94 lines
2.8 KiB
Terraform
94 lines
2.8 KiB
Terraform
terraform {
|
|
required_version = ">= 1.10"
|
|
required_providers {
|
|
vault = {
|
|
source = "hashicorp/vault"
|
|
version = "~> 4.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "vault" {
|
|
address = var.bao_address
|
|
}
|
|
|
|
variable "bao_address" {
|
|
type = string
|
|
default = "https://bao.ad.ddupan.top:8200"
|
|
}
|
|
variable "pki_mount" {
|
|
type = string
|
|
default = "pki"
|
|
}
|
|
variable "kv_mount" {
|
|
type = string
|
|
default = "kv"
|
|
}
|
|
variable "member_names" {
|
|
type = list(string)
|
|
default = ["etcd-laptop", "etcd-pve1", "etcd-pve2"]
|
|
}
|
|
variable "consumer_names" {
|
|
type = set(string)
|
|
default = ["patroni-pg-prod"]
|
|
}
|
|
|
|
# 仅管理既有 PKI 下的新 role/policy，不纳管 CA 私钥、mount 或秘密值。
|
|
locals {
|
|
certificate_roles = {
|
|
server = { names = var.member_names, server = true, client = false, ips = true }
|
|
peer = { names = concat(var.member_names, ["homelab-etcd-peer"]), server = true, client = true, ips = true }
|
|
admin = { names = ["root"], server = false, client = true, ips = false }
|
|
gateway = { names = var.member_names, server = false, client = true, ips = false }
|
|
client = { names = [for name in var.consumer_names : "etcd-${name}"], server = false, client = true, ips = false }
|
|
}
|
|
}
|
|
resource "vault_pki_secret_backend_role" "etcd" {
|
|
for_each = local.certificate_roles
|
|
backend = var.pki_mount
|
|
name = "homelab-etcd-${each.key}"
|
|
allowed_domains = each.value.names
|
|
allow_bare_domains = true
|
|
allow_subdomains = false
|
|
allow_glob_domains = false
|
|
allow_any_name = false
|
|
allow_localhost = false
|
|
allow_wildcard_certificates = false
|
|
allow_ip_sans = each.value.ips
|
|
server_flag = each.value.server
|
|
client_flag = each.value.client
|
|
key_type = "ec"
|
|
key_bits = 256
|
|
ttl = 5184000
|
|
max_ttl = 5184000
|
|
require_cn = !contains(["gateway", "client"], each.key)
|
|
use_csr_common_name = true
|
|
use_csr_sans = true
|
|
}
|
|
|
|
resource "vault_policy" "etcd_provisioner" {
|
|
name = "homelab-etcd-provisioner"
|
|
policy = <<-EOT
|
|
path "${var.pki_mount}/sign/homelab-etcd-*" {
|
|
capabilities = ["update"]
|
|
}
|
|
path "${var.kv_mount}/metadata/infra/etcd/consumers/*" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "${var.kv_mount}/data/infra/etcd/consumers/*" {
|
|
capabilities = ["create", "read", "update"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
# 身份绑定沿用既有控制端认证方式，创建 policy 不自动授权任何身份。
|
|
resource "vault_policy" "etcd_consumer" {
|
|
for_each = var.consumer_names
|
|
name = "homelab-etcd-${each.key}"
|
|
policy = <<-EOT
|
|
path "${var.kv_mount}/data/infra/etcd/consumers/${each.key}" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
}
|