mirror of https://github.com/fluxcd/flux2.git
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
93 lines
2.1 KiB
HCL
93 lines
2.1 KiB
HCL
resource "azurerm_key_vault" "this" {
|
|
name = "kv-credentials-${random_pet.suffix.id}"
|
|
resource_group_name = azurerm_resource_group.this.name
|
|
location = azurerm_resource_group.this.location
|
|
tenant_id = data.azurerm_client_config.current.tenant_id
|
|
sku_name = "standard"
|
|
}
|
|
|
|
resource "azurerm_key_vault_access_policy" "admin" {
|
|
key_vault_id = azurerm_key_vault.this.id
|
|
tenant_id = data.azurerm_client_config.current.tenant_id
|
|
object_id = data.azurerm_client_config.current.object_id
|
|
|
|
key_permissions = [
|
|
"Backup",
|
|
"Create",
|
|
"Decrypt",
|
|
"Delete",
|
|
"Encrypt",
|
|
"Get",
|
|
"Import",
|
|
"List",
|
|
"Purge",
|
|
"Recover",
|
|
"Restore",
|
|
"Sign",
|
|
"UnwrapKey",
|
|
"Update",
|
|
"Verify",
|
|
"WrapKey",
|
|
]
|
|
|
|
secret_permissions = [
|
|
"Backup",
|
|
"Delete",
|
|
"Get",
|
|
"List",
|
|
"Purge",
|
|
"Recover",
|
|
"Restore",
|
|
"Set",
|
|
]
|
|
}
|
|
|
|
resource "azurerm_key_vault_access_policy" "cluster" {
|
|
key_vault_id = azurerm_key_vault.this.id
|
|
tenant_id = data.azurerm_client_config.current.tenant_id
|
|
object_id = azurerm_kubernetes_cluster.this.kubelet_identity[0].object_id
|
|
|
|
key_permissions = [
|
|
"Decrypt",
|
|
"Encrypt",
|
|
]
|
|
}
|
|
|
|
resource "azurerm_key_vault_key" "sops" {
|
|
depends_on = [azurerm_key_vault_access_policy.admin]
|
|
|
|
name = "sops"
|
|
key_vault_id = azurerm_key_vault.this.id
|
|
key_type = "RSA"
|
|
key_size = 2048
|
|
|
|
key_opts = [
|
|
"decrypt",
|
|
"encrypt",
|
|
]
|
|
}
|
|
|
|
resource "azurerm_key_vault_secret" "pat" {
|
|
depends_on = [azurerm_key_vault_access_policy.admin]
|
|
|
|
name = "pat"
|
|
value = var.azuredevops_pat
|
|
key_vault_id = azurerm_key_vault.this.id
|
|
}
|
|
|
|
resource "azurerm_key_vault_secret" "id_rsa" {
|
|
depends_on = [azurerm_key_vault_access_policy.admin]
|
|
|
|
name = "id-rsa"
|
|
value = var.azuredevops_id_rsa
|
|
key_vault_id = azurerm_key_vault.this.id
|
|
}
|
|
|
|
resource "azurerm_key_vault_secret" "id_rsa_pub" {
|
|
depends_on = [azurerm_key_vault_access_policy.admin]
|
|
|
|
name = "id-rsa-pub"
|
|
value = var.azuredevops_id_rsa_pub
|
|
key_vault_id = azurerm_key_vault.this.id
|
|
}
|