Grant vault deployer access to import + manage the rancher engine

The rancher token secrets engine is registered ('imported') into the catalog by terraform-vault (sys/plugins/catalog, sudo-protected) and configured via the ranchervaultsecret provider, so the deployer needs catalog access plus write on the engine's config/service-accounts/roles paths. Without this, apply 403s on plugin registration and on rancher/* writes. - Add policies/rancher/admin.yaml granting the tf_vault approle and the woodpecker_terraform_vault k8s role: catalog sudo on the plugin, and manage on rancher/{config,service-accounts,roles}.
Register + mount the GPG secrets engine at gpg/ (#87 )
2026-07-17 23:37:31 +10:00 · 2026-07-17 23:19:38 +10:00 · 2026-07-17 23:09:31 +10:00 · 2026-07-17 23:08:04 +10:00 · 2026-07-15 21:37:45 +10:00 · 2026-07-09 23:47:32 +10:00
227 changed files with 2075 additions and 188 deletions
@@ -9,8 +9,8 @@ repos:
  - repo: https://github.com/gruntwork-io/pre-commit
    rev: v0.1.30
    hooks:
-      - id: terraform-fmt
+      - id: tofu-fmt
-      - id: terraform-validate
+      - id: tofu-validate
      - id: tflint
      - id: terragrunt-hcl-fmt
  - repo: https://github.com/adrienverge/yamllint.git
@@ -0,0 +1,23 @@
 when:
  - event: push
    branch: master
 steps:
  - name: apply
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
    commands:
      - dnf install vault -y
      - make plan
      - make apply
    backend_options:
      kubernetes:
        serviceAccountName: terraform-vault
        resources:
          requests:
            memory: 512Mi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 2
@@ -0,0 +1,21 @@
 when:
  - event: pull_request
 steps:
  - name: plan
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    environment:
      VAULT_AUTH_METHOD: kubernetes
    commands:
      - dnf install vault -y
      - make plan
    backend_options:
      kubernetes:
        serviceAccountName: terraform-vault
        resources:
          requests:
            memory: 512Mi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 2
@@ -0,0 +1,18 @@
 when:
  - event: pull_request
 steps:
  - name: pre-commit
    image: git.unkin.net/unkin/almalinux9-opentofu:20260606
    commands:
      - uvx pre-commit run --all-files
    backend_options:
      kubernetes:
        serviceAccountName: default
        resources:
          requests:
            memory: 512Mi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 2
@@ -1,29 +1,35 @@
 .PHONY: init plan apply format
-#init:
+VAULT_AUTH_METHOD ?= approle
-#	@echo "Sourcing environment and initializing Terraform..."
+VAULT_K8S_ROLE ?= woodpecker_terraform_vault
-#	@source ./env && terraform init
+VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
-#
+VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
 #plan:
 #	@echo "Sourcing environment and planning Terraform changes..."
 #	@source ./env && terraform plan
 #
 #apply:
 #	@echo "Sourcing environment and applying Terraform changes..."
 #	@source ./env && terraform apply -auto-approve
 # Define vault_env function to set up vault environment
 define vault_env
 	@export VAULT_ADDR="https://vault.service.consul:8200" && \
 	if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
 		export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
 	else \
 		export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
 	fi && \
 	export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-vault)
 endef
 init:
-	@terragrunt run --all --non-interactive init -- -upgrade
+	@$(call vault_env) && \
 	terragrunt run --all --non-interactive init -- -upgrade
 plan: init
-	@terragrunt run --all --parallelism 4 --non-interactive plan
+	@$(call vault_env) && \
 	terragrunt run --all --parallelism 4 --non-interactive plan
 apply: init
-	@terragrunt run --all --parallelism 2 --non-interactive apply
+	@$(call vault_env) && \
 	terragrunt run --all --parallelism 2 --non-interactive apply
 format:
-	@echo "Formatting Terraform files..."
+	@echo "Formatting OpenTofu files..."
-	@terraform fmt -recursive .
+	@tofu fmt -recursive .
 	@echo "Formatting Terragrunt files..."
