfilter = var.groupfilter
|
||||
groupattr = var.groupattr
|
||||
binddn = data.vault_kv_secret_v2.auth_backend_config.data["binddn"]
|
||||
bindpass = data.vault_kv_secret_v2.auth_backend_config.data["bindpass"]
|
||||
alias_metadata = var.alias_metadata
|
||||
username_as_alias = var.username_as_alias
|
||||
|
||||
tune {
|
||||
default_lease_ttl = var.default_lease_ttl
|
||||
max_lease_ttl = var.max_lease_ttl
|
||||
listing_visibility = var.listing_visibility
|
||||
}
|
||||
}
|
||||
91
modules/vault_cluster/modules/auth_ldap_backend/variables.tf
Normal file
91
modules/vault_cluster/modules/auth_ldap_backend/variables.tf
Normal file
@ -0,0 +1,91 @@
|
||||
variable "country" {
|
||||
description = "Country identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "Region identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "path" {
|
||||
description = "Mount path of the LDAP auth backend"
|
||||
type = string
|
||||
default = "ldap"
|
||||
}
|
||||
|
||||
variable "userdn" {
|
||||
description = "Base DN under which to perform user search"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "userattr" {
|
||||
description = "Attribute on user objects matching the username"
|
||||
type = string
|
||||
default = "uid"
|
||||
}
|
||||
|
||||
variable "upndomain" {
|
||||
description = "UPN domain for users"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "discoverdn" {
|
||||
description = "Use anonymous bind to discover the bind DN of a user"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "groupdn" {
|
||||
description = "Base DN under which to perform group search"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "groupfilter" {
|
||||
description = "Go template for querying group membership"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "groupattr" {
|
||||
description = "LDAP attribute to follow on objects returned by groupfilter"
|
||||
type = string
|
||||
default = "cn"
|
||||
}
|
||||
|
||||
|
||||
variable "listing_visibility" {
|
||||
description = "Specifies whether to show this mount in the UI-specific listing endpoint. Valid values are 'unauth' or 'hidden'"
|
||||
type = string
|
||||
default = null
|
||||
validation {
|
||||
condition = var.listing_visibility == null || contains(["unauth", "hidden"], var.listing_visibility)
|
||||
error_message = "listing_visibility must be either 'unauth' or 'hidden'."
|
||||
}
|
||||
}
|
||||
|
||||
variable "default_lease_ttl" {
|
||||
description = "Specifies the default time-to-live. If set, this overrides the global default. Must be a valid duration string"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "max_lease_ttl" {
|
||||
description = "Specifies the maximum time-to-live. If set, this overrides the global default. Must be a valid duration string"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "alias_metadata" {
|
||||
description = "The metadata to be tied to generated entity alias. This should be a list or map containing the metadata in key value pairs"
|
||||
type = map(string)
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "username_as_alias" {
|
||||
description = "Force the auth method to use the username passed by the user as the alias name"
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
5
modules/vault_cluster/modules/auth_ldap_group/main.tf
Normal file
5
modules/vault_cluster/modules/auth_ldap_group/main.tf
Normal file
@ -0,0 +1,5 @@
|
||||
resource "vault_ldap_auth_backend_group" "group" {
|
||||
groupname = var.groupname
|
||||
policies = var.policies
|
||||
backend = var.backend
|
||||
}
|
||||
14
modules/vault_cluster/modules/auth_ldap_group/variables.tf
Normal file
14
modules/vault_cluster/modules/auth_ldap_group/variables.tf
Normal file
@ -0,0 +1,14 @@
|
||||
variable "groupname" {
|
||||
description = "Name of the LDAP group"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "policies" {
|
||||
description = "List of policies to assign to the LDAP group"
|
||||
type = list(string)
|
||||
}
|
||||
|
||||
variable "backend" {
|
||||
description = "Path of the LDAP auth backend"
|
||||
type = string
|
||||
}
|
||||
21
modules/vault_cluster/modules/consul_secret_backend/main.tf
Normal file
21
modules/vault_cluster/modules/consul_secret_backend/main.tf
