63c20f23ed
- Add vault provider to root terragrunt.hcl (generated providers.tf) - Delete stacks/vault/vault_provider.tf (now in generated providers.tf) - Add 124 variable declarations + 43 vault_kv_secret_v2 resources to vault/main.tf to populate Vault KV at secret/<stack-name> - Migrate 43 consuming stacks to read secrets from Vault KV via data "vault_kv_secret_v2" instead of SOPS var-file - Add dependency "vault" to all migrated stacks' terragrunt.hcl - Complex types (maps/lists) stored as JSON strings, decoded with jsondecode() in locals blocks Bootstrap secrets (vault_root_token, vault_authentik_client_id, vault_authentik_client_secret) remain in SOPS permanently. Apply order: vault stack first (populates KV), then all others.
32 lines
698 B
HCL
32 lines
698 B
HCL
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
|
|
terraform {
|
|
required_providers {
|
|
proxmox = {
|
|
source = "telmate/proxmox"
|
|
version = "3.0.2-rc07"
|
|
}
|
|
}
|
|
}
|
|
|
|
variable "kube_config_path" {
|
|
type = string
|
|
default = "~/.kube/config"
|
|
sensitive = true
|
|
}
|
|
|
|
variable "proxmox_pm_api_url" { type = string }
|
|
variable "proxmox_pm_api_token_id" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
variable "proxmox_pm_api_token_secret" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
provider "proxmox" {
|
|
pm_api_url = var.proxmox_pm_api_url
|
|
pm_api_token_id = var.proxmox_pm_api_token_id
|
|
pm_api_token_secret = var.proxmox_pm_api_token_secret
|
|
pm_tls_insecure = true
|
|
}
|