Skip to content

Commit f419284

Browse files
juniorjunior
committed
modularization of the kms
Signed-off-by: junior <junior@users.noreply.github.com>
1 parent 09d2797 commit f419284

File tree

5 files changed

+173
-6
lines changed

5 files changed

+173
-6
lines changed

‎modules/oke/kms.tf renamed to ‎modules/oci-vault-kms/main.tf

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright (c) 2021 Oracle and/or its affiliates. All rights reserved.
1+
# Copyright (c) 2021, 2022 Oracle and/or its affiliates. All rights reserved.
22
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
33
#
44

@@ -8,19 +8,19 @@
88

99
### OCI Vault vault
1010
resource "oci_kms_vault" "oke_vault" {
11-
compartment_id = local.oke_compartment_ocid
12-
display_name = "${local.vault_display_name} - ${random_string.deploy_id.result}"
11+
compartment_id = var.oke_cluster_compartment_ocid
12+
display_name = "${local.vault_display_name} - ${var.app_details.app_deployment_id}"
1313
vault_type = local.vault_type[0]
1414
freeform_tags = local.freeform_deployment_tags
1515

16-
depends_on = [oci_identity_policy.kms_user_group_compartment_policies]
16+
# depends_on = [oci_identity_policy.kms_user_group_compartment_policies]
1717

1818
count = var.use_encryption_from_oci_vault ? (var.create_new_encryption_key ? 1 : 0) : 0
1919
}
2020
### OCI Vault key
2121
resource "oci_kms_key" "oke_key" {
22-
compartment_id = local.oke_compartment_ocid
23-
display_name = "${local.vault_key_display_name} - ${random_string.deploy_id.result}"
22+
compartment_id = var.oke_cluster_compartment_ocid
23+
display_name = "${local.vault_key_display_name} - ${var.app_details.app_deployment_id}"
2424
management_endpoint = oci_kms_vault.oke_vault[0].management_endpoint
2525
protection_mode = local.vault_key_protection_mode
2626
freeform_tags = local.freeform_deployment_tags

‎modules/oci-vault-kms/outputs.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Copyright (c) 2022 Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
output "oci_vault_key_id" {
6+
value = var.use_encryption_from_oci_vault ? (var.create_new_encryption_key ? oci_kms_key.oke_key[0].id : var.existent_encryption_key_id) : null
7+
}

