30 lines
896 B
Terraform
30 lines
896 B
Terraform
|
resource "random_password" "versitygw_argo_secret_access_key" {
|
||
|
|
length = 48
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "versitygw_argo_user" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "versitygw/users/argo"
|
||
|
|
|
||
|
|
data_json_wo_version = 1
|
||
|
|
data_json_wo = jsonencode({
|
||
|
|
secretAccessKey = random_password.versitygw_argo_secret_access_key.result
|
||
|
|
})
|
||
|
|
|
||
|
|
# Vault is source of truth after first write. Re-runs do not rotate user credentials.
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "argo_artifacts" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "argo/artifacts"
|
||
|
|
|
||
|
|
data_json_wo_version = 1
|
||
|
|
data_json_wo = jsonencode({
|
||
|
|
access_key_id = "********"
|
||
|
|
secret_access_key = random_password.versitygw_argo_secret_access_key.result
|
||
|
|
internal_ca_cert = vault_pki_secret_backend_root_cert.root.certificate
|
||
|
|
})
|
||
|
|
|
||
|
|
# Keep in lockstep with versitygw/users/argo until rotation is designed.
|
||
|
|
}
|