Normal file
@ -0,0 +1,21 @@
|
||||
# Expected keys in KV secret: token (if not bootstrapping)
|
||||
data "vault_kv_secret_v2" "secret_backend_config" {
|
||||
count = var.bootstrap ? 0 : 1
|
||||
|
||||
mount = "kv"
|
||||
name = "service/vault/${var.country}/${var.region}/secret_backend/${var.path}"
|
||||
}
|
||||
|
||||
resource "vault_consul_secret_backend" "consul" {
|
||||
path = var.path
|
||||
description = var.description
|
||||
address = var.address
|
||||
token = var.bootstrap ? null : data.vault_kv_secret_v2.secret_backend_config[0].data["token"]
|
||||
bootstrap = var.bootstrap
|
||||
scheme = var.scheme
|
||||
ca_cert = var.ca_cert
|
||||
client_cert = var.client_cert
|
||||
client_key = var.client_key
|
||||
default_lease_ttl_seconds = var.default_lease_ttl_seconds
|
||||
max_lease_ttl_seconds = var.max_lease_ttl_seconds
|
||||
}
|
||||
@ -0,0 +1,67 @@
|
||||
variable "country" {
|
||||
description = "Country identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "Region identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "path" {
|
||||
description = "Mount path of the Consul secrets engine"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "description" {
|
||||
description = "Human-friendly description of the mount"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "address" {
|
||||
description = "The address of the Consul instance"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "bootstrap" {
|
||||
description = "Whether to bootstrap the Consul backend"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "scheme" {
|
||||
description = "The scheme to use when connecting to Consul"
|
||||
type = string
|
||||
default = "https"
|
||||
}
|
||||
|
||||
variable "ca_cert" {
|
||||
description = "CA certificate for TLS verification"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "client_cert" {
|
||||
description = "Client certificate for TLS authentication"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "client_key" {
|
||||
description = "Client key for TLS authentication"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "default_lease_ttl_seconds" {
|
||||
description = "Default lease TTL in seconds"
|
||||
type = number
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "max_lease_ttl_seconds" {
|
||||
description = "Maximum lease TTL in seconds"
|
||||
type = number
|
||||
default = null
|
||||
}
|
||||
@ -0,0 +1,8 @@
|
||||
resource "vault_consul_secret_backend_role" "role" {
|
||||
backend = var.backend
|
||||
name = var.name
|
||||
consul_roles = var.consul_roles
|
||||
ttl = var.ttl
|
||||
max_ttl = var.max_ttl
|
||||
local = var.local
|
||||
}
|
||||
@ -0,0 +1,35 @@
|
||||
variable "backend" {
|
||||
description = "The unique path where the Consul backend is mounted"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "name" {
|
||||
description = "The name of the role"
|
||||
type = string
|
||||
}
|
||||
|
||||
|
||||
variable "consul_roles" {
|
||||
description = "List of Consul roles to attach to tokens"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
|
||||
variable "ttl" {
|
||||
description = "TTL for generated tokens"
|
||||
type = number
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "max_ttl" {
|
||||
description = "Maximum TTL for generated tokens"
|
||||
type = number
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "local" {
|
||||
description = "Whether tokens should be local to the datacenter"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
@ -0,0 +1,16 @@
|
||||
# Expected keys in KV secret: service_account_jwt, kubernetes_ca_cert
|
||||
data "vault_kv_secret_v2" "secret_backend_config" {
|
||||
mount = "kv"
|
||||
name = "service/vault/${var.country}/${var.region}/secret_backend/${var.path}"
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_secret_backend" "kubernetes" {
|
||||
path = var.path
|
||||
description = var.description
|
||||
default_lease_ttl_seconds = var.default_lease_ttl_seconds
|
||||
max_lease_ttl_seconds = var.max_lease_ttl_seconds
|
||||
kubernetes_host = var.kubernetes_host
|
||||
kubernetes_ca_cert = data.vault_kv_secret_v2.secret_backend_config.data["kubernetes_ca_cert"]
|
||||
service_account_jwt = data.vault_kv_secret_v2.secret_backend_config.data["service_account_jwt"]