 	@terragrunt hcl fmt
@@ -1,5 +1,3 @@
 token_policies:
  - "pki_int/certmanager"
 token_ttl: 30
 token_max_ttl: 30
 bind_secret_id: false
@@ -1,6 +1,3 @@
 token_policies:
  - "default_access"
  - "kv/service/incus/incus-cluster-join-tokens"
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
@@ -1,6 +1,3 @@
 token_policies:
  - "default_access"
  - "kv/service/packer/packer_builder"
 token_ttl: 300
 token_max_ttl: 600
 bind_secret_id: false
@@ -1,5 +1,3 @@
 token_policies:
  - "kv/service/puppetapi/puppetapi_read_tokens"
 token_ttl: 30
 token_max_ttl: 30
 bind_secret_id: false
@@ -1,6 +1,3 @@
 token_policies:
  - "kv/service/github/neoloc/tokens/read-only-token/read"
  - "kv/service/gitea/unkinben/tokens/read-only-packages/read"
 token_ttl: 30
 token_max_ttl: 30
 bind_secret_id: false
@@ -1,5 +1,3 @@
 token_policies:
  - "rundeck/rundeck"
 token_ttl: 3600
 token_max_ttl: 14400
 bind_secret_id: true
@@ -1,6 +1,3 @@
 token_policies:
  - "ssh-host-signer/sshsigner"
  - "sshca_signhost"
 token_ttl: 30
 token_max_ttl: 30
 bind_secret_id: false
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -1,7 +1,3 @@
 token_policies:
  - "default_access"
  - "kv/service/terraform/incus"
  - "kv/service/puppet/certificates/terraform_puppet_cert"
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -1,6 +1,3 @@
 token_policies:
  - "default_access"
  - "kv/service/terraform/nomad"
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -1,7 +1,3 @@
 token_policies:
  - "default_access"
  - "kv/service/repoflow/unkinadmin/tokens/terraform/read"
  - "kv/service/terraform/repoflow"
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
@@ -0,0 +1,9 @@
 token_ttl: 120
 token_max_ttl: 120
 bind_secret_id: false
 token_bound_cidrs:
  - "10.10.12.200/32"
  - "198.18.25.102/32"
  - "198.18.26.91/32"
  - "198.18.27.40/32"
 use_deterministic_role_id: true
@@ -1,27 +1,3 @@
 token_policies:
  - "default_access"
  - "approle_token_create"
  - "auth/approle/approle_role_admin"
  - "auth/approle/approle_role_login"
  - "auth/kubernetes/k8s_auth_admin"
  - "auth/ldap/ldap_admin"
  - "auth/token/auth_token_create"
  - "auth/token/auth_token_self"
  - "auth/token/auth_token_roles_admin"
  - "kubernetes/au/config_admin"
  - "kubernetes/au/roles_admin"
  - "kv/service/glauth/services/svc_vault_read"
  - "kv/service/kubernetes/au/syd1/token_reviewer_jwt/read"
  - "kv/service/kubernetes/au/syd1/service_account_jwt/read"
  - "kv/service/vault/auth_backends_read"
  - "pki_int/pki_int_roles_admin"
  - "pki_root/pki_root_roles_admin"
  - "ssh-host-signer/ssh-host-signer_roles_admin"
  - "sshca/sshca_roles_admin"
  - "sys/sys_auth_admin"
  - "sys/sys_mounts_admin"
  - "sys/sys_policy_admin"
  - "transit/keys/admin"
 token_ttl: 60
 token_max_ttl: 120
 bind_secret_id: false
@@ -1,5 +1,5 @@
 kubernetes_host: https://api-k8s.service.consul:6443
 disable_iss_validation: true
-use_annotations_as_alias_metadata: true
+use_annotations_as_alias_metadata: false # doesnt work with openbao yet
 default_lease_ttl: 1h
 max_lease_ttl: 24h
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - artifactapi
 token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -4,8 +4,6 @@ bound_service_account_names:
 bound_service_account_namespaces:
  - csi-cephrbd
  - csi-cephfs
-token_ttl: 60
+token_ttl: 600
-token_policies:
+token_max_ttl: 600
  - kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read
  - kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read
 audience: vault
@@ -2,8 +2,6 @@ bound_service_account_names:
  - cert-manager-vault-issuer
 bound_service_account_namespaces:
  - cert-manager
-token_ttl: 60
+token_ttl: 600
-token_policies:
+token_max_ttl: 600
  - pki_int/sign/servers_default
  - pki_int/issue/servers_default
 audience: vault
@@ -0,0 +1,6 @@
 bound_service_account_names:
  - default
 bound_service_account_namespaces: ['*']
 token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -2,7 +2,6 @@ bound_service_account_names:
  - externaldns
 bound_service_account_namespaces:
  - externaldns
-token_ttl: 60
+token_ttl: 600
-token_policies:
+token_max_ttl: 600
  - kv/service/kubernetes/au/syd1/externaldns/tsig/read
 audience: vault
@@ -2,8 +2,5 @@ bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - huntarr
-token_ttl: 60
+token_ttl: 600
 token_policies:
  - pki_int/sign/servers_default
  - pki_int/issue/servers_default
 audience: vault
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - identity
 token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -2,8 +2,6 @@ bound_service_account_names:
  - media-apps-vault-reader
 bound_service_account_namespaces:
  - media-apps
-token_ttl: 60
+token_ttl: 600
-token_policies:
+token_max_ttl: 600
  - kv/service/media-apps/radarr/read
  - kv/service/media-apps/sonarr/read
 audience: vault
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - puppet
 token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - rancher
 bound_service_account_namespaces:
  - cattle-system
 token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -2,11 +2,6 @@ bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - repoflow
-token_ttl: 60
+token_ttl: 600
-token_policies:
+token_max_ttl: 600
  - kv/service/repoflow/au/syd1/ceph-s3/read
  - kv/service/repoflow/au/syd1/elasticsearch/read
  - kv/service/repoflow/au/syd1/hasura/read
  - kv/service/repoflow/au/syd1/postgres/read
  - kv/service/repoflow/au/syd1/repoflow-server/read
 audience: vault
@@ -0,0 +1,8 @@
 # rpmbuilder is deployed in woodpeckerci
 bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - default
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: vault
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-artifactapi
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-authentik
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-git
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-prowlarr
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-radarr
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-rancher
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-sonarr
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,7 @@
 bound_service_account_names:
  - terraform-vault
 bound_service_account_namespaces:
  - woodpecker
 token_ttl: 600
 token_max_ttl: 600
 audience: https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,3 @@
 ---
 # this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
 description: foo
@@ -0,0 +1,3 @@
 ---
 # this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
 description: foo
@@ -0,0 +1,3 @@
 ---
 # this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
 description: foo
@@ -1,2 +0,0 @@
 policies:
  - "default_access"
@@ -1,3 +1,3 @@
-policies:
+---
-  - "default_access"
+# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
-  - "global-admin"
+description: foo
@@ -169,7 +169,7 @@ locals {
    }
    consul_secret_backend = {
      for file_path, content in local.all_configs :
-      trimsuffix(basename(file_path), ".yaml") => content
+      trimsuffix(replace(file_path, "consul_secret_backend/", ""), ".yaml") => content
      if startswith(file_path, "consul_secret_backend/")
    }
    consul_secret_backend_role = {
@@ -185,5 +185,38 @@ locals {
      trimsuffix(basename(file_path), ".yaml") => content
      if startswith(file_path, "pki_mount_only/")
    }
    litellm_secret_backend = {
