ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/vault/quay.tf

@@ -0,0 +1,82 @@
+ephemeral "vault_kv_secret_v2" "quay_oidc" {
+  mount = vault_mount.secret.path
+  name  = "quay/oidc/zitadel"
+}
+
+resource "vault_kv_secret_v2" "quay_cluster_pull" {
+  mount = vault_mount.secret.path
+  name  = "quay/robots/cluster_pull"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    username = "PLACEHOLDER"
+    token    = "PLACEHOLDER"
+  })
+}
+
+resource "random_password" "versitygw_quay_secret_access_key" {
+  length  = 48
+  special = false
+}
+
+resource "vault_kv_secret_v2" "versitygw_quay_user" {
+  mount = vault_mount.secret.path
+  name  = "versitygw/users/quay"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    secretAccessKey = random_password.versitygw_quay_secret_access_key.result
+  })
+
+  # Vault is source of truth after first write. Re-runs do not rotate user credentials.
+}
+
+resource "random_password" "quay_dragonfly_password" {
+  length  = 48
+  special = false
+}
+
+resource "vault_kv_secret_v2" "dragonfly_quay_acl" {
+  mount = vault_mount.secret.path
+  name  = "dragonfly/quay/acl"
+
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    acl = "user default on >${random_password.quay_dragonfly_password.result} ~* &* +@all\n"
+  })
+
+  # Vault is source of truth after first write. Re-runs do not rotate the ACL.
+}
+
+resource "random_password" "quay_secret_key" {
+  length  = 48
+  special = false
+}
+
+resource "random_password" "quay_database_secret_key" {
+  length  = 48
+  special = false
+}
+
+resource "random_password" "quay_clair_psk" {
+  length  = 44
+  special = false
+}
+
+resource "vault_kv_secret_v2" "quay_secrets" {
+  mount = vault_mount.secret.path
+  name  = "quay/secrets"
+
+  disable_read         = true
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    oidc_client_id      = ephemeral.vault_kv_secret_v2.quay_oidc.data["client_id"]
+    oidc_client_secret  = ephemeral.vault_kv_secret_v2.quay_oidc.data["client_secret"]
+    redis_password      = random_password.quay_dragonfly_password.result
+    s3_secret_key       = random_password.versitygw_quay_secret_access_key.result
+    secret_key          = random_password.quay_secret_key.result
+    database_secret_key = random_password.quay_database_secret_key.result
+    clair_psk           = random_password.quay_clair_psk.result
+    internal_ca_cert    = vault_pki_secret_backend_root_cert.root.certificate
+  })
+}