58 lines
1.4 KiB
Terraform
58 lines
1.4 KiB
Terraform
|
resource "random_password" "quay" {
|
||
|
|
length = 32
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "postgresql_role" "quay" {
|
||
|
|
name = "quay"
|
||
|
|
login = true
|
||
|
|
password = random_password.quay.result
|
||
|
|
|
||
|
|
lifecycle {
|
||
|
|
ignore_changes = [password]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "postgresql_database" "quay" {
|
||
|
|
name = "quay"
|
||
|
|
owner = postgresql_role.quay.name
|
||
|
|
}
|
||
|
|
|
||
|
|
# Allows vault_db_admin to ALTER ROLE quay PASSWORD '...' for credential rotation.
|
||
|
|
resource "postgresql_grant_role" "vault_db_admin_quay" {
|
||
|
|
role = postgresql_role.vault_db_admin.name
|
||
|
|
grant_role = postgresql_role.quay.name
|
||
|
|
with_admin_option = true
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "postgresql_extension" "quay_pg_trgm" {
|
||
|
|
name = "pg_trgm"
|
||
|
|
database = postgresql_database.quay.name
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "random_password" "quay_clair" {
|
||
|
|
length = 32
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "postgresql_role" "quay_clair" {
|
||
|
|
name = "quay_clair"
|
||
|
|
login = true
|
||
|
|
password = random_password.quay_clair.result
|
||
|
|
|
||
|
|
lifecycle {
|
||
|
|
ignore_changes = [password]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "postgresql_database" "quay_clair" {
|
||
|
|
name = "quay_clair"
|
||
|
|
owner = postgresql_role.quay_clair.name
|
||
|
|
}
|
||
|
|
|
||
|
|
# Allows vault_db_admin to ALTER ROLE quay_clair PASSWORD '...' for credential rotation.
|
||
|
|
resource "postgresql_grant_role" "vault_db_admin_quay_clair" {
|
||
|
|
role = postgresql_role.vault_db_admin.name
|
||
|
|
grant_role = postgresql_role.quay_clair.name
|
||
|
|
with_admin_option = true
|
||
|
|
}
|