      for file_path, content in local.all_configs :
      trimsuffix(basename(file_path), ".yaml") => content
      if startswith(file_path, "litellm_secret_backend/")
    }
    litellm_secret_backend_role = {
      for file_path, content in local.all_configs :
      trimsuffix(replace(file_path, "litellm_secret_backend_role/", ""), ".yaml") => merge(content, {
        name    = trimsuffix(basename(file_path), ".yaml")
        backend = dirname(replace(file_path, "litellm_secret_backend_role/", ""))
      })
      if startswith(file_path, "litellm_secret_backend_role/")
    }
    plugins = {
      for file_path, content in local.all_configs :
      trimsuffix(basename(file_path), ".yaml") => merge(content, {
        name = trimsuffix(basename(file_path), ".yaml")
      })
      if startswith(file_path, "plugins/")
    }
    gpg_secret_backend = {
      for file_path, content in local.all_configs :
      trimsuffix(basename(file_path), ".yaml") => content
      if startswith(file_path, "gpg_secret_backend/")
    }
    gpg_key = {
      for file_path, content in local.all_configs :
      trimsuffix(replace(file_path, "gpg_key/", ""), ".yaml") => merge(content, {
        name    = trimsuffix(basename(file_path), ".yaml")
        backend = dirname(replace(file_path, "gpg_key/", ""))
      })
      if startswith(file_path, "gpg_key/")
    }
  }
-}
+}
@@ -0,0 +1,7 @@
 description: "consul secret engine for au-syd1 cluster"
 default_lease_ttl_seconds: 600
 max_lease_ttl_seconds: 86400
 address: "consul.service.au-syd1.consul"
 scheme: https
 bootstrap: false
 datacenter: au-syd1
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-artifactapi
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-authentik
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-git
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-incus
 ttl: 300
 max_ttl: 600
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-k8s
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-ldap
 ttl: 60
 max_ttl: 60
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-nomad
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-prowlarr
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-radarr
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-rancher
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-repoflow
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-sonarr
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,5 @@
 consul_roles:
  - terraform-vault
 ttl: 120
 max_ttl: 300
 datacenters: []
@@ -0,0 +1,7 @@
 # config/gpg_key/gpg/pass.yaml
 # An OpenPGP key in the gpg engine for password-store (passv). The private key
 # stays in Vault; clients import the exported public key to encrypt and delegate
 # decryption to gpg/decrypt/pass. Key name = "pass", backend = "gpg".
 algorithm: rsa-4096
 identity: "pass <pass@unkin.net>"
 exportable: false
@@ -0,0 +1,4 @@
 # config/gpg_secret_backend/gpg.yaml
 # Mounts the gpg secrets engine at "gpg". The plugin itself is registered in the
 # catalog separately (see config/plugins/vault-plugin-secrets-gpg.yaml).
 description: "GPG/OpenPGP secrets engine (sign/verify/encrypt/decrypt)"
@@ -1,4 +1,3 @@
 backend: "kubernetes/au/syd1"
 allowed_kubernetes_namespaces:
  - "*"
 kubernetes_role_type: "ClusterRole"
@@ -1,4 +1,3 @@
 backend: "kubernetes/au/syd1"
 allowed_kubernetes_namespaces:
  - "*"
 kubernetes_role_type: "ClusterRole"
@@ -1,4 +1,3 @@
 backend: "kubernetes/au/syd1"
 allowed_kubernetes_namespaces:
  - "*"
 kubernetes_role_type: "ClusterRole"
@@ -1,4 +1,3 @@
 backend: "kubernetes/au/syd1"
 allowed_kubernetes_namespaces:
  - "media-apps"
 kubernetes_role_type: "Role"