|
||||
disable_local_ca_jwt = var.disable_local_ca_jwt
|
||||
}
|
||||
@ -0,0 +1,43 @@
|
||||
variable "country" {
|
||||
description = "Country identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "Region identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "path" {
|
||||
description = "Mount path of the Kubernetes secrets engine"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "description" {
|
||||
description = "Human-friendly description of the mount"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "default_lease_ttl_seconds" {
|
||||
description = "Default lease TTL in seconds"
|
||||
type = number
|
||||
default = 600
|
||||
}
|
||||
|
||||
variable "max_lease_ttl_seconds" {
|
||||
description = "Maximum lease TTL in seconds"
|
||||
type = number
|
||||
default = 86400
|
||||
}
|
||||
|
||||
variable "kubernetes_host" {
|
||||
description = "The Kubernetes API server URL"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "disable_local_ca_jwt" {
|
||||
description = "Whether to disable local CA JWT validation"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
@ -0,0 +1,19 @@
|
||||
locals {
|
||||
# Auto-generate role rules path: resources/secret_backend/{backend_path}/roles/{role_name}.yaml
|
||||
role_rules_file = "resources/secret_backend/${var.backend}/roles/${var.name}.yaml"
|
||||
|
||||
# Auto-generate extra labels based on country/region and role name
|
||||
auto_labels = merge(var.extra_labels, {
|
||||
vault-region = "${var.country}-${var.region}"
|
||||
vault-role = var.name
|
||||
})
|
||||
}
|
||||
|
||||
resource "vault_kubernetes_secret_backend_role" "role" {
|
||||
backend = var.backend
|
||||
name = var.name
|
||||
allowed_kubernetes_namespaces = var.allowed_kubernetes_namespaces
|
||||
kubernetes_role_type = var.kubernetes_role_type
|
||||
generated_role_rules = file("${path.module}/../../../../../../../../${local.role_rules_file}")
|
||||
extra_labels = local.auto_labels
|
||||
}
|
||||
@ -0,0 +1,37 @@
|
||||
variable "country" {
|
||||
description = "Country identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "Region identifier"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "backend" {
|
||||
description = "The unique path where the Kubernetes backend is mounted"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "name" {
|
||||
description = "The name of the role"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "allowed_kubernetes_namespaces" {
|
||||
description = "List of allowed Kubernetes namespaces"
|
||||
type = list(string)
|
||||
default = ["*"]
|
||||
}
|
||||
|
||||
variable "kubernetes_role_type" {
|
||||
description = "Type of Kubernetes role (Role or ClusterRole)"
|
||||
type = string
|
||||
default = "Role"
|
||||
}
|
||||
|
||||
variable "extra_labels" {
|
||||
description = "Additional labels to apply to generated Kubernetes objects"
|
||||
type = map(string)
|
||||
default = {}
|
||||
}
|
||||
17
modules/vault_cluster/modules/kv_secret_backend/main.tf
Normal file
17
modules/vault_cluster/modules/kv_secret_backend/main.tf
Normal file
@ -0,0 +1,17 @@
|
||||
resource "vault_mount" "kv" {
|
||||
path = var.path
|
||||
type = "kv"
|
||||
description = var.description
|
||||
|
||||
options = {
|
||||
version = var.kv_version
|
||||
type = var.type
|
||||
}
|
||||
}
|
||||
|
||||
resource "vault_kv_secret_backend_v2" "config" {
|
||||
count = var.type == "kv-v2" && var.max_versions != null ? 1 : 0
|
||||
|
||||
mount = vault_mount.kv.path
|
||||
max_versions = var.max_versions
|
||||
}
|
||||
28
modules/vault_cluster/modules/kv_secret_backend/variables.tf
Normal file
28
modules/vault_cluster/modules/kv_secret_backend/variables.tf
Normal file
@ -0,0 +1,28 @@
|
||||
variable "path" {
|
||||
description = "Mount path of the KV secrets engine"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "type" {
|
||||
description = "Type of the secrets engine"
|
||||
type = string
|
||||
default = "kv-v2"
|
||||
}
|
||||
|
||||
variable "description" {
|
||||
description = "Human-friendly description of the mount"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "kv_version" {
|
||||
description = "KV secrets engine version"
|
||||
type = string
