mirror of
https://gitlab.sarex.io/infra/terraform-contour-mirror.git
synced 2026-08-09 05:21:36 +03:00
fix camunda vault secrets: restore admin/firstuser/db passwords as explicit values, add identity-password/keycloak-password fields to camunda_postgresql secret
This commit is contained in:
parent
d642789448
commit
261b581508
@ -1340,7 +1340,7 @@ environments:
|
||||
lifecycle:
|
||||
ignore_changes: false
|
||||
data:
|
||||
test-key: ENC[AES256_GCM,data:kuxtOu8Jf+6pIBOFJSDF0w==,iv:X4prcqoF966X+RCetGXd1H5EvjdJmBseiRrP5qZW+Ok=,tag:DuXrYstF2skc6dvP19abNw==,type:str]
|
||||
test-key: ENC[AES256_GCM,data:jBkZ/S+WqKBfegjPaGT3Ig==,iv:rDGhROt0OSy+kGAhqirYyEeOrEyntJz2hzn7KX6ROrw=,tag:rXgn142fiN9ZeQscbfk3Xw==,type:str]
|
||||
- name: test-db-k8s
|
||||
namespace: contour
|
||||
type: database
|
||||
@ -1926,17 +1926,17 @@ environments:
|
||||
password: ENC[AES256_GCM,data:s1Ogbd8a2XWwIRmpwE8/LfCL5nQDx3pJ1Ojl2erkNCE=,iv:W83tq9ErfzBbmbouCNT3gkvhyilSN+KA/3ViMSlMRXU=,tag:vehf//Phf6ijngyUIWqwtQ==,type:str]
|
||||
topics:
|
||||
- configs:
|
||||
cleanup.policy: ENC[AES256_GCM,data:bci0at7a,iv:4A4fDSiY17839hTiEI4VIg6kFRUV4cs7p50nE/Zqf0k=,tag:IKyGJFmXi7Ihiqfo+51hIQ==,type:str]
|
||||
retention.ms: ENC[AES256_GCM,data:OHpBeqDdg6ZA,iv:wH4ZxKyhj5tcxTCefdVMda2G6LzPJExhnnQFYQmMkOk=,tag:lGhCH2CiYXujdwNwSS4I4w==,type:str]
|
||||
cleanup.policy: ENC[AES256_GCM,data:l9aeysDK,iv:+vVjtuoA+7Um8MAW2fG/4lDYASuDa0BPBwRkKgnThZU=,tag:ft4/jTPtw7BcZ/71pQWBbQ==,type:str]
|
||||
retention.ms: ENC[AES256_GCM,data:So+CLuNKAm/8,iv:A2osiomxZRFOT9XtKd2AMIgdLVjKVt1d+opXuaSwbTs=,tag:vVVvRlVNCFuyVabqTIDKlQ==,type:str]
|
||||
name: ENC[AES256_GCM,data:t+M3aITQpWjkV90=,iv:nuCdm9JJeDNQiiiGB0D3y9xsRcmd7pNOfT73azOEufg=,tag:w3GePrjSSHS0DvEQw0qS8Q==,type:str]
|
||||
partitions: ENC[AES256_GCM,data:WA==,iv:16BCF08lvhzJmeOtaEeeWHul2ACVyGr6klnnBANyljo=,tag:UH7Td0GRtY3sna+1VGXUaQ==,type:int]
|
||||
replication_factor: ENC[AES256_GCM,data:mw==,iv:2p3IeM+gCV2rjRouMsorJmPW32oWWa0YK4bKx3oMHI4=,tag:RvuqtMdYYJvMqvUHeqTrCA==,type:int]
|
||||
partitions: ENC[AES256_GCM,data:Ow==,iv:MJY8gIV0rYH56rFgJywHEyFmGTjKeWuJoqHm/JkRppw=,tag:xFzCz0i8+OVtaepSj8ZMHA==,type:int]
|
||||
replication_factor: ENC[AES256_GCM,data:Ww==,iv:VWAaVg0LPAMwzzV3uvtVLhlxcIgkvWz6bdCcO+XWcxw=,tag:Ga4H+2ziS78eLZJTzp7GRQ==,type:int]
|
||||
- configs:
|
||||
cleanup.policy: ENC[AES256_GCM,data:Prc/53fC,iv:8okyNgdamRmI1R2KvabFPGF7scUSpdI/kU7XUKz0fdg=,tag:51DKWHZ1CwqfyLgqNWeV+w==,type:str]
