Currently, Terraform states are on-disk. They will soon contain credentials with D4206.
Could we avoid to store those credentials on disk?
- At software level. OpenTofu supports openbao as encryption backend, but Terraform doesn't
- At provider level. With Vault provider 5.0+ can use a block json_data_wo to avoid to store in the Vault, but OVH doesn't have that.
- At stanza level. Terraform suggests ephemeral blocks for that kind of use, but OVH provider doesn't support it
- null_resource + local-exec. We could replace Terraform providers logic by a script to run locally to use OVH API and Vault CLI client. Works, but the Terraform point was to avoid that (if not, we would have done everything in Salt + salt-cloud).
On FreeBSD, we got good results with PEFS on devserver role.
So could we keep states on disk, but with encryption-at-rest?
Relevant links: