unkin-agent
0e82cda02d
ci/woodpecker/push/apply Pipeline failed
## Why Creates the arrstack secrets engine itself: the mount + config and the per-scope roles that mint arrproxy API keys. **PR 3 of 3 (resources)**, stacked on #126 (policy). Final step of the register -> policy -> resources split (was #124). ## Change - Adds `config/arrstack_secret_backend/arrstack.yaml`: mounts the engine at `arrstack` and writes its config (`base_url`, timeout). The arrproxy admin token stays out of git and is read from KV by the module. - Adds `config/arrstack_secret_backend_role/arrstack/{all,sonarr,radarr,prowlarr}.yaml`: roles scoped to each arr app (plus one covering all three). Default `ttl` is **60s** (short-lived, renewed on demand); `max_ttl` 86400 mirrors the litellm sibling convention. The engine additionally caps renewal at the arrproxy admin token's fixed mint expiry. - Adds `modules/vault_cluster/modules/arrstack_secret_backend{,_role}` and wires them in: `config/config.hcl` maps, `modules/vault_cluster/main.tf`, `variables.tf`, the environment inputs, and the root provider block. - Provider source is `artifactapi.k8s.syd1.au.unkin.net/terraform-unkin/vault-secrets-arrstack` (repo `terraform-provider-vault-secrets-arrstack`), local name `arrstack`. ## Apply order Apply **after PR #126 (policy) AND after `terraform-provider-vault-secrets-arrstack` v0.1.0 is published** to the artifactapi terraform registry. Until the provider is published, `tofu init` cannot resolve it, so **CI/plan on this PR is red by design** — that is expected, not a regression. Note **plan-green != apply-green**: the KV-sourced `admin_token` is only fetched at apply time, so a green plan does not prove the seeded token is readable. ## Stack 1. register -> #125 2. policy -> #126 3. **resources (this PR)** -> `benvin/arrstack-resources` off `benvin/arrstack-policy` Supersedes #124. --------- Co-authored-by: unkin-agent <unkin-agent@git.unkin.net> Co-authored-by: BenVincent <benvin@main.unkin.net> Reviewed-on: #127 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
108 lines
4.2 KiB
HCL
108 lines
4.2 KiB
HCL
include "root" {
|
|
path = find_in_parent_folders("root.hcl")
|
|
expose = true
|
|
}
|
|
|
|
include "config" {
|
|
path = "${get_repo_root()}/config/config.hcl"
|
|
expose = true
|
|
}
|
|
|
|
include "policies" {
|
|
path = "${get_repo_root()}/policies/policies.hcl"
|
|
expose = true
|
|
}
|
|
|
|
include "resources" {
|
|
path = "${get_repo_root()}/resources/resources.hcl"
|
|
expose = true
|
|
}
|
|
|
|
locals {
|
|
# Extract country and region from path
|
|
path_parts = split("/", dirname(get_terragrunt_dir()))
|
|
country = basename(dirname(get_terragrunt_dir())) # "au"
|
|
region = basename(get_terragrunt_dir()) # "syd1"
|
|
|
|
# Include configuration from config.hcl
|
|
config = include.config.locals.config
|
|
|
|
# Include policies from policies.hcl
|
|
policies = include.policies.locals
|
|
|
|
# Include resources from resources.hcl
|
|
resources = include.resources.locals
|
|
|
|
# Create sanitized backend name mapping for Consul providers
|
|
# Provider aliases can't contain slashes, so replace them with underscores
|
|
consul_backend_aliases = {
|
|
for backend_name, _ in local.config.consul_secret_backend :
|
|
backend_name => replace(backend_name, "/", "_")
|
|
}
|
|
|
|
# Same sanitized alias mapping for the NetBox providers.
|
|
netbox_backend_aliases = {
|
|
for backend_name, _ in local.config.netbox_secret_backend :
|
|
backend_name => replace(backend_name, "/", "_")
|
|
}
|
|
}
|
|
|
|
terraform {
|
|
source = "../../../modules/vault_cluster"
|
|
}
|
|
|
|
inputs = {
|
|
country = local.country
|
|
region = local.region
|
|
|
|
# Pass configuration maps to vault_cluster module
|
|
auth_approle_backend = local.config.auth_approle_backend
|
|
auth_approle_role = local.config.auth_approle_role
|
|
auth_ldap_backend = local.config.auth_ldap_backend
|
|
auth_ldap_group = local.config.auth_ldap_group
|
|
auth_kubernetes_backend = local.config.auth_kubernetes_backend
|
|
auth_kubernetes_role = local.config.auth_kubernetes_role
|
|
kv_secret_backend = local.config.kv_secret_backend
|
|
transit_secret_backend = local.config.transit_secret_backend
|
|
transit_secret_backend_key = local.config.transit_secret_backend_key
|
|
ssh_secret_backend = local.config.ssh_secret_backend
|
|
ssh_secret_backend_role = local.config.ssh_secret_backend_role
|
|
pki_secret_backend = local.config.pki_secret_backend
|
|
pki_secret_backend_role = local.config.pki_secret_backend_role
|
|
consul_secret_backend = local.config.consul_secret_backend
|
|
consul_secret_backend_role = local.config.consul_secret_backend_role
|
|
kubernetes_secret_backend = local.config.kubernetes_secret_backend
|
|
kubernetes_secret_backend_role = local.config.kubernetes_secret_backend_role
|
|
pki_mount_only = local.config.pki_mount_only
|
|
litellm_secret_backend = local.config.litellm_secret_backend
|
|
litellm_secret_backend_role = local.config.litellm_secret_backend_role
|
|
arrstack_secret_backend = local.config.arrstack_secret_backend
|
|
arrstack_secret_backend_role = local.config.arrstack_secret_backend_role
|
|
plugins = local.config.plugins
|
|
gpg_secret_backend = local.config.gpg_secret_backend
|
|
gpg_key = local.config.gpg_key
|
|
|
|
rancher_secret_backend = local.config.rancher_secret_backend
|
|
rancher_secret_backend_service_account = local.config.rancher_secret_backend_service_account
|
|
rancher_secret_backend_role = local.config.rancher_secret_backend_role
|
|
|
|
gitea_secret_backend = local.config.gitea_secret_backend
|
|
gitea_secret_backend_role = local.config.gitea_secret_backend_role
|
|
|
|
netbox_secret_backend = local.config.netbox_secret_backend
|
|
netbox_secret_backend_role = local.config.netbox_secret_backend_role
|
|
|
|
ghp_secret_backend = local.config.ghp_secret_backend
|
|
ghp_secret_backend_role = local.config.ghp_secret_backend_role
|
|
|
|
# Pass policy maps to vault_cluster module
|
|
policy_auth_map = local.policies.policy_auth_map
|
|
policy_rules_map = local.policies.policy_rules_map
|
|
|
|
# Pass sanitized consul backend aliases for provider configuration
|
|
consul_backend_aliases = local.consul_backend_aliases
|
|
|
|
# Pass sanitized netbox backend aliases for provider configuration
|
|
netbox_backend_aliases = local.netbox_backend_aliases
|
|
}
|