diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml index 8acf3e0..3972fc9 100644 --- a/infrastructure-secrets.yaml +++ b/infrastructure-secrets.yaml @@ -1340,7 +1340,7 @@ environments: lifecycle: ignore_changes: false data: - test-key: ENC[AES256_GCM,data:kuxtOu8Jf+6pIBOFJSDF0w==,iv:X4prcqoF966X+RCetGXd1H5EvjdJmBseiRrP5qZW+Ok=,tag:DuXrYstF2skc6dvP19abNw==,type:str] + test-key: ENC[AES256_GCM,data:jBkZ/S+WqKBfegjPaGT3Ig==,iv:rDGhROt0OSy+kGAhqirYyEeOrEyntJz2hzn7KX6ROrw=,tag:rXgn142fiN9ZeQscbfk3Xw==,type:str] - name: test-db-k8s namespace: contour type: database @@ -1926,17 +1926,17 @@ environments: password: ENC[AES256_GCM,data:s1Ogbd8a2XWwIRmpwE8/LfCL5nQDx3pJ1Ojl2erkNCE=,iv:W83tq9ErfzBbmbouCNT3gkvhyilSN+KA/3ViMSlMRXU=,tag:vehf//Phf6ijngyUIWqwtQ==,type:str] topics: - configs: - cleanup.policy: ENC[AES256_GCM,data:bci0at7a,iv:4A4fDSiY17839hTiEI4VIg6kFRUV4cs7p50nE/Zqf0k=,tag:IKyGJFmXi7Ihiqfo+51hIQ==,type:str] - retention.ms: ENC[AES256_GCM,data:OHpBeqDdg6ZA,iv:wH4ZxKyhj5tcxTCefdVMda2G6LzPJExhnnQFYQmMkOk=,tag:lGhCH2CiYXujdwNwSS4I4w==,type:str] + cleanup.policy: ENC[AES256_GCM,data:l9aeysDK,iv:+vVjtuoA+7Um8MAW2fG/4lDYASuDa0BPBwRkKgnThZU=,tag:ft4/jTPtw7BcZ/71pQWBbQ==,type:str] + retention.ms: ENC[AES256_GCM,data:So+CLuNKAm/8,iv:A2osiomxZRFOT9XtKd2AMIgdLVjKVt1d+opXuaSwbTs=,tag:vVVvRlVNCFuyVabqTIDKlQ==,type:str] name: ENC[AES256_GCM,data:t+M3aITQpWjkV90=,iv:nuCdm9JJeDNQiiiGB0D3y9xsRcmd7pNOfT73azOEufg=,tag:w3GePrjSSHS0DvEQw0qS8Q==,type:str] - partitions: ENC[AES256_GCM,data:WA==,iv:16BCF08lvhzJmeOtaEeeWHul2ACVyGr6klnnBANyljo=,tag:UH7Td0GRtY3sna+1VGXUaQ==,type:int] - replication_factor: ENC[AES256_GCM,data:mw==,iv:2p3IeM+gCV2rjRouMsorJmPW32oWWa0YK4bKx3oMHI4=,tag:RvuqtMdYYJvMqvUHeqTrCA==,type:int] + partitions: ENC[AES256_GCM,data:Ow==,iv:MJY8gIV0rYH56rFgJywHEyFmGTjKeWuJoqHm/JkRppw=,tag:xFzCz0i8+OVtaepSj8ZMHA==,type:int] + replication_factor: ENC[AES256_GCM,data:Ww==,iv:VWAaVg0LPAMwzzV3uvtVLhlxcIgkvWz6bdCcO+XWcxw=,tag:Ga4H+2ziS78eLZJTzp7GRQ==,type:int] - configs: - cleanup.policy: ENC[AES256_GCM,data:Prc/53fC,iv:8okyNgdamRmI1R2KvabFPGF7scUSpdI/kU7XUKz0fdg=,tag:51DKWHZ1CwqfyLgqNWeV+w==,type:str] - retention.ms: ENC[AES256_GCM,data:FPHsif9etKCT,iv:8moCT36zXh7G80sbIaXi4UwNZBGIS/Zr8nUc2uRe+gg=,tag:5v5wM7baOBIKyVfbts3Iow==,type:str] + cleanup.policy: ENC[AES256_GCM,data:l9aeysDK,iv:+vVjtuoA+7Um8MAW2fG/4lDYASuDa0BPBwRkKgnThZU=,tag:ft4/jTPtw7BcZ/71pQWBbQ==,type:str] + retention.ms: ENC[AES256_GCM,data:So+CLuNKAm/8,iv:A2osiomxZRFOT9XtKd2AMIgdLVjKVt1d+opXuaSwbTs=,tag:vVVvRlVNCFuyVabqTIDKlQ==,type:str] name: ENC[AES256_GCM,data:KnVT/mTcdE+ghdaXD3eeHQ==,iv:r6XURr//smAiOjkENgdGcUXWG1X6lqFxeelEe3Y2I+0=,tag:tz1JSBqg/PAwpy0LNZ0QGQ==,type:str] - partitions: ENC[AES256_GCM,data:7g==,iv:UNyFsa4tT0Z6t+p/yn8EWYg96Wv+RFXkpPu7coFL+b8=,tag:QBzQRcWtckQPoyIVi9KRuA==,type:int] - replication_factor: ENC[AES256_GCM,data:Ew==,iv:gEibiPAvcgPgGddC1ETlluNpUMo0Aqb/hbU75jp5DTc=,tag:HsAcaSPS1DcO15Du//JBJg==,type:int] + partitions: ENC[AES256_GCM,data:Ow==,iv:MJY8gIV0rYH56rFgJywHEyFmGTjKeWuJoqHm/JkRppw=,tag:xFzCz0i8+OVtaepSj8ZMHA==,type:int] + replication_factor: ENC[AES256_GCM,data:Ww==,iv:VWAaVg0LPAMwzzV3uvtVLhlxcIgkvWz6bdCcO+XWcxw=,tag:Ga4H+2ziS78eLZJTzp7GRQ==,type:int] - configs: cleanup.policy: ENC[AES256_GCM,data:l9aeysDK,iv:+vVjtuoA+7Um8MAW2fG/4lDYASuDa0BPBwRkKgnThZU=,tag:ft4/jTPtw7BcZ/71pQWBbQ==,type:str] retention.ms: ENC[AES256_GCM,data:So+CLuNKAm/8,iv:A2osiomxZRFOT9XtKd2AMIgdLVjKVt1d+opXuaSwbTs=,tag:vVVvRlVNCFuyVabqTIDKlQ==,type:str] @@ -2255,14 +2255,16 @@ environments: zeebe-secret: ENC[AES256_GCM,data:VFHr9YgTNqk/Y7rxFAtzzesqTFR1CN5Hs28feTzGprw=,iv:GUcI8kA33x5pk32xtd2hi0pI4OUrUfTw0LqxB+LpaEU=,tag:GIRuB0nVcsm6xrzrzjxzrw==,type:str] identity_firstuser: generate: ENC[AES256_GCM,data:gWbO/m0=,iv:CmmL0AGJRkg8DlSkmqoVQ2fyLHnPFMzmBkybZ9FRm8o=,tag:Urk9ZM8b34SYai+5Qq9gyg==,type:bool] - identity_firstuser_password: "" + identity_firstuser_password: ENC[AES256_GCM,data:cSvwDBwDu3o/pHwczcYdyqCUHQEe66U226ewJ/m55M8=,iv:GNt8A9qRxFD3uy6eKOm7J/yvO4NOcgY/LwVSDJOiDRc=,tag:OclWcsoxq6sWWrFpUsTptg==,type:str] keycloak_admin: generate: ENC[AES256_GCM,data:zYEwUzA=,iv:s1Nwr1dhc/U5NfDQHRKZjoOWAM+ujXSxNzu1HVZTNxE=,tag:0+eo0KzX+PqVapSwpncf3w==,type:bool] - admin_password: "" + admin_password: ENC[AES256_GCM,data:4JZNKfW144z1mSihzVstq0r6FcOOnwktZqLrR0xiGSw=,iv:d65e7Raj0jYe3xRmqIgLAj03l+dk/ZeKnPDxLC6wSSI=,tag:s7Laa3kknsCKXAIVXLQjNg==,type:str] postgresql: generate: ENC[AES256_GCM,data:zWVwwOA=,iv:Jj1eHN8g2SxhZ2fmaPa4nONESE5Dgss1TpRCATBrncQ=,tag:ldOgGZko8qtMIWuGGqjJ7A==,type:bool] password: "" postgres_password: "" + identity_password: ENC[AES256_GCM,data:YSdu6h9QUODVHsGKVn8+7/K/1c/phTyrfptezC+lfyWFFNtqGpGCOUUcd48vmTwJYH8I712QQHfYybmpe+2p3w==,iv:NLW5G79zsvlxMBTEPmswftRf6nyEWbdAbfPLCFa8mKU=,tag:hL0GWlrn9pYOFiiaAqPNzw==,type:str] + keycloak_password: ENC[AES256_GCM,data:w7M/YauGeGzZz/0l9uar83+fjLDZi5fx6oB6GmuOYE6ECd82wixX60VKCwPNv+Y+jEbkLJab8cxnH9gbqDSbvQ==,iv:FLqj9NiIBg2s2RPkZqFynWSJ6kHLdILp8ickZbQeEfM=,tag:QLCNVmuocmECfcjjXRi90Q==,type:str] secrets: - name: attachments-postgres type: database @@ -2626,8 +2628,8 @@ sops: dDV2c1FBTkdLajFtWHdDZjM1NjJQSzgK2ysr++aBuJeW67hdOg5Phqw2Jg6/4PqB qWKvglUwZfaMMOqGIMqw++wbgDNHLOl/pkoDb30qcC4NqW2Us7clXg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-07T08:53:29Z" - mac: ENC[AES256_GCM,data:b81s5abLYTZfqCGXnuu0Hi9eYa91X6vzr6Ktzzyyc0k2yjQAlQf8l+rTOiGE/0IfLi6SVBMhUC1fbRsLVp+LTQY65PJRkzQ+wbF9UPEocvFn65ayQ4KblAJskRm1LizD0YUyCR/bmdYgmn/llaOaA6x/rNv6C9jrWB+Brp0eVeQ=,iv:IanfOu4Vs0CcXS85bKeJCDT33Xu+ZZnL0cpINaZSYmA=,tag:GjCRYWcAUC5YZ1y0gS4z+g==,type:str] + lastmodified: "2026-08-07T11:35:00Z" + mac: ENC[AES256_GCM,data:Hhr1B1KVvJgwPrKafRLKhx6fGKpMMFpIToo017/BZ/vggCvTcwdRJgihNoqBErMjYHaDuCaBbtHRUkxdbFVt5hkIbEXae/ftjlT9GCZtvNAU++KZgx6AjMjD+/Yv/HHpXggwY1DvmGZLdLK2G2+QC4pUJmO51muwDjFvwVX3/nI=,iv:Hi8A8nvkIvIxPBU6O1GfpVbBZMWP6CG9AhMnHVvMl5U=,tag:ieaRgmsYg2MbAn5dEM8IZw==,type:str] pgp: [] encrypted_regex: ^(data)$ version: 3.9.0 diff --git a/modules/vault-platform-secrets/main.tf