3aba29e7a3
Vault is now the sole source of truth for secrets. SOPS pipeline removed entirely — auth via `vault login -method=oidc`. Part A: SOPS removal - vault/main.tf: delete 990 lines (93 vars + 43 KV write resources), add self-read data source for OIDC creds from secret/vault - terragrunt.hcl: remove SOPS var loading, vault_root_token, check_secrets hook - scripts/tg: remove SOPS decryption, keep -auto-approve logic - .woodpecker/default.yml: replace SOPS with Vault K8s auth via curl - Delete secrets.sops.json, .sops.yaml Part B: External Secrets Operator - New stack stacks/external-secrets/ with Helm chart + 2 ClusterSecretStores (vault-kv for KV v2, vault-database for DB engine) Part C: Database secrets engine (in vault/main.tf) - MySQL + PostgreSQL connections with static role rotation (24h) - 6 MySQL roles (speedtest, wrongmove, codimd, nextcloud, shlink, grafana) - 6 PostgreSQL roles (trading, health, linkwarden, affine, woodpecker, claude_memory) Part D: Kubernetes secrets engine (in vault/main.tf) - RBAC for Vault SA to manage K8s tokens - Roles: dashboard-admin, ci-deployer, openclaw, local-admin - New scripts/vault-kubeconfig helper for dynamic kubeconfig K8s auth method with scoped policies for CI, ESO, OpenClaw, Woodpecker sync.
80 lines
2 KiB
HCL
80 lines
2 KiB
HCL
resource "kubernetes_namespace" "external_secrets" {
|
|
metadata {
|
|
name = "external-secrets"
|
|
labels = {
|
|
tier = local.tiers.cluster
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "helm_release" "external_secrets" {
|
|
name = "external-secrets"
|
|
namespace = kubernetes_namespace.external_secrets.metadata[0].name
|
|
repository = "https://charts.external-secrets.io"
|
|
chart = "external-secrets"
|
|
version = "0.12.1"
|
|
|
|
values = [yamlencode({
|
|
installCRDs = true
|
|
})]
|
|
}
|
|
|
|
# --- ClusterSecretStore for Vault KV v2 ---
|
|
|
|
resource "kubernetes_manifest" "css_vault_kv" {
|
|
manifest = {
|
|
apiVersion = "external-secrets.io/v1beta1"
|
|
kind = "ClusterSecretStore"
|
|
metadata = { name = "vault-kv" }
|
|
spec = {
|
|
provider = {
|
|
vault = {
|
|
server = "http://vault-active.vault.svc.cluster.local:8200"
|
|
path = "secret"
|
|
version = "v2"
|
|
auth = {
|
|
kubernetes = {
|
|
mountPath = "kubernetes"
|
|
role = "eso"
|
|
serviceAccountRef = {
|
|
name = "external-secrets"
|
|
namespace = "external-secrets"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
depends_on = [helm_release.external_secrets]
|
|
}
|
|
|
|
# --- ClusterSecretStore for Vault Database Engine ---
|
|
|
|
resource "kubernetes_manifest" "css_vault_db" {
|
|
manifest = {
|
|
apiVersion = "external-secrets.io/v1beta1"
|
|
kind = "ClusterSecretStore"
|
|
metadata = { name = "vault-database" }
|
|
spec = {
|
|
provider = {
|
|
vault = {
|
|
server = "http://vault-active.vault.svc.cluster.local:8200"
|
|
path = "database"
|
|
version = "v1"
|
|
auth = {
|
|
kubernetes = {
|
|
mountPath = "kubernetes"
|
|
role = "eso"
|
|
serviceAccountRef = {
|
|
name = "external-secrets"
|
|
namespace = "external-secrets"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
depends_on = [helm_release.external_secrets]
|
|
}
|