|
||||
retention.ms: ENC[AES256_GCM,data:FPHsif9etKCT,iv:8moCT36zXh7G80sbIaXi4UwNZBGIS/Zr8nUc2uRe+gg=,tag:5v5wM7baOBIKyVfbts3Iow==,type:str]
|
||||
cleanup.policy: ENC[AES256_GCM,data:l9aeysDK,iv:+vVjtuoA+7Um8MAW2fG/4lDYASuDa0BPBwRkKgnThZU=,tag:ft4/jTPtw7BcZ/71pQWBbQ==,type:str]
|
||||
retention.ms: ENC[AES256_GCM,data:So+CLuNKAm/8,iv:A2osiomxZRFOT9XtKd2AMIgdLVjKVt1d+opXuaSwbTs=,tag:vVVvRlVNCFuyVabqTIDKlQ==,type:str]
|
||||
name: ENC[AES256_GCM,data:KnVT/mTcdE+ghdaXD3eeHQ==,iv:r6XURr//smAiOjkENgdGcUXWG1X6lqFxeelEe3Y2I+0=,tag:tz1JSBqg/PAwpy0LNZ0QGQ==,type:str]
|
||||
partitions: ENC[AES256_GCM,data:7g==,iv:UNyFsa4tT0Z6t+p/yn8EWYg96Wv+RFXkpPu7coFL+b8=,tag:QBzQRcWtckQPoyIVi9KRuA==,type:int]
|
||||
replication_factor: ENC[AES256_GCM,data:Ew==,iv:gEibiPAvcgPgGddC1ETlluNpUMo0Aqb/hbU75jp5DTc=,tag:HsAcaSPS1DcO15Du//JBJg==,type:int]
|
||||
partitions: ENC[AES256_GCM,data:Ow==,iv:MJY8gIV0rYH56rFgJywHEyFmGTjKeWuJoqHm/JkRppw=,tag:xFzCz0i8+OVtaepSj8ZMHA==,type:int]
|
||||
replication_factor: ENC[AES256_GCM,data:Ww==,iv:VWAaVg0LPAMwzzV3uvtVLhlxcIgkvWz6bdCcO+XWcxw=,tag:Ga4H+2ziS78eLZJTzp7GRQ==,type:int]
|
||||
- configs:
|
||||
cleanup.policy: ENC[AES256_GCM,data:l9aeysDK,iv:+vVjtuoA+7Um8MAW2fG/4lDYASuDa0BPBwRkKgnThZU=,tag:ft4/jTPtw7BcZ/71pQWBbQ==,type:str]
|
||||
retention.ms: ENC[AES256_GCM,data:So+CLuNKAm/8,iv:A2osiomxZRFOT9XtKd2AMIgdLVjKVt1d+opXuaSwbTs=,tag:vVVvRlVNCFuyVabqTIDKlQ==,type:str]
|
||||
@ -2255,14 +2255,16 @@ environments:
|
||||
zeebe-secret: ENC[AES256_GCM,data:VFHr9YgTNqk/Y7rxFAtzzesqTFR1CN5Hs28feTzGprw=,iv:GUcI8kA33x5pk32xtd2hi0pI4OUrUfTw0LqxB+LpaEU=,tag:GIRuB0nVcsm6xrzrzjxzrw==,type:str]
|
||||
identity_firstuser:
|
||||
generate: ENC[AES256_GCM,data:gWbO/m0=,iv:CmmL0AGJRkg8DlSkmqoVQ2fyLHnPFMzmBkybZ9FRm8o=,tag:Urk9ZM8b34SYai+5Qq9gyg==,type:bool]
|
||||
identity_firstuser_password: ""
|
||||
identity_firstuser_password: ENC[AES256_GCM,data:cSvwDBwDu3o/pHwczcYdyqCUHQEe66U226ewJ/m55M8=,iv:GNt8A9qRxFD3uy6eKOm7J/yvO4NOcgY/LwVSDJOiDRc=,tag:OclWcsoxq6sWWrFpUsTptg==,type:str]
|
||||
keycloak_admin:
|
||||
generate: ENC[AES256_GCM,data:zYEwUzA=,iv:s1Nwr1dhc/U5NfDQHRKZjoOWAM+ujXSxNzu1HVZTNxE=,tag:0+eo0KzX+PqVapSwpncf3w==,type:bool]
|
||||
admin_password: ""
|
||||
admin_password: ENC[AES256_GCM,data:4JZNKfW144z1mSihzVstq0r6FcOOnwktZqLrR0xiGSw=,iv:d65e7Raj0jYe3xRmqIgLAj03l+dk/ZeKnPDxLC6wSSI=,tag:s7Laa3kknsCKXAIVXLQjNg==,type:str]
|
||||
postgresql:
|
||||
