234 lines
7.3 KiB
HCL
234 lines
7.3 KiB
HCL
# Root CA
|
|
resource "vault_mount" "pki_root" {
|
|
path = "pki"
|
|
type = "pki"
|
|
default_lease_ttl_seconds = 86400
|
|
max_lease_ttl_seconds = 3153600000 # 100 years
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_root_cert" "root" {
|
|
backend = vault_mount.pki_root.path
|
|
type = "internal"
|
|
common_name = "Internal Root CA"
|
|
issuer_name = "internal-root"
|
|
ttl = "876000h" # 100 years
|
|
key_type = "ec"
|
|
key_bits = 384
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_config_urls" "root" {
|
|
backend = vault_mount.pki_root.path
|
|
issuing_certificates = ["https://vault.quorate.internal/v1/pki/ca"]
|
|
crl_distribution_points = ["https://vault.quorate.internal/v1/pki/crl"]
|
|
}
|
|
|
|
# Intermediate CA
|
|
resource "vault_mount" "pki_int" {
|
|
path = "pki_int"
|
|
type = "pki"
|
|
default_lease_ttl_seconds = 86400
|
|
max_lease_ttl_seconds = 157680000 # 5 years (intermediate lifetime)
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_intermediate_cert_request" "int" {
|
|
backend = vault_mount.pki_int.path
|
|
type = "internal"
|
|
common_name = "Internal Intermediate CA"
|
|
key_type = "ec"
|
|
key_bits = 256
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_root_sign_intermediate" "int" {
|
|
backend = vault_mount.pki_root.path
|
|
issuer_ref = vault_pki_secret_backend_root_cert.root.issuer_id
|
|
common_name = "Internal Intermediate CA"
|
|
csr = vault_pki_secret_backend_intermediate_cert_request.int.csr
|
|
ttl = "43800h" # 5 years
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_intermediate_set_signed" "int" {
|
|
backend = vault_mount.pki_int.path
|
|
certificate = vault_pki_secret_backend_root_sign_intermediate.int.certificate
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_config_urls" "int" {
|
|
backend = vault_mount.pki_int.path
|
|
issuing_certificates = ["https://vault.quorate.internal/v1/pki_int/ca"]
|
|
crl_distribution_points = ["https://vault.quorate.internal/v1/pki_int/crl"]
|
|
}
|
|
|
|
# PKI role (on intermediate)
|
|
# cert-manager issues all Tier I leaf certificates through this role.
|
|
resource "vault_pki_secret_backend_role" "cert_manager" {
|
|
backend = vault_mount.pki_int.path
|
|
name = "cert-manager"
|
|
issuer_ref = "default"
|
|
ttl = 7776000 # 90 days
|
|
max_ttl = 7776000
|
|
key_type = "ec"
|
|
key_bits = 256
|
|
allow_subdomains = true
|
|
allow_glob_domains = true
|
|
allow_bare_domains = true
|
|
allowed_domains = [
|
|
var.internal_domain,
|
|
var.cluster_domain,
|
|
"svc.${var.cluster_domain}",
|
|
]
|
|
require_cn = false
|
|
}
|
|
|
|
# Policy
|
|
resource "vault_policy" "cert_manager" {
|
|
name = "cert-manager"
|
|
|
|
policy = <<-EOT
|
|
path "pki_int/sign/cert-manager" {
|
|
capabilities = ["update"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
resource "vault_mount" "pki_opnsense" {
|
|
path = "pki_opnsense"
|
|
type = "pki"
|
|
default_lease_ttl_seconds = 86400
|
|
max_lease_ttl_seconds = 3153600000
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_root_cert" "opnsense" {
|
|
backend = vault_mount.pki_opnsense.path
|
|
type = "internal"
|
|
common_name = "OPNsense Root CA"
|
|
issuer_name = "opnsense-root"
|
|
ttl = "876000h"
|
|
key_type = "ec"
|
|
key_bits = 384
|
|
permitted_ip_ranges = [
|
|
"10.77.102.91/32",
|
|
"10.212.111.120/32",
|
|
"10.31.87.181/32",
|
|
"10.86.169.153/32",
|
|
"10.146.95.240/32",
|
|
]
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_config_urls" "opnsense" {
|
|
