Will Anderson
110 lines
2.3 KiB
Terraform
110 lines
2.3 KiB
Terraform
# Vault — secrets management with GCP KMS auto-unseal
|
|
# UI: https://vault.neuralplatform.ai
|
|
# Auto-unseal: GCP KMS projects/neuron-785695/locations/global/keyRings/vault/cryptoKeys/vault-unseal
|
|
|
|
resource "kubernetes_namespace" "vault" {
|
|
metadata {
|
|
name = "vault"
|
|
labels = {
|
|
managed-by = "terraform"
|
|
tier = "platform"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_secret" "vault_gcp_sa" {
|
|
metadata {
|
|
name = "vault-gcp-sa"
|
|
namespace = kubernetes_namespace.vault.metadata[0].name
|
|
}
|
|
|
|
data = {
|
|
"sa.json" = file("${path.module}/vault-gcp-sa.json")
|
|
}
|
|
}
|
|
|
|
resource "helm_release" "vault" {
|
|
name = "vault"
|
|
namespace = kubernetes_namespace.vault.metadata[0].name
|
|
repository = "https://helm.releases.hashicorp.com"
|
|
chart = "vault"
|
|
version = "0.29.1"
|
|
timeout = 300
|
|
|
|
values = [<<-EOT
|
|
server:
|
|
image:
|
|
repository: hashicorp/vault
|
|
tag: "1.18.3"
|
|
|
|
extraEnvironmentVars:
|
|
GOOGLE_APPLICATION_CREDENTIALS: /vault/gcp/sa.json
|
|
|
|
volumes:
|
|
- name: gcp-sa
|
|
secret:
|
|
secretName: vault-gcp-sa
|
|
|
|
volumeMounts:
|
|
- name: gcp-sa
|
|
mountPath: /vault/gcp
|
|
readOnly: true
|
|
|
|
ha:
|
|
enabled: false
|
|
|
|
dataStorage:
|
|
enabled: true
|
|
size: 10Gi
|
|
|
|
standalone:
|
|
enabled: true
|
|
config: |
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
}
|
|
|
|
storage "file" {
|
|
path = "/vault/data"
|
|
}
|
|
|
|
seal "gcpckms" {
|
|
project = "neuron-785695"
|
|
region = "global"
|
|
key_ring = "vault"
|
|
crypto_key = "vault-unseal"
|
|
}
|
|
|
|
ingress:
|
|
enabled: true
|
|
ingressClassName: traefik
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
hosts:
|
|
- host: vault.${var.infra_domain}
|
|
paths:
|
|
- /
|
|
tls:
|
|
- secretName: vault-tls
|
|
hosts:
|
|
- vault.${var.infra_domain}
|
|
|
|
ui:
|
|
enabled: true
|
|
|
|
injector:
|
|
enabled: false
|
|
EOT
|
|
]
|
|
|
|
depends_on = [
|
|
kubernetes_secret.vault_gcp_sa,
|
|
helm_release.cert_manager,
|
|
]
|
|
}
|