generate: ENC[AES256_GCM,data:zWVwwOA=,iv:Jj1eHN8g2SxhZ2fmaPa4nONESE5Dgss1TpRCATBrncQ=,tag:ldOgGZko8qtMIWuGGqjJ7A==,type:bool]
|
||||
password: ""
|
||||
postgres_password: ""
|
||||
identity_password: ENC[AES256_GCM,data:YSdu6h9QUODVHsGKVn8+7/K/1c/phTyrfptezC+lfyWFFNtqGpGCOUUcd48vmTwJYH8I712QQHfYybmpe+2p3w==,iv:NLW5G79zsvlxMBTEPmswftRf6nyEWbdAbfPLCFa8mKU=,tag:hL0GWlrn9pYOFiiaAqPNzw==,type:str]
|
||||
keycloak_password: ENC[AES256_GCM,data:w7M/YauGeGzZz/0l9uar83+fjLDZi5fx6oB6GmuOYE6ECd82wixX60VKCwPNv+Y+jEbkLJab8cxnH9gbqDSbvQ==,iv:FLqj9NiIBg2s2RPkZqFynWSJ6kHLdILp8ickZbQeEfM=,tag:QLCNVmuocmECfcjjXRi90Q==,type:str]
|
||||
secrets:
|
||||
- name: attachments-postgres
|
||||
type: database
|
||||
@ -2626,8 +2628,8 @@ sops:
|
||||
dDV2c1FBTkdLajFtWHdDZjM1NjJQSzgK2ysr++aBuJeW67hdOg5Phqw2Jg6/4PqB
|
||||
qWKvglUwZfaMMOqGIMqw++wbgDNHLOl/pkoDb30qcC4NqW2Us7clXg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2026-08-07T08:53:29Z"
|
||||
mac: ENC[AES256_GCM,data:b81s5abLYTZfqCGXnuu0Hi9eYa91X6vzr6Ktzzyyc0k2yjQAlQf8l+rTOiGE/0IfLi6SVBMhUC1fbRsLVp+LTQY65PJRkzQ+wbF9UPEocvFn65ayQ4KblAJskRm1LizD0YUyCR/bmdYgmn/llaOaA6x/rNv6C9jrWB+Brp0eVeQ=,iv:IanfOu4Vs0CcXS85bKeJCDT33Xu+ZZnL0cpINaZSYmA=,tag:GjCRYWcAUC5YZ1y0gS4z+g==,type:str]
|
||||
lastmodified: "2026-08-07T11:35:00Z"
|
||||
mac: ENC[AES256_GCM,data:Hhr1B1KVvJgwPrKafRLKhx6fGKpMMFpIToo017/BZ/vggCvTcwdRJgihNoqBErMjYHaDuCaBbtHRUkxdbFVt5hkIbEXae/ftjlT9GCZtvNAU++KZgx6AjMjD+/Yv/HHpXggwY1DvmGZLdLK2G2+QC4pUJmO51muwDjFvwVX3/nI=,iv:Hi8A8nvkIvIxPBU6O1GfpVbBZMWP6CG9AhMnHVvMl5U=,tag:ieaRgmsYg2MbAn5dEM8IZw==,type:str]
|
||||
pgp: []
|
||||
encrypted_regex: ^(data)$
|
||||
version: 3.9.0
|
||||
|
||||
@ -191,6 +191,8 @@ locals {
|
||||
generate = false
|
||||
password = ""
|
||||
postgres_password = ""
|
||||
identity_password = ""
|
||||
keycloak_password = ""
|
||||
}
|
||||
role = {
|
||||
enabled = true
|
||||
@ -504,6 +506,16 @@ locals {
|
||||
camunda_pg_postgres_password = trimspace(try(local.camunda_pg_cfg.postgres_password, "")) != "" ? trimspace(local.camunda_pg_cfg.postgres_password) : (
|
||||
try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_postgres_password[0].result, "") : ""
|
||||
)
|
||||
# identity-password / keycloak-password are the two distinct app-DB user passwords
|
||||
# (users "identity" and "bn_keycloak") that camunda-identity/camunda-keycloak vault-agent
|
||||
# templates actually read from this secret - separate from the generic password/postgres-password
|
||||