|
||||
default = "2"
|
||||
}
|
||||
|
||||
variable "max_versions" {
|
||||
description = "Maximum number of versions to keep per key"
|
||||
type = number
|
||||
default = null
|
||||
}
|
||||
38
modules/vault_cluster/modules/pki_mount_only/main.tf
Normal file
38
modules/vault_cluster/modules/pki_mount_only/main.tf
Normal file
@ -0,0 +1,38 @@
|
||||
resource "vault_mount" "pki" {
|
||||
path = var.path
|
||||
type = "pki"
|
||||
description = var.description
|
||||
max_lease_ttl_seconds = var.max_lease_ttl_seconds
|
||||
}
|
||||
|
||||
data "vault_pki_secret_backend_issuer" "issuer" {
|
||||
backend = vault_mount.pki.path
|
||||
issuer_ref = var.issuer_ref
|
||||
}
|
||||
|
||||
resource "vault_pki_secret_backend_config_urls" "config_urls" {
|
||||
backend = vault_mount.pki.path
|
||||
|
||||
issuing_certificates = var.issuing_certificates
|
||||
crl_distribution_points = var.crl_distribution_points
|
||||
ocsp_servers = var.ocsp_servers
|
||||
enable_templating = var.enable_templating
|
||||
}
|
||||
|
||||
resource "vault_pki_secret_backend_config_issuers" "issuers" {
|
||||
count = var.default_issuer_ref != null ? 1 : 0
|
||||
|
||||
backend = vault_mount.pki.path
|
||||
default = var.default_issuer_ref
|
||||
default_follows_latest_issuer = var.default_follows_latest_issuer
|
||||
}
|
||||
|
||||
resource "vault_pki_secret_backend_crl_config" "crl" {
|
||||
backend = vault_mount.pki.path
|
||||
expiry = var.crl_expiry
|
||||
disable = var.crl_disable
|
||||
ocsp_disable = var.ocsp_disable
|
||||
auto_rebuild = var.auto_rebuild
|
||||
enable_delta = var.enable_delta
|
||||
delta_rebuild_interval = var.delta_rebuild_interval
|
||||
}
|
||||
92
modules/vault_cluster/modules/pki_mount_only/variables.tf
Normal file
92
modules/vault_cluster/modules/pki_mount_only/variables.tf
Normal file
@ -0,0 +1,92 @@
|
||||
variable "path" {
|
||||
description = "Path where the PKI backend will be mounted"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "description" {
|
||||
description = "Description of the PKI mount"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "max_lease_ttl_seconds" {
|
||||
description = "Maximum possible lease duration for tokens and secrets in seconds"
|
||||
type = number
|
||||
}
|
||||
|
||||
variable "issuer_ref" {
|
||||
description = "Reference to the PKI issuer (default, or issuer ID/name)"
|
||||
type = string
|
||||
default = "default"
|
||||
}
|
||||
|
||||
variable "issuing_certificates" {
|
||||
description = "List of URLs for issuing certificates"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "crl_distribution_points" {
|
||||
description = "List of URLs for CRL distribution points"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "ocsp_servers" {
|
||||
description = "List of OCSP server URLs"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "enable_templating" {
|
||||
description = "Whether to enable URL templating"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "default_issuer_ref" {
|
||||
description = "Default issuer reference"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "default_follows_latest_issuer" {
|
||||
description = "Whether the default issuer follows the latest issuer"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "crl_expiry" {
|
||||
description = "CRL expiry time"
|
||||
type = string
|
||||
default = "72h"
|
||||
}
|
||||
|
||||
variable "crl_disable" {
|
||||
description = "Whether to disable CRL"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "ocsp_disable" {
|
||||
description = "Whether to disable OCSP"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "auto_rebuild" {
|
||||
description = "Whether to enable auto rebuild of CRL"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "enable_delta" {
|
||||
description = "Whether to enable delta CRL"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "delta_rebuild_interval" {
|
||||
description = "Delta CRL rebuild interval"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
54
modules/vault_cluster/modules/pki_secret_backend/main.tf
Normal file
54
modules/vault_cluster/modules/pki_secret_backend/main.tf
Normal file
@ -0,0 +1,54 @@
|
||||
resource "vault_mount" "pki" {
|
||||
path = var.path
|
||||
type = "pki"
