Page MenuHomeDevCentral
Files F24962034

D4016.diff
No OneTemporary
Actions

D4016.diff
View Options

diff --git a/terraform/openbao/policies/router.hcl b/terraform/openbao/policies/router.hcl
new file mode 100644
--- /dev/null
+++ b/terraform/openbao/policies/router.hcl
@@ -0,0 +1,18 @@
+# -------------------------------------------------------------
+# Vault configuration - Policy for router nodes
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# Source file: terraform/openbao/policies/router.hcl
+# -------------------------------------------------------------
+#
+# <auto-generated>
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
+# </auto-generated>
+
+path "apps/data/network/carp-hyper-001-switch" {
+ capabilities = [ "read" ]
+}
diff --git a/terraform/openbao/router.tf b/terraform/openbao/router.tf
new file mode 100644
--- /dev/null
+++ b/terraform/openbao/router.tf
@@ -0,0 +1,37 @@
+# -------------------------------------------------------------
+# Terraform :: OpenBao :: Router
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: BSD-2-Clause
+# Provider: Vault / OpenBao
+# Target: completor.nasqueron.drake
+# -------------------------------------------------------------
+
+# -------------------------------------------------------------
+# Policy
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+resource "vault_policy" "router" {
+ name = "router"
+ policy = file("${path.module}/policies/router.hcl")
+}
+
+# -------------------------------------------------------------
+# AppRole
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+module "router_approle" {
+ source = "./modules/app_credentials"
+
+ role_name = "router"
+ policies = ["router"]
+
+ secret_id_bound_cidrs = [
+ "172.27.27.11/32", # router-002
+ "172.27.27.12/32", # router-003
+ ]
+
+ # Save credentials to
+ kv_mount = "ops"
+ kv_path = "secrets/network/router/vault"
+}

File Metadata

Mime Type
text/plain
Expires
Sun, Mar 22, 14:32 (20 h, 52 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
3553689
Default Alt Text
D4016.diff (2 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator