feat: add vault and time providers, update examples and modules for secrets management

Author: mahauber

.github/publish-release.yml .github/workflows/publish-release.yml.github/publish-release.yml renamed to .github/workflows/publish-release.yml

@@ -2,4 +2,16 @@ provider "stackit" {
   default_region        = var.region
   enable_beta_resources = true
   experiments           = ["iam", "routing-tables", "network"]
-}
+}
+
+provider "vault" {
+  address          = "https://prod.sm.eu01.stackit.cloud"
+  skip_child_token = true
+
+  auth_login_userpass {
+    username = module.management.secretsmanager_username
+    password = module.management.secretsmanager_password
+  }
+}
+
+provider "time" {}

examples/01-standalone/providers.tf

@@ -6,5 +6,13 @@ terraform {
       source  = "stackitcloud/stackit"
       version = "0.88.0"
     }
+    time = {
+      source  = "hashicorp/time"
+      version = "0.13.1"
+    }
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.7.0"
+    }
   }
 }

examples/01-standalone/terraform.tf

@@ -3,3 +3,15 @@ provider "stackit" {
   enable_beta_resources = true
   experiments           = ["iam", "routing-tables", "network"]
 }
+
+provider "vault" {
+  address          = "https://prod.sm.eu01.stackit.cloud"
+  skip_child_token = true
+
+  auth_login_userpass {
+    username = module.management.secretsmanager_username
+    password = module.management.secretsmanager_password
+  }
+}
+
+provider "time" {}

examples/02-hub-spoke/providers.tf

@@ -6,5 +6,13 @@ terraform {
       source  = "stackitcloud/stackit"
       version = "0.88.0"
     }
+    time = {
+      source  = "hashicorp/time"
+      version = "0.13.1"
+    }
+    vault = {
+      source  = "hashicorp/vault"
+      version = "5.7.0"
+    }
   }
 }

examples/02-hub-spoke/terraform.tf

@@ -8,9 +8,10 @@ resource "stackit_secretsmanager_instance" "this" {
   # acls       = length(var.secretsmanager_config.acls) > 0 ? var.secretsmanager_config.acls : null
 }
 
-resource "stackit_secretsmanager_user" "default" {
-  project_id    = stackit_resourcemanager_project.this.project_id
-  instance_id   = stackit_secretsmanager_instance.this.instance_id
-  description   = "Default user for accessing the Secrets Manager"
-  write_enabled = true
-}
+# used for vault provider to access the secrets manager instance
+# resource "stackit_secretsmanager_user" "default" {
+#   project_id    = stackit_resourcemanager_project.this.project_id
+#   instance_id   = stackit_secretsmanager_instance.this.instance_id
+#   description   = "Default user for accessing the Secrets Manager"
+#   write_enabled = true
+# }

modules/landing-zone/4-secrets-manager.tf

@@ -31,15 +31,15 @@ resource "stackit_objectstorage_credential" "this" {
   credentials_group_id = stackit_objectstorage_credentials_group.this.credentials_group_id
 }
 
-# resource "vault_kv_secret_v2" "object_storage_credentials" {
-#   mount               = stackit_secretsmanager_instance.this.instance_id
-#   name                = "service_account_key_${stackit_service_account.automation.name}"
-#   cas                 = 1
-#   delete_all_versions = true
-#   data_json = jsonencode(
-#     {
-#       ACCESS_KEY        = stackit_objectstorage_credential.this.access_key,
-#       SECRET_ACCESS_KEY = stackit_objectstorage_credential.this.secret_access_key
-#     }
-#   )
-# }
+resource "vault_kv_secret_v2" "object_storage_credentials" {
+  mount               = stackit_secretsmanager_instance.this.instance_id
+  name                = "service_account_key_${stackit_service_account.automation.name}"
+  cas                 = 1
+  delete_all_versions = true
+  data_json = jsonencode(
+    {
+      ACCESS_KEY        = stackit_objectstorage_credential.this.access_key,
+      SECRET_ACCESS_KEY = stackit_objectstorage_credential.this.secret_access_key
+    }
+  )
+}

modules/management/3-bucket.tf

@@ -27,10 +27,10 @@ resource "stackit_authorization_organization_role_assignment" "sa_owner" {
   subject     = stackit_service_account.automation.email
 }
 
-# resource "vault_kv_secret_v2" "service_account_key_automation" {
-#   mount               = stackit_secretsmanager_instance.this.instance_id
-#   name                = "service_account_key_${stackit_service_account.automation.name}"
-#   cas                 = 1
-#   delete_all_versions = true
-#   data_json           = stackit_service_account_key.automation.json
-# }
+resource "vault_kv_secret_v2" "service_account_key_automation" {
+  mount               = stackit_secretsmanager_instance.this.instance_id
+  name                = "service_account_key_${stackit_service_account.automation.name}"
+  cas                 = 1
+  delete_all_versions = true
+  data_json           = stackit_service_account_key.automation.json
+}

modules/management/4-service-account.tf

@@ -16,4 +16,15 @@ output "project_name" {
 output "service_account_email" {
   description = "The email of the created service account."
   value       = stackit_service_account.automation.email
+}
+
+output "secretsmanager_username" {
+  description = "The username of the default Secrets Manager user."
+  value       = stackit_secretsmanager_user.default.username
+}
+
+output "secretsmanager_password" {
+  description = "The password of the default Secrets Manager user."
+  value       = stackit_secretsmanager_user.default.password
+  sensitive   = true
 }

modules/management/outputs.tf

@@ -10,5 +10,9 @@ terraform {
       source  = "hashicorp/time"
       version = ">=0.13.1"
     }
+    vault = {
+      source  = "hashicorp/vault"
+      version = ">=5.7.0"
+    }
   }
 }