@@ -0,0 +1,6 @@
 # Mounts the LiteLLM dynamic secrets engine at "litellm" and writes its config.
 # The master key is sensitive and read from KV, not stored here:
 #   kv/service/vault/au/syd1/secret_backend/litellm -> key "master_key"
 description: "LiteLLM dynamic virtual keys"
 base_url: "https://litellm.k8s.syd1.au.unkin.net"
 request_timeout_seconds: 30
@@ -0,0 +1,9 @@
 ---
 models:
  - claude-opus-4-7
 max_budget: 5
 ttl: 3600      # seconds (1h)
 max_ttl: 86400 # seconds (24h)
 metadata:
  team: testuser
  env: prod
@@ -0,0 +1,10 @@
 ---
 models:
  - claude-haiku-4-5
  - claude-sonnet-4-6
 max_budget: 50
 ttl: 3600      # seconds (1h)
 max_ttl: 86400 # seconds (24h)
 metadata:
  team: mailfiltering
  env: prod
@@ -1,4 +1,3 @@
 backend: "pki/au/syd1"
 allow_ip_sans: true
 allowed_domains:
  - "unkin.net"
@@ -1,4 +1,3 @@
 backend: "pki_int"
 allow_ip_sans: true
 allowed_domains:
  - "unkin.net"
@@ -1,4 +1,3 @@
 backend: "pki_root"
 allow_ip_sans: true
 allowed_domains:
  - "unkin.net"
@@ -0,0 +1,10 @@
 # config/plugins/vault-plugin-secrets-gpg.yaml
 # Imports (registers) the gpg secrets plugin in the catalog. Filename = catalog
 # name = mount type. The binary is installed on the OpenBao nodes by Puppet
 # (openbao-plugin-secrets-gpg RPM -> /opt/openbao-plugins/vault-plugin-secrets-gpg).
 #
 # sha256 pins the released v0.1.0 binary; bump it in lockstep with any RPM
 # upgrade or OpenBao will refuse to launch the plugin.
 type: secret
 command: vault-plugin-secrets-gpg
 sha256: "0e92d7408795688badb55789bc1604e8f1dd4d71998656c7f831991fce9a7b20"
@@ -13,6 +13,11 @@ include "policies" {
  expose = true
 }
 include "resources" {
  path   = "${get_repo_root()}/resources/resources.hcl"
  expose = true
 }
 locals {
  # Extract country and region from path
  path_parts = split("/", dirname(get_terragrunt_dir()))
@@ -24,6 +29,16 @@ locals {
  # Include policies from policies.hcl
  policies = include.policies.locals
  # Include resources from resources.hcl
  resources = include.resources.locals
  # Create sanitized backend name mapping for Consul providers
  # Provider aliases can't contain slashes, so replace them with underscores
  consul_backend_aliases = {
    for backend_name, _ in local.config.consul_secret_backend :
    backend_name => replace(backend_name, "/", "_")
  }
 }
 terraform {
@@ -53,8 +68,16 @@ inputs = {
  kubernetes_secret_backend      = local.config.kubernetes_secret_backend
  kubernetes_secret_backend_role = local.config.kubernetes_secret_backend_role
  pki_mount_only                 = local.config.pki_mount_only
  litellm_secret_backend         = local.config.litellm_secret_backend
  litellm_secret_backend_role    = local.config.litellm_secret_backend_role
  plugins                        = local.config.plugins
  gpg_secret_backend             = local.config.gpg_secret_backend
  gpg_key                        = local.config.gpg_key
  # Pass policy maps to vault_cluster module
  policy_auth_map  = local.policies.policy_auth_map
  policy_rules_map = local.policies.policy_rules_map
  # Pass sanitized consul backend aliases for provider configuration
  consul_backend_aliases = local.consul_backend_aliases
 }
@@ -3,27 +3,26 @@ generate "backend" {
  path      = "backend.tf"
  if_exists = "overwrite"
  contents  = <<EOF
 #-------------------------------------------
 # locals
 #-------------------------------------------
 locals {
  vault_addr = "https://vault.service.consul:8200"
 }
 #-----------------------------------------------------------------------------
 # Configure this provider through the environment variables:
 #    - VAULT_ADDR
 #    - VAULT_TOKEN
 #-----------------------------------------------------------------------------
 provider "vault" {
  address = local.vault_addr
 }
-#------------------------------------------------------------------------------
+# The LiteLLM secrets engine is managed through its own provider, which talks to
-# Use remote state file and encrypt it since your state files may contains
+# the same Vault server. Token falls back to the VAULT_TOKEN environment variable.
-# sensitive data.
+provider "litellm" {
-# export CONSUL_HTTP_TOKEN=<your-token>
+  address = local.vault_addr
-#------------------------------------------------------------------------------
+}
 # The gpg secrets engine's keys are managed through its own provider (same Vault
 # server; token falls back to VAULT_TOKEN).
 provider "gpg" {
  address = local.vault_addr
 }
 terraform {
  backend "consul" {
    address = "https://consul.service.consul"
@@ -38,6 +37,18 @@ terraform {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
    consul = {
      source  = "hashicorp/consul"
      version = "2.23.0"
    }
    litellm = {
      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/litellmvaultsecret"
      version = "0.1.0"
    }
    gpg = {
      source  = "artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/gpgvaultsecret"
      version = "0.1.0"
    }
  }
 }
 EOF
@@ -0,0 +1,11 @@
 rule "terraform_required_providers" {
  enabled = false
 }
 rule "terraform_required_version" {
  enabled = false
 }
 rule "terraform_unused_declarations" {
  enabled = false
 }
@@ -3,8 +3,6 @@ module "auth_approle_backend" {
  for_each = var.auth_approle_backend
  country            = var.country
  region             = var.region
  path               = each.key
  listing_visibility = each.value.listing_visibility
  default_lease_ttl  = each.value.default_lease_ttl
@@ -61,7 +59,7 @@ module "auth_ldap_group" {
  groupname = each.value.groupname
  backend   = each.value.backend
-  policies  = each.value.policies
+  policies  = var.policy_auth_map[each.value.backend][each.value.groupname]
  depends_on = [module.auth_ldap_backend]
 }
@@ -92,6 +90,7 @@ module "auth_kubernetes_role" {
  bound_service_account_names      = each.value.bound_service_account_names
  bound_service_account_namespaces = each.value.bound_service_account_namespaces
  token_ttl                        = each.value.token_ttl
  token_max_ttl                    = each.value.token_max_ttl
  token_policies                   = var.policy_auth_map[each.value.backend][each.value.role_name]
  audience                         = each.value.audience
@@ -185,7 +184,6 @@ module "pki_secret_backend" {
  crl_distribution_points       = each.value.crl_distribution_points
  ocsp_servers                  = each.value.ocsp_servers
  enable_templating             = each.value.enable_templating
  default_issuer_ref            = each.value.default_issuer_ref
  default_follows_latest_issuer = each.value.default_follows_latest_issuer
  crl_expiry                    = each.value.crl_expiry
  crl_disable                   = each.value.crl_disable
@@ -237,19 +235,41 @@ module "consul_secret_backend" {
  max_lease_ttl_seconds     = each.value.max_lease_ttl_seconds
 }
 # Create data sources for consul backend tokens
 data "vault_kv_secret_v2" "consul_backend_configs" {
  for_each = {
    for k, v in var.consul_secret_backend : k => v
    if !v.bootstrap
  }
  mount = "kv"
  name  = "service/vault/${var.country}/${var.region}/secret_backend/${each.key}"
 }
 # Create Consul ACL management module
 module "consul_acl_management" {
  source = "./modules/consul_acl_management"
  country                = var.country
  region                 = var.region
  consul_backends        = var.consul_secret_backend
  consul_roles           = var.consul_secret_backend_role
  consul_backend_aliases = var.consul_backend_aliases
 }
 # Create consul secret backend roles (Vault resources only)
 module "consul_secret_backend_role" {
  source = "./modules/consul_secret_backend_role"
  for_each = var.consul_secret_backend_role
-  name         = each.value.name
+  name    = each.value.name
-  backend      = each.value.backend
+  backend = each.value.backend
-  consul_roles = each.value.consul_roles
+  ttl     = each.value.ttl
-  ttl          = each.value.ttl
+  max_ttl = each.value.max_ttl
-  max_ttl      = each.value.max_ttl
+  local   = each.value.local
  local        = each.value.local
-  depends_on = [module.consul_secret_backend]
+  depends_on = [module.consul_secret_backend, module.consul_acl_management]
 }
 module "kubernetes_secret_backend" {
@@ -283,6 +303,77 @@ module "kubernetes_secret_backend_role" {
  depends_on = [module.kubernetes_secret_backend]
 }
 module "litellm_secret_backend" {
  source = "./modules/litellm_secret_backend"
  for_each = var.litellm_secret_backend
  country                 = var.country
  region                  = var.region
  path                    = each.key
  plugin                  = each.value.plugin
  description             = each.value.description
  base_url                = each.value.base_url
  request_timeout_seconds = each.value.request_timeout_seconds
 }
 module "litellm_secret_backend_role" {
  source = "./modules/litellm_secret_backend_role"
  for_each = var.litellm_secret_backend_role
  name             = each.value.name
  backend          = each.value.backend
  models           = each.value.models
  max_budget       = each.value.max_budget
  key_alias_prefix = each.value.key_alias_prefix
  ttl              = each.value.ttl
  max_ttl          = each.value.max_ttl
  metadata         = each.value.metadata
  depends_on = [module.litellm_secret_backend]
 }
 module "plugin" {
  source = "./modules/plugin"
  for_each = var.plugins
  name           = each.value.name
  type           = each.value.type
  command        = each.value.command
  sha256         = each.value.sha256
  plugin_version = each.value.version
 }
 module "gpg_secret_backend" {
  source = "./modules/gpg_secret_backend"
  for_each = var.gpg_secret_backend
  path        = each.key
  plugin      = each.value.plugin
  description = each.value.description
  depends_on = [module.plugin]
 }
 module "gpg_key" {
  source = "./modules/gpg_key"
  for_each = var.gpg_key
  backend                = each.value.backend
  name                   = each.value.name
  algorithm              = each.value.algorithm
  identity               = each.value.identity
  exportable             = each.value.exportable
  deletion_allowed       = each.value.deletion_allowed
  min_decryption_version = each.value.min_decryption_version
  depends_on = [module.gpg_secret_backend]
 }
 module "vault_policy" {
  source = "./modules/vault_policy"
@@ -300,7 +391,6 @@ module "pki_mount_only" {
  path                          = each.key
  description                   = each.value.description
  max_lease_ttl_seconds         = each.value.max_lease_ttl_seconds
  issuer_ref                    = each.value.issuer_ref
  issuing_certificates          = each.value.issuing_certificates
  crl_distribution_points       = each.value.crl_distribution_points
  ocsp_servers                  = each.value.ocsp_servers
@@ -314,3 +404,4 @@ module "pki_mount_only" {
  enable_delta                  = each.value.enable_delta
  delta_rebuild_interval        = each.value.delta_rebuild_interval
 }
@@ -8,4 +8,4 @@ resource "vault_auth_backend" "approle" {
    max_lease_ttl      = var.max_lease_ttl
    listing_visibility = var.listing_visibility
  }
-}
+}
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -1,13 +1,3 @@
 variable "country" {
  description = "Country identifier"
  type        = string
 }
 variable "region" {
  description = "Region identifier"
  type        = string
 }
 variable "path" {
  description = "Mount path of the AppRole auth backend"
  type        = string
@@ -34,4 +24,4 @@ variable "max_lease_ttl" {
  description = "Specifies the maximum time-to-live. If set, this overrides the global default. Must be a valid duration string"
  type        = string
  default     = null
-}
+}
@@ -16,7 +16,7 @@ data "vault_kv_secret_v2" "role_config" {
 locals {
  salt                  = data.vault_kv_secret_v2.salt_config.data["salt"]
  role_id_input         = "${local.salt}-${var.approle_name}-${var.mount_path}"
-  deterministic_role_id = uuidv5("dns", "${local.role_id_input}")
+  deterministic_role_id = uuidv5("dns", local.role_id_input)
  # Use deterministic role-id by default, or read from KV if specified
  role_id = var.use_deterministic_role_id ? local.deterministic_role_id : data.vault_kv_secret_v2.role_config[0].data["role_id"]
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -4,6 +4,7 @@ resource "vault_kubernetes_auth_backend_role" "role" {
  bound_service_account_names      = var.bound_service_account_names
  bound_service_account_namespaces = var.bound_service_account_namespaces
  token_ttl                        = var.token_ttl
  token_max_ttl                    = var.token_max_ttl
  token_policies                   = var.token_policies
  audience                         = var.audience
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -24,6 +24,12 @@ variable "token_ttl" {
  default     = 3600
 }
 variable "token_max_ttl" {
  description = "The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time."
