mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(gcp): Create Cloud KMS resources for encrypting secrets

Browse source 
The idea here is to use Cloud KMS and a shell script that mimics
'pass' to trick kontemplate into using Cloud KMS to decrypt secrets.
This commit is contained in:
Vincent Ambo 2019-09-03 15:13:34 +01:00
parent eb43ba75d2
commit abd5d7538c
1 changed files with 28 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
infra/gcp/default.tf
View file

@ -27,24 +27,25 @@ resource "google_project_services" "primary" {
"bigquerystorage.googleapis.com", "bigquerystorage.googleapis.com",
"cloudapis.googleapis.com", "cloudapis.googleapis.com",
"clouddebugger.googleapis.com", "clouddebugger.googleapis.com",
"cloudkms.googleapis.com",
"cloudtrace.googleapis.com", "cloudtrace.googleapis.com",
"compute.googleapis.com",
"container.googleapis.com",
"containerregistry.googleapis.com",
"datastore.googleapis.com", "datastore.googleapis.com",
"dns.googleapis.com", "dns.googleapis.com",
"iam.googleapis.com",
"iamcredentials.googleapis.com",
"logging.googleapis.com", "logging.googleapis.com",
"monitoring.googleapis.com", "monitoring.googleapis.com",
"oslogin.googleapis.com",
"pubsub.googleapis.com",
"servicemanagement.googleapis.com", "servicemanagement.googleapis.com",
"serviceusage.googleapis.com", "serviceusage.googleapis.com",
"sourcerepo.googleapis.com",
"sql-component.googleapis.com", "sql-component.googleapis.com",
"storage-api.googleapis.com", "storage-api.googleapis.com",
"storage-component.googleapis.com", "storage-component.googleapis.com",
"container.googleapis.com",
"iam.googleapis.com",
"compute.googleapis.com",
"iamcredentials.googleapis.com",
"oslogin.googleapis.com",
"pubsub.googleapis.com",
"containerregistry.googleapis.com",
"sourcerepo.googleapis.com",
] ]
} }
@ -81,3 +82,22 @@ resource "google_service_account" "nixery" {
account_id = "nixery" account_id = "nixery"
display_name = "Nixery service account" display_name = "Nixery service account"
} }
# Configure Cloud KMS for secret encryption
resource "google_kms_key_ring" "tazjins_keys" {
name = "tazjins-keys"
location = "europe-north1"
lifecycle {
prevent_destroy = true
}
}
resource "google_kms_crypto_key" "kontemplate_key" {
name = "kontemplate-key"
key_ring = google_kms_key_ring.tazjins_keys.id
lifecycle {
prevent_destroy = true
}
}