HomeDevCentral

Don't store Terraform state and always rotate secrets

Description

Don't store Terraform state and always rotate secrets

Summary:
The Terraform state goal is to track resources last deployed state.

For Vault, it doesn't matter as the current provider write objects
using a create-or-update API, so the policies, auth methods and kv
objects can be reprovisionned without breaking anything.

Also, Vault recommends secret rotation, we've an opportunity here
to easily do that by creating with make rotate an atomic transaction
where we update all secret_id through Terraform then update
the configuration files with Salt.

Finally, secrets need to be stored in Vault, not Terraform state,
so it makes sense to discard state as temporary working file for
this specific workflow.

Test Plan:

  • make rotate
  • Check Terraform output
  • Check Salt output

Differential Revision: https://devcentral.nasqueron.org/D3926

Details

Provenance
derecksonAuthored on Sun, Feb 8, 12:23
derecksonPushed on Sun, Feb 8, 13:21
Differential Revision
D3926: Don't store Terraform state and always rotate secrets
Parents
rOPSd81abfe1034d: Touch deployment log on deployment server
Branches
Unknown
Tags
Unknown