  type        = number
  default     = 86400
 }
 variable "token_policies" {
  description = "List of policies to assign to the role (passed from policy_auth_map)"
  type        = list(string)
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,9 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
  }
 }
@@ -0,0 +1,7 @@
 rule "terraform_required_providers" {
  enabled = false
 }
 rule "terraform_required_version" {
  enabled = false
 }
@@ -0,0 +1,58 @@
 # Get consul backend tokens from Vault
 data "vault_kv_secret_v2" "consul_backend_configs" {
  for_each = var.consul_backends
  mount = "kv"
  name  = "service/vault/${var.country}/${var.region}/secret_backend/${each.key}"
 }
 # Create consul provider instances for each consul backend
 provider "consul" {
  alias    = "by_backend"
  for_each = var.consul_backend_aliases
  address = var.consul_backends[each.key].address
  scheme  = var.consul_backends[each.key].scheme
  ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
  token   = data.vault_kv_secret_v2.consul_backend_configs[each.key].data["token"]
 }
 # Create Consul ACL policies
 resource "consul_acl_policy" "policies" {
  for_each = var.consul_roles
  provider = consul.by_backend[each.value.backend]
  name        = each.value.name
  description = each.value.description != null ? each.value.description : "Auto-generated policy for Vault role ${each.value.name}"
  rules       = file("${path.module}/../../../../../../../../resources/secret_backend/${each.value.backend}/${each.value.name}.hcl")
  datacenters = each.value.datacenters
 }
 # Create Consul ACL roles
 resource "consul_acl_role" "roles" {
  for_each = var.consul_roles
  provider = consul.by_backend[each.value.backend]
  name        = each.value.name
  description = each.value.description != null ? each.value.description : "Auto-generated role for Vault role ${each.value.name}"
  policies = [consul_acl_policy.policies[each.key].name]
  dynamic "service_identities" {
    for_each = each.value.service_identities != null ? each.value.service_identities : []
    content {
      service_name = service_identities.value.service_name
      datacenters  = service_identities.value.datacenters
    }
  }
  dynamic "node_identities" {
    for_each = each.value.node_identities != null ? each.value.node_identities : []
    content {
      node_name  = node_identities.value.node_name
      datacenter = node_identities.value.datacenter
    }
  }
 }
@@ -0,0 +1,9 @@
 output "consul_acl_policies" {
  description = "Map of created Consul ACL policies"
  value       = consul_acl_policy.policies
 }
 output "consul_acl_roles" {
  description = "Map of created Consul ACL roles"
  value       = consul_acl_role.roles
 }
@@ -0,0 +1,13 @@
 terraform {
  required_version = ">= 1.10"
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "5.6.0"
    }
    consul = {
      source  = "hashicorp/consul"
      version = "2.23.0"
    }
  }
 }
@@ -0,0 +1,46 @@
 variable "consul_backends" {
  description = "Map of consul secret backends"
  type = map(object({
    address         = string
    scheme          = string
    bootstrap       = bool
    bootstrap_token = optional(string)
    ca_cert         = optional(string)
    client_cert     = optional(string)
    client_key      = optional(string)
  }))
 }
 variable "consul_roles" {
  description = "Map of consul secret backend roles"
  type = map(object({
    name        = string
    backend     = string
    description = optional(string)
    datacenters = optional(list(string))
    service_identities = optional(list(object({
      service_name = string
      datacenters  = optional(list(string))
    })))
    node_identities = optional(list(object({
      node_name  = string
      datacenter = string
    })))
  }))
 }
 variable "consul_backend_aliases" {
  description = "Map of consul backend names to sanitized provider aliases"
  type        = map(string)
  default     = {}
 }
 variable "country" {
  description = "Country identifier"
  type        = string
 }
 variable "region" {
  description = "Region identifier"
  type        = string
 }
--- a/Show More
+++ b/Show More