viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

migrate all secrets from SOPS to Vault KV

Browse source 
- Add vault provider to root terragrunt.hcl (generated providers.tf)
- Delete stacks/vault/vault_provider.tf (now in generated providers.tf)
- Add 124 variable declarations + 43 vault_kv_secret_v2 resources to
  vault/main.tf to populate Vault KV at secret/<stack-name>
- Migrate 43 consuming stacks to read secrets from Vault KV via
  data "vault_kv_secret_v2" instead of SOPS var-file
- Add dependency "vault" to all migrated stacks' terragrunt.hcl
- Complex types (maps/lists) stored as JSON strings, decoded with
  jsondecode() in locals blocks

Bootstrap secrets (vault_root_token, vault_authentik_client_id,
vault_authentik_client_secret) remain in SOPS permanently.

Apply order: vault stack first (populates KV), then all others.
This commit is contained in:
Viktor Barzin 2026-03-14 17:15:48 +00:00
parent 39b7dac1a9
commit a8d944eb9b
126 changed files with 1635 additions and 817 deletions
Download patch file Download diff file Expand all files Collapse all files

60
stacks/claude-memory/main.tf
View file

@ -3,17 +3,14 @@ variable "tls_secret_name" {
sensitive = true
}
variable "postgresql_host" { type = string }
variable "dbaas_postgresql_root_password" {
type = string
sensitive = true
}
variable "claude_memory_db_password" {
type = string
sensitive = true
}
variable "claude_memory_api_key" {
type = string
sensitive = true
data "vault_kv_secret_v2" "secrets" {
mount = "secret"
name = "claude-memory"
}
resource "kubernetes_namespace" "claude-memory" {
@ -48,11 +45,11 @@ resource "kubernetes_job" "db_init" {
"sh", "-c",
<<-EOT
set -e
PGPASSWORD='${var.dbaas_postgresql_root_password}' psql -h ${var.postgresql_host} -U root -tc "SELECT 1 FROM pg_roles WHERE rolname='claude_memory'" | grep -q 1 || \
PGPASSWORD='${var.dbaas_postgresql_root_password}' psql -h ${var.postgresql_host} -U root -c "CREATE ROLE claude_memory WITH LOGIN PASSWORD '${var.claude_memory_db_password}'"
PGPASSWORD='${var.dbaas_postgresql_root_password}' psql -h ${var.postgresql_host} -U root -tc "SELECT 1 FROM pg_database WHERE datname='claude_memory'" | grep -q 1 || \
PGPASSWORD='${var.dbaas_postgresql_root_password}' psql -h ${var.postgresql_host} -U root -c "CREATE DATABASE claude_memory OWNER claude_memory"
PGPASSWORD='${var.dbaas_postgresql_root_password}' psql -h ${var.postgresql_host} -U root -c "GRANT ALL PRIVILEGES ON DATABASE claude_memory TO claude_memory"
PGPASSWORD='${data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]}' psql -h ${var.postgresql_host} -U root -tc "SELECT 1 FROM pg_roles WHERE rolname='claude_memory'" | grep -q 1 || \
PGPASSWORD='${data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]}' psql -h ${var.postgresql_host} -U root -c "CREATE ROLE claude_memory WITH LOGIN PASSWORD '${var.claude_memory_db_password}'"
PGPASSWORD='${data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]}' psql -h ${var.postgresql_host} -U root -tc "SELECT 1 FROM pg_database WHERE datname='claude_memory'" | grep -q 1 || \
PGPASSWORD='${data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]}' psql -h ${var.postgresql_host} -U root -c "CREATE DATABASE claude_memory OWNER claude_memory"
PGPASSWORD='${data.vault_kv_secret_v2.secrets.data["dbaas_root_password"]}' psql -h ${var.postgresql_host} -U root -c "GRANT ALL PRIVILEGES ON DATABASE claude_memory TO claude_memory"
echo "Database init complete"
EOT
]
@ -79,7 +76,7 @@ resource "kubernetes_deployment" "claude-memory" {
}
}
spec {
replicas = 1
replicas = 2
selector {
match_labels = {
app = "claude-memory"
@ -92,6 +89,18 @@ resource "kubernetes_deployment" "claude-memory" {
}
}
spec {
affinity {
pod_anti_affinity {
required_during_scheduling_ignored_during_execution {
label_selector {
match_labels = {
app = "claude-memory"
}
}
topology_key = "kubernetes.io/hostname"
}
}
}
container {
name = "claude-memory"
image = "viktorbarzin/claude-memory-mcp:latest"
@ -106,9 +115,17 @@ resource "kubernetes_deployment" "claude-memory" {
}
env {
name = "API_KEY"
value = var.claude_memory_api_key
value = data.vault_kv_secret_v2.secrets.data["api_key"]
}
startup_probe {
http_get {
path = "/health"
port = 8000
}
failure_threshold = 30
period_seconds = 2
}
liveness_probe {
http_get {
path = "/health"
@ -146,6 +163,21 @@ resource "kubernetes_deployment" "claude-memory" {
}
}
resource "kubernetes_pod_disruption_budget_v1" "claude-memory" {
metadata {
name = "claude-memory"
namespace = kubernetes_namespace.claude-memory.metadata[0].name
}
spec {
min_available = "1"
selector {
match_labels = {
app = "claude-memory"
}
}
}
}
resource "kubernetes_service" "claude-memory" {
metadata {
name = "claude-memory"

5
stacks/claude-memory/terragrunt.hcl
View file

@ -6,3 +6,8 @@ dependency "platform" {
config_path = "../platform"
skip_outputs = true
}
dependency "vault" {
config_path = "../vault"
skip_outputs = true
}