backend = vault_mount.pki_opnsense.path
|
|
issuing_certificates = ["https://vault.quorate.internal/v1/pki_opnsense/ca"]
|
|
crl_distribution_points = ["https://vault.quorate.internal/v1/pki_opnsense/crl"]
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_role" "opnsense" {
|
|
backend = vault_mount.pki_opnsense.path
|
|
name = "webgui"
|
|
issuer_ref = vault_pki_secret_backend_root_cert.opnsense.issuer_id
|
|
ttl = 7776000
|
|
max_ttl = 7776000
|
|
key_type = "ec"
|
|
key_bits = 256
|
|
allow_ip_sans = true
|
|
require_cn = false
|
|
use_csr_common_name = false
|
|
use_csr_sans = true
|
|
server_flag = true
|
|
client_flag = false
|
|
}
|
|
|
|
resource "vault_policy" "argo_opnsense_certificate" {
|
|
name = "argo-opnsense-certificate"
|
|
|
|
policy = <<-EOT
|
|
path "pki_opnsense/sign/webgui" {
|
|
capabilities = ["update"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "argo_opnsense_certificate" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "argo-opnsense-certificate"
|
|
bound_service_account_names = ["opnsense-certificate-rotator"]
|
|
bound_service_account_namespaces = ["argo-opnsense-certificate"]
|
|
token_policies = [vault_policy.argo_opnsense_certificate.name]
|
|
token_ttl = 900
|
|
token_max_ttl = 900
|
|
}
|
|
|
|
resource "vault_mount" "pki_postgres" {
|
|
path = "pki_postgres"
|
|
type = "pki"
|
|
default_lease_ttl_seconds = 86400
|
|
max_lease_ttl_seconds = 3153600000
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_root_cert" "postgres" {
|
|
backend = vault_mount.pki_postgres.path
|
|
type = "internal"
|
|
common_name = "PostgreSQL Root CA"
|
|
issuer_name = "postgres-root"
|
|
ttl = "876000h"
|
|
key_type = "ec"
|
|
key_bits = 384
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_config_urls" "postgres" {
|
|
backend = vault_mount.pki_postgres.path
|
|
issuing_certificates = ["https://vault.quorate.internal/v1/pki_postgres/ca"]
|
|
crl_distribution_points = ["https://vault.quorate.internal/v1/pki_postgres/crl"]
|
|
}
|
|
|
|
resource "vault_pki_secret_backend_role" "postgres_server" {
|
|
backend = vault_mount.pki_postgres.path
|
|
name = "server"
|
|
issuer_ref = vault_pki_secret_backend_root_cert.postgres.issuer_id
|
|
ttl = 7776000
|
|
max_ttl = 7776000
|
|
key_type = "ec"
|
|
key_bits = 256
|
|
allowed_domains = [
|
|
"main-rw",
|
|
"main-rw.postgres",
|
|
"main-rw.postgres.svc",
|
|
"main-rw.postgres.svc.cluster.local",
|
|
"main-rw-lb",
|
|
"main-rw-lb.postgres",
|
|
"main-rw-lb.postgres.svc",
|
|
"main-rw-lb.postgres.svc.cluster.local",
|
|
"main-ro-lb",
|
|
"main-ro-lb.postgres",
|
|
"main-ro-lb.postgres.svc",
|
|
"main-ro-lb.postgres.svc.cluster.local",
|
|
"postgres-rw.quorate.internal",
|
|
"postgres-ro.quorate.internal",
|
|
]
|
|
allow_bare_domains = true
|
|
allow_ip_sans = false
|
|
allow_localhost = false
|
|
allow_wildcard_certificates = false
|
|
require_cn = false
|
|
use_csr_common_name = false
|
|
use_csr_sans = true
|
|
server_flag = true
|
|
client_flag = false
|
|
}
|
|
|
|
resource "vault_policy" "cert_manager_postgres" {
|
|
name = "cert-manager-postgres"
|
|
|
|
policy = <<-EOT
|
|
path "pki_postgres/sign/server" {
|
|
capabilities = ["update"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "cert_manager_postgres" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "cert-manager-postgres"
|
|
bound_service_account_names = ["cert-manager"]
|
|
bound_service_account_namespaces = ["cert-manager"]
|
|
token_policies = [vault_policy.cert_manager_postgres.name]
|
|
token_ttl = 3600
|
|
token_max_ttl = 3600
|
|
}
|