|
||||
description = var.description
|
||||
max_lease_ttl_seconds = var.max_lease_ttl_seconds
|
||||
}
|
||||
|
||||
resource "vault_pki_secret_backend_root_cert" "root_cert" {
|
||||
backend = vault_mount.pki.path
|
||||
common_name = var.common_name
|
||||
issuer_name = var.issuer_name
|
||||
ttl = var.ttl
|
||||
format = var.format
|
||||
type = "internal"
|
||||
}
|
||||
|
||||
data "vault_pki_secret_backend_issuer" "issuer" {
|
||||
backend = vault_mount.pki.path
|
||||
issuer_ref = vault_pki_secret_backend_root_cert.root_cert.issuer_id
|
||||
|
||||
depends_on = [vault_pki_secret_backend_root_cert.root_cert]
|
||||
}
|
||||
|
||||
resource "vault_pki_secret_backend_config_urls" "urls" {
|
||||
backend = vault_mount.pki.path
|
||||
|
||||
issuing_certificates = var.issuing_certificates
|
||||
crl_distribution_points = var.crl_distribution_points
|
||||
ocsp_servers = var.ocsp_servers
|
||||
enable_templating = var.enable_templating
|
||||
}
|
||||
|
||||
resource "vault_pki_secret_backend_config_issuers" "issuers" {
|
||||
backend = vault_mount.pki.path
|
||||
default = data.vault_pki_secret_backend_issuer.issuer.issuer_id
|
||||
default_follows_latest_issuer = var.default_follows_latest_issuer
|
||||
|
||||
depends_on = [
|
||||
vault_pki_secret_backend_root_cert.root_cert,
|
||||
data.vault_pki_secret_backend_issuer.issuer
|
||||
]
|
||||
}
|
||||
|
||||
resource "vault_pki_secret_backend_crl_config" "crl" {
|
||||
backend = vault_mount.pki.path
|
||||
expiry = var.crl_expiry
|
||||
disable = var.crl_disable
|
||||
ocsp_disable = var.ocsp_disable
|
||||
auto_rebuild = var.auto_rebuild
|
||||
enable_delta = var.enable_delta
|
||||
delta_rebuild_interval = var.delta_rebuild_interval
|
||||
|
||||
depends_on = [vault_pki_secret_backend_root_cert.root_cert]
|
||||
}
|
||||
110
modules/vault_cluster/modules/pki_secret_backend/variables.tf
Normal file
110
modules/vault_cluster/modules/pki_secret_backend/variables.tf
Normal file
@ -0,0 +1,110 @@
|
||||
variable "path" {
|
||||
description = "Mount path of the PKI secrets engine"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "description" {
|
||||
description = "Human-friendly description of the mount"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "max_lease_ttl_seconds" {
|
||||
description = "Maximum lease TTL in seconds"
|
||||
type = number
|
||||
default = 315360000 # 87600 * 3600
|
||||
}
|
||||
|
||||
variable "common_name" {
|
||||
description = "Common name for the root certificate"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "issuer_name" {
|
||||
description = "Name for the root CA issuer"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "ttl" {
|
||||
description = "TTL for the root certificate in seconds"
|
||||
type = number
|
||||
default = 315360000 # 87600 * 3600
|
||||
}
|
||||
|
||||
variable "format" {
|
||||
description = "Format for the certificate"
|
||||
type = string
|
||||
default = "pem"
|
||||
}
|
||||
|
||||
variable "issuing_certificates" {
|
||||
description = "List of issuing certificate URLs"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "crl_distribution_points" {
|
||||
description = "List of CRL distribution point URLs"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "ocsp_servers" {
|
||||
description = "List of OCSP server URLs"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "enable_templating" {
|
||||
description = "Whether to enable templating for URL configuration"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "default_issuer_ref" {
|
||||
description = "Reference to the default issuer"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "default_follows_latest_issuer" {
|
||||
description = "Whether the default issuer should follow the latest issuer"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "crl_expiry" {
|
||||
description = "CRL expiration time"
|
||||
type = string
|
||||
default = "72h"
|
||||
}
|
||||
|
||||
variable "crl_disable" {
|
||||
description = "Whether to disable CRL"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "ocsp_disable" {
|
||||
description = "Whether to disable OCSP"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "auto_rebuild" {
|
||||