# fields above, which no consumer reads.
|
||||
camunda_pg_identity_password = trimspace(try(local.camunda_pg_cfg.identity_password, "")) != "" ? trimspace(local.camunda_pg_cfg.identity_password) : (
|
||||
try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_identity_password[0].result, "") : ""
|
||||
)
|
||||
camunda_pg_keycloak_password = trimspace(try(local.camunda_pg_cfg.keycloak_password, "")) != "" ? trimspace(local.camunda_pg_cfg.keycloak_password) : (
|
||||
try(local.camunda_pg_cfg.generate, false) ? try(random_password.camunda_pg_keycloak_password[0].result, "") : ""
|
||||
)
|
||||
|
||||
keycloak_admin_password = trimspace(try(local.keycloak_admin_cfg.password, "")) != "" ? trimspace(local.keycloak_admin_cfg.password) : (
|
||||
try(local.keycloak_admin_cfg.generate, false) ? try(random_password.keycloak_admin_password[0].result, "") : ""
|
||||
@ -922,6 +934,20 @@ resource "random_password" "camunda_pg_postgres_password" {
|
||||
special = false
|
||||
}
|
||||
|
||||
resource "random_password" "camunda_pg_identity_password" {
|
||||
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) && try(local.camunda_pg_cfg.generate, false) && trimspace(try(local.camunda_pg_cfg.identity_password, "")) == "" ? 1 : 0
|
||||
|
||||
length = 32
|
||||
special = false
|
||||
}
|
||||
|
||||
resource "random_password" "camunda_pg_keycloak_password" {
|
||||
count = var.create_infra_secrets && try(local.camunda_cfg.enabled, true) && try(local.camunda_pg_cfg.enabled, true) && try(local.camunda_pg_cfg.generate, false) && trimspace(try(local.camunda_pg_cfg.keycloak_password, "")) == "" ? 1 : 0
|
||||
|
||||
length = 32
|
||||
special = false
|
||||
}
|
||||
|
||||
resource "random_password" "keycloak_admin_password" {
|
||||
count = var.create_infra_secrets && try(local.keycloak_cfg.enabled, true) && try(local.keycloak_admin_cfg.enabled, true) && try(local.keycloak_admin_cfg.generate, false) && trimspace(try(local.keycloak_admin_cfg.password, "")) == "" ? 1 : 0
|
||||
|
||||
@ -1184,6 +1210,8 @@ resource "vault_kv_secret_v2" "camunda_postgresql" {
|
||||
data_json = jsonencode({
|
||||
password = local.camunda_pg_password
|
||||
"postgres-password" = local.camunda_pg_postgres_password
|
||||
"identity-password" = local.camunda_pg_identity_password
|
||||
"keycloak-password" = local.camunda_pg_keycloak_password
|
||||
})
|
||||
}
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user