b/modules/vault-platform-secrets/main.tf index 6d7f623..eb04a03 100644 --- a/modules/vault-platform-secrets/main.tf +++ b/modules/vault-platform-secrets/main.tf @@ -191,6 +191,8 @@ locals { generate = false password = "" postgres_password = "" + identity_password = "" + keycloak_password = "" } role = { enabled = true @@ -504,6 +506,16 @@ locals { camunda_pg_postgres_password = trimspace(try(local.camunda_pg_cfg.postgres_password, "")) != "" ? trimspace(local.camunda_pg_cfg.postgres_password) : ( try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_postgres_password[0].result, "") : "" ) + # identity-password / keycloak-password are the two distinct app-DB user passwords + # (users "identity" and "bn_keycloak") that camunda-identity/camunda-keycloak vault-agent + # templates actually read from this secret - separate from the generic password/postgres-password + # fields above, which no consumer reads. + camunda_pg_identity_password = trimspace(try(local.camunda_pg_cfg.identity_password, "")) != "" ? trimspace(local.camunda_pg_cfg.identity_password) : ( + try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_identity_password[0].result, "") : "" + ) + camunda_pg_keycloak_password = trimspace(try(local.camunda_pg_cfg.keycloak_password, "")) != "" ? trimspace(local.camunda_pg_cfg.keycloak_password) : ( + try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_keycloak_password[0].result, "") : "" + ) keycloak_admin_password = trimspace(try(local.keycloak_admin_cfg.password, "")) != "" ? trimspace(local.keycloak_admin_cfg.password) : ( try(local.keycloak_admin_cfg.generate, false) ? try(random_password.keycloak_admin_password[0].result, "") : "" @@ -922,6 +934,20 @@ resource "random_password" "camunda_pg_postgres_password" { special = false } +resource "random_password" "camunda_pg_identity_password" { + count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) && try(local.camunda_pg_cfg.generate, false) && trimspace(try(local.camunda_pg_cfg.identity_password, "")) == "" ? 1 : 0 + + length = 32 + special = false +} + +resource "random_password" "camunda_pg_keycloak_password" { + count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) && try(local.camunda_pg_cfg.generate, false) && trimspace(try(local.camunda_pg_cfg.keycloak_password, "")) == "" ? 1 : 0 + + length = 32 + special = false +} + resource "random_password" "keycloak_admin_password" { count = var.create_infra_secrets && try(local.keycloak_cfg.enabled, true) && try(local.keycloak_admin_cfg.enabled, true) && try(local.keycloak_admin_cfg.generate, false) && trimspace(try(local.keycloak_admin_cfg.password, "")) == "" ? 1 : 0 @@ -1184,6 +1210,8 @@ resource "vault_kv_secret_v2" "camunda_postgresql" { data_json = jsonencode({ password = local.camunda_pg_password "postgres-password" = local.camunda_pg_postgres_password + "identity-password" = local.camunda_pg_identity_password + "keycloak-password" = local.camunda_pg_keycloak_password }) }