description = "Whether to auto-rebuild CRL"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "enable_delta" {
|
||||
description = "Whether to enable delta CRL"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "delta_rebuild_interval" {
|
||||
description = "Delta CRL rebuild interval"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
@ -0,0 +1,16 @@
|
||||
resource "vault_pki_secret_backend_role" "role" {
|
||||
backend = var.backend
|
||||
name = var.name
|
||||
allow_ip_sans = var.allow_ip_sans
|
||||
allowed_domains = var.allowed_domains
|
||||
allow_subdomains = var.allow_subdomains
|
||||
allow_glob_domains = var.allow_glob_domains
|
||||
allow_bare_domains = var.allow_bare_domains
|
||||
enforce_hostnames = var.enforce_hostnames
|
||||
allow_any_name = var.allow_any_name
|
||||
max_ttl = var.max_ttl
|
||||
key_bits = var.key_bits
|
||||
country = var.country
|
||||
use_csr_common_name = var.use_csr_common_name
|
||||
use_csr_sans = var.use_csr_sans
|
||||
}
|
||||
@ -0,0 +1,81 @@
|
||||
variable "backend" {
|
||||
description = "The unique path where the PKI backend is mounted"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "name" {
|
||||
description = "The name of the role"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "allow_ip_sans" {
|
||||
description = "Whether IP Subject Alternative Names are allowed"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "allowed_domains" {
|
||||
description = "List of allowed domains for certificates"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "allow_subdomains" {
|
||||
description = "Whether subdomains are allowed"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "allow_glob_domains" {
|
||||
description = "Whether glob domains are allowed"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "allow_bare_domains" {
|
||||
description = "Whether bare domains are allowed"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "enforce_hostnames" {
|
||||
description = "Whether to enforce hostnames"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "allow_any_name" {
|
||||
description = "Whether any name is allowed"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "max_ttl" {
|
||||
description = "Maximum TTL for certificates in seconds"
|
||||
type = number
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "key_bits" {
|
||||
description = "Number of bits for the key"
|
||||
type = number
|
||||
default = 4096
|
||||
}
|
||||
|
||||
variable "country" {
|
||||
description = "List of countries for certificate subject"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "use_csr_common_name" {
|
||||
description = "Whether to use CSR common name"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "use_csr_sans" {
|
||||
description = "Whether to use CSR Subject Alternative Names"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
14
modules/vault_cluster/modules/ssh_secret_backend/main.tf
Normal file
14
modules/vault_cluster/modules/ssh_secret_backend/main.tf
Normal file
@ -0,0 +1,14 @@
|
||||
resource "vault_mount" "ssh" {
|
||||
path = var.path
|
||||
type = "ssh"
|
||||
description = var.description
|
||||
max_lease_ttl_seconds = var.max_lease_ttl_seconds
|
||||
}
|
||||
|
||||
resource "vault_ssh_secret_backend_ca" "ssh_ca" {
|
||||
count = var.generate_signing_key != null ? 1 : 0
|
||||
|
||||
backend = vault_mount.ssh.path
|
||||
generate_signing_key = var.generate_signing_key
|
||||
key_type = var.key_type
|
||||
}
|
||||
@ -0,0 +1,28 @@
|
||||
variable "path" {
|
||||
description = "Mount path of the SSH secrets engine"
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "description" {
|
||||
description = "Human-friendly description of the mount"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "max_lease_ttl_seconds" {
|
||||
description = "Maximum lease TTL in seconds"
|
||||
type = number
|
||||
default = 315360000 # 87600 * 3600
|
||||
}
|
||||
|
||||
variable "generate_signing_key" {
|
||||
description = "Whether to generate a signing key for the CA"
|
||||
type = bool
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "key_type" {
|
||||
description = "Type of key to generate for the CA"
|
||||
type = string
|
||||
default = "ssh-rsa"
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user