82 lines
2.3 KiB
Terraform
82 lines
2.3 KiB
Terraform
|
ephemeral "vault_kv_secret_v2" "quay_oidc" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "quay/oidc/zitadel"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "quay_cluster_pull" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "quay/robots/cluster_pull"
|
||
|
|
|
||
|
|
data_json_wo_version = 1
|
||
|
|
data_json_wo = jsonencode({
|
||
|
|
username = "PLACEHOLDER"
|
||
|
|
token = "PLACEHOLDER"
|
||
|
|
})
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "random_password" "versitygw_quay_secret_access_key" {
|
||
|
|
length = 48
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "versitygw_quay_user" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "versitygw/users/quay"
|
||
|
|
|
||
|
|
data_json_wo_version = 1
|
||
|
|
data_json_wo = jsonencode({
|
||
|
|
secretAccessKey = random_password.versitygw_quay_secret_access_key.result
|
||
|
|
})
|
||
|
|
|
||
|
|
# Vault is source of truth after first write. Re-runs do not rotate user credentials.
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "random_password" "quay_dragonfly_password" {
|
||
|
|
length = 48
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "dragonfly_quay_acl" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "dragonfly/quay/acl"
|
||
|
|
|
||
|
|
data_json_wo_version = 1
|
||
|
|
data_json_wo = jsonencode({
|
||
|
|
acl = "user default on >${random_password.quay_dragonfly_password.result} ~* &* +@all\n"
|
||
|
|
})
|
||
|
|
|
||
|
|
# Vault is source of truth after first write. Re-runs do not rotate the ACL.
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "random_password" "quay_secret_key" {
|
||
|
|
length = 48
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "random_password" "quay_database_secret_key" {
|
||
|
|
length = 48
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "random_password" "quay_clair_psk" {
|
||
|
|
length = 44
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "quay_secrets" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "quay/secrets"
|
||
|
|
|
||
|
|
disable_read = true
|
||
|
|
data_json_wo_version = 1
|
||
|
|
data_json_wo = jsonencode({
|
||
|
|
oidc_client_id = ephemeral.vault_kv_secret_v2.quay_oidc.data["client_id"]
|
||
|
|
oidc_client_secret = ephemeral.vault_kv_secret_v2.quay_oidc.data["client_secret"]
|
||
|
|
redis_password = random_password.quay_dragonfly_password.result
|
||
|
|
s3_secret_key = random_password.versitygw_quay_secret_access_key.result
|
||
|
|
secret_key = random_password.quay_secret_key.result
|
||
|
|
database_secret_key = random_password.quay_database_secret_key.result
|
||
|
|
clair_psk = random_password.quay_clair_psk.result
|
||
|
|
internal_ca_cert = vault_pki_secret_backend_root_cert.root.certificate
|
||
|
|
})
|
||
|
|
}
|