Patrick de Ruiter
8a2341423a
Some checks failed
Code Quality & Security Scan / TFLint (push) Successful in 19s
Code Quality & Security Scan / Tfsec Security Scan (push) Successful in 27s
Code Quality & Security Scan / Checkov Security Scan (push) Successful in 37s
Code Quality & Security Scan / Terraform Validate (push) Failing after 32s
Code Quality & Security Scan / SonarQube Trigger (push) Has been skipped
- Fix ansible_host resource: use 'name' and 'variables' instead of 'inventory_hostname' and 'vars' - Add missing Vault authentication variables: role_id and secret_id - Update CI/CD pipeline to provide dummy auth variables for validation - Run terraform fmt
48 lines
1.6 KiB
HCL
Executable File
48 lines
1.6 KiB
HCL
Executable File
locals {
|
|
secret_path = "secret/data/${var.environment}/${var.short_hostname}/certificate"
|
|
policy_name = "${var.environment}-${var.short_hostname}-cert-policy"
|
|
approle_name = "${var.environment}-${var.short_hostname}-approle"
|
|
}
|
|
|
|
resource "vault_policy" "cert_access" {
|
|
name = local.policy_name
|
|
policy = <<EOT
|
|
path "${local.secret_path}" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
resource "vault_approle_auth_backend_role" "cert_role" {
|
|
backend = "approle"
|
|
role_name = local.approle_name
|
|
token_policies = [vault_policy.cert_access.name]
|
|
token_ttl = "1h"
|
|
token_max_ttl = "4h"
|
|
secret_id_ttl = "24h"
|
|
}
|
|
|
|
resource "vault_approle_auth_backend_role_secret_id" "cert_role_secret" {
|
|
backend = "approle"
|
|
role_name = vault_approle_auth_backend_role.cert_role.role_name
|
|
}
|
|
|
|
resource "ansible_host" "vault_agent_node" {
|
|
name = var.short_hostname
|
|
groups = ["vault_agent"]
|
|
|
|
variables = {
|
|
ansible_user = "ansible"
|
|
ansible_ssh_private_key_file = "~/.ssh/id_ed25519"
|
|
ansible_python_interpreter = "/usr/bin/python3"
|
|
vault_approle_role_id = vault_approle_auth_backend_role.cert_role.role_id
|
|
vault_approle_secret_id = vault_approle_auth_backend_role_secret_id.cert_role_secret.secret_id
|
|
vault_address = var.vault_address
|
|
vault_secret_path = local.secret_path
|
|
environment = var.environment
|
|
short_hostname = var.short_hostname
|
|
ssl_certs_dir = "/etc/ssl/certs"
|
|
ssl_private_dir = "/etc/ssl/private"
|
|
}
|
|
}
|