Patrick de Ruiter
9c0d389dd3
- Migrated Ansible integration from consul_template to vault_agent - Copied vault_agent role from terraform-vsphere-infra module - Created vault_agent-playbook.yml for deployment - Archived consul_template role as consul_template-legacy - Updated Terraform configuration: - Changed Ansible inventory group from consul_template to vault_agent - Added vault_secret_path variable for vault-agent - Added ssl_certs_dir and ssl_private_dir variables - Formatted all Terraform files - Implemented CI/CD pipeline: - Created .gitea/workflows/pipeline.yaml - Added TFLint, Tfsec, and Checkov security scans - Added Terraform validate step - Added SonarQube integration - Created sonar-project.properties - Documentation updates: - Updated README.md with vault-agent information - Added migration section comparing consul-template vs vault-agent - Updated CLAUDE.md with vault-agent architecture - Added vault-agent configuration examples Why vault-agent over consul-template: - Full AppRole support with role_id/secret_id files - Advanced token auto-renewal with auto_auth - Better credential security (separate files vs config) - Actively developed by HashiCorp Note: The ansible/ directory changes (vault_agent role and playbook) are not committed as the directory is in .gitignore. These files exist locally and will be deployed during Ansible runs.
48 lines
1.6 KiB
HCL
Executable File
48 lines
1.6 KiB
HCL
Executable File
locals {
|
|
secret_path = "secret/data/${var.environment}/${var.short_hostname}/certificate"
|
|
policy_name = "${var.environment}-${var.short_hostname}-cert-policy"
|
|
approle_name = "${var.environment}-${var.short_hostname}-approle"
|
|
}
|
|
|
|
resource "vault_policy" "cert_access" {
|
|
name = local.policy_name
|
|
policy = <<EOT
|
|
path "${local.secret_path}" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
resource "vault_approle_auth_backend_role" "cert_role" {
|
|
backend = "approle"
|
|
role_name = local.approle_name
|
|
token_policies = [vault_policy.cert_access.name]
|
|
token_ttl = "1h"
|
|
token_max_ttl = "4h"
|
|
secret_id_ttl = "24h"
|
|
}
|
|
|
|
resource "vault_approle_auth_backend_role_secret_id" "cert_role_secret" {
|
|
backend = "approle"
|
|
role_name = vault_approle_auth_backend_role.cert_role.role_name
|
|
}
|
|
|
|
resource "ansible_host" "vault_agent_node" {
|
|
inventory_hostname = var.short_hostname
|
|
groups = ["vault_agent"]
|
|
|
|
vars = {
|
|
ansible_user = "ansible"
|
|
ansible_ssh_private_key_file = "~/.ssh/id_ed25519"
|
|
ansible_python_interpreter = "/usr/bin/python3"
|
|
vault_approle_role_id = vault_approle_auth_backend_role.cert_role.role_id
|
|
vault_approle_secret_id = vault_approle_auth_backend_role_secret_id.cert_role_secret.secret_id
|
|
vault_address = var.vault_address
|
|
vault_secret_path = local.secret_path
|
|
environment = var.environment
|
|
short_hostname = var.short_hostname
|
|
ssl_certs_dir = "/etc/ssl/certs"
|
|
ssl_private_dir = "/etc/ssl/private"
|
|
}
|
|
}
|