89 lines
2.4 KiB
Text
89 lines
2.4 KiB
Text
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
export VAULT_ADDR=https://vault.quorate.internal
|
||
|
|
|
||
|
|
state_host="${TF_STATE_PG_HOST:-10.234.158.153}"
|
||
|
|
state_port="${TF_STATE_PG_PORT:-5432}"
|
||
|
|
state_db="${TF_STATE_PG_DB:-tf_state}"
|
||
|
|
state_vault_path="${TF_STATE_PG_VAULT_PATH:-database/static-creds/tf-state}"
|
||
|
|
source_s3_key="${VERSITYGW_TERRAFORM_STATE_ACCESS_KEY_ID:-terraform-state}"
|
||
|
|
source_s3_path="${VERSITYGW_TERRAFORM_STATE_VAULT_PATH:-secret/versitygw/users/terraform-state}"
|
||
|
|
|
||
|
|
if [[ -z "${TF_CLI_CONFIG_FILE:-}" && -f dev.tfrc ]]; then
|
||
|
|
export TF_CLI_CONFIG_FILE=dev.tfrc
|
||
|
|
fi
|
||
|
|
|
||
|
|
tofu_subcommand=""
|
||
|
|
for arg in "$@"; do
|
||
|
|
case "$arg" in
|
||
|
|
-chdir=*)
|
||
|
|
;;
|
||
|
|
-*)
|
||
|
|
if [[ "$arg" == "-help" || "$arg" == "--help" || "$arg" == "-version" ]]; then
|
||
|
|
tofu_subcommand="$arg"
|
||
|
|
break
|
||
|
|
fi
|
||
|
|
;;
|
||
|
|
*)
|
||
|
|
tofu_subcommand="$arg"
|
||
|
|
break
|
||
|
|
;;
|
||
|
|
esac
|
||
|
|
done
|
||
|
|
|
||
|
|
needs_state_credentials=true
|
||
|
|
needs_s3_credentials=false
|
||
|
|
case "$tofu_subcommand" in
|
||
|
|
"" | "-help" | "--help" | "-version" | "version" | "fmt" | "validate" | "get" | "metadata")
|
||
|
|
needs_state_credentials=false
|
||
|
|
;;
|
||
|
|
"init")
|
||
|
|
for arg in "$@"; do
|
||
|
|
if [[ "$arg" == "-backend=false" ]]; then
|
||
|
|
needs_state_credentials=false
|
||
|
|
break
|
||
|
|
fi
|
||
|
|
if [[ "$arg" == "-migrate-state" ]]; then
|
||
|
|
needs_s3_credentials=true
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
;;
|
||
|
|
esac
|
||
|
|
|
||
|
|
if [[ "$needs_state_credentials" == "false" ]]; then
|
||
|
|
exec tofu "$@"
|
||
|
|
fi
|
||
|
|
|
||
|
|
if ! command -v vault >/dev/null 2>&1; then
|
||
|
|
echo "vault CLI is required to read PostgreSQL Terraform state credentials" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
state_user="$(vault read -field=username "$state_vault_path")"
|
||
|
|
state_password="$(vault read -field=password "$state_vault_path")"
|
||
|
|
|
||
|
|
if [[ -z "$state_user" || -z "$state_password" ]]; then
|
||
|
|
echo "Vault credential $state_vault_path is incomplete" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
export PG_CONN_STR="postgres://${state_host}:${state_port}/${state_db}?sslmode=require"
|
||
|
|
export PGUSER="$state_user"
|
||
|
|
export PGPASSWORD="$state_password"
|
||
|
|
|
||
|
|
if [[ "$needs_s3_credentials" == "true" ]]; then
|
||
|
|
source_s3_secret="$(vault kv get -field=secretAccessKey "$source_s3_path")"
|
||
|
|
|
||
|
|
if [[ -z "$source_s3_secret" ]]; then
|
||
|
|
echo "Vault credential $source_s3_path is incomplete" >&2
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
export AWS_ACCESS_KEY_ID="$source_s3_key"
|
||
|
|
export AWS_SECRET_ACCESS_KEY="$source_s3_secret"
|
||
|
|
export AWS_REGION="${AWS_REGION:-us-east-1}"
|
||
|
|
export AWS_EC2_METADATA_DISABLED=true
|
||
|
|
fi
|
||
|
|
|
||
|
|
exec tofu "$@"
|