‎modules/oci-vault-kms/policies.tf

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# Copyright (c) 2022 Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
resource "oci_identity_dynamic_group" "app_dynamic_group" {
6+
name = "${local.app_name_normalized}-kms-dg-${var.app_details.app_deployment_id}"
7+
description = "${var.app_details.app_name} KMS for OKE Dynamic Group (${var.app_details.app_deployment_id})"
8+
compartment_id = var.tenancy_ocid
9+
matching_rule = "ANY {${join(",", local.dynamic_group_matching_rules)}}"
10+
11+
provider = oci.home_region
12+
13+
count = var.create_dynamic_group_for_nodes_in_compartment ? 1 : 0
14+
}
15+
resource "oci_identity_policy" "app_compartment_policies" {
16+
name = "${local.app_name_normalized}-kms-compartment-policies-${var.app_details.app_deployment_id}"
17+
description = "${var.app_details.app_name} KMS for OKE Compartment Policies (${var.app_details.app_deployment_id})"
18+
compartment_id = var.oke_cluster_compartment_ocid
19+
statements = local.app_compartment_statements
20+
21+
depends_on = [oci_identity_dynamic_group.app_dynamic_group]
22+
23+
provider = oci.home_region
24+
25+
count = var.create_compartment_policies ? 1 : 0
26+
}
27+
resource "oci_identity_policy" "kms_user_group_compartment_policies" {
28+
name = "${local.app_name_normalized}-kms-compartment-policies-${var.app_details.app_deployment_id}"
29+
description = "${var.app_details.app_name} KMS User Group Compartment Policies (${var.app_details.app_deployment_id})"
30+
compartment_id = var.oke_cluster_compartment_ocid
31+
statements = local.kms_user_group_compartment_statements
32+
33+
depends_on = [oci_identity_dynamic_group.app_dynamic_group]
34+
35+
provider = oci.home_region
36+
37+
count = (var.create_compartment_policies && var.create_vault_policies_for_group) ? 1 : 0
38+
}
39+
40+
# Concat Matching Rules and Policy Statements
41+
locals {
42+
dynamic_group_matching_rules = concat(
43+
local.instances_in_compartment_rule,
44+
local.clusters_in_compartment_rule
45+
)
46+
app_compartment_statements = concat(
47+
var.use_encryption_from_oci_vault ? local.allow_oke_use_oci_vault_keys_statements : []
48+
)
49+
kms_user_group_compartment_statements = concat(
50+
local.allow_group_manage_vault_keys_statements
51+
)
52+
}
53+
54+
# Individual Rules
55+
locals {
56+
instances_in_compartment_rule = ["ALL {instance.compartment.id = '${var.oke_cluster_compartment_ocid}'}"]
57+
clusters_in_compartment_rule = ["ALL {resource.type = 'cluster', resource.compartment.id = '${var.oke_cluster_compartment_ocid}'}"]
58+
}
59+
60+
# Individual Policy Statements
61+
locals {
62+
allow_oke_use_oci_vault_keys_statements = [
63+
"Allow service oke to use vaults in compartment id ${var.oke_cluster_compartment_ocid}",
64+
"Allow service oke to use keys in compartment id ${var.oke_cluster_compartment_ocid} where target.key.id = '${local.oci_vault_key_id}'",
65+
"Allow service oke to use key-delegates in compartment id ${var.oke_cluster_compartment_ocid} where target.key.id = '${local.oci_vault_key_id}'",
66+
"Allow service blockstorage to use keys in compartment id ${var.oke_cluster_compartment_ocid} where target.key.id = '${local.oci_vault_key_id}'",
67+
"Allow dynamic-group ${local.app_dynamic_group} to use keys in compartment id ${var.oke_cluster_compartment_ocid} where target.key.id = '${local.oci_vault_key_id}'",
68+
"Allow dynamic-group ${local.app_dynamic_group} to use key-delegates in compartment id ${var.oke_cluster_compartment_ocid} where target.key.id = '${local.oci_vault_key_id}'"
69+
]
70+
allow_group_manage_vault_keys_statements = [
71+
"Allow group ${var.user_admin_group_for_vault_policy} to manage vaults in compartment id ${var.oke_cluster_compartment_ocid}",
72+
"Allow group ${var.user_admin_group_for_vault_policy} to manage keys in compartment id ${var.oke_cluster_compartment_ocid}",
73+
"Allow group ${var.user_admin_group_for_vault_policy} to use key-delegate in compartment id ${var.oke_cluster_compartment_ocid}"
74+
]
75+
}
76+
77+
# Conditional locals
78+
locals {
79+
app_dynamic_group = var.create_dynamic_group_for_nodes_in_compartment ? oci_identity_dynamic_group.app_dynamic_group.0.name : "void"
80+
app_name_normalized = var.app_details.app_name_normalized
81+
}

‎modules/oci-vault-kms/providers.tf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
terraform {
6+
required_version = ">= 1.1"
7+
required_providers {
8+
oci = {
9+
source = "oracle/oci"
10+
version = "~> 4"
11+
# https://registry.terraform.io/providers/oracle/oci/
12+
configuration_aliases = [oci.home_region]
13+
}
14+
local = {
15+
source = "hashicorp/local"
16+
version = "~> 2"
17+
# https://registry.terraform.io/providers/hashicorp/local/
18+
}
19+
}
20+
}

‎modules/oci-vault-kms/variables.tf

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Copyright (c) 2021, 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
# OKE Encryption details
6+
variable "use_encryption_from_oci_vault" {
7+
default = false
8+
description = "By default, Oracle manages the keys that encrypts Kubernetes Secrets at Rest in Etcd, but you can choose a key from a vault that you have access to, if you want greater control over the key's lifecycle and how it's used"
9+
}
10+
variable "create_new_encryption_key" {
11+
default = false
12+
description = "Creates new vault and key on OCI Vault/Key Management/KMS and assign to boot volume of the worker nodes"
13+
}
14+
variable "existent_encryption_key_id" {
15+
default = ""
16+
description = "Use an existent master encryption key to encrypt boot volume and object storage bucket. NOTE: If the key resides in a different compartment or in a different tenancy, make sure you have the proper policies to access, or the provision of the worker nodes will fail"
17+
}
18+
19+
# Deployment Details
20+
variable "app_details" {
21+
description = "App Details"
22+
}
23+
24+
# OKE Variables
25+
variable "oke_cluster_compartment_ocid" {
26+
description = "Compartment OCID used by the OKE Cluster"
27+
type = string
28+
}
29+
30+
# Policies variables
31+
variable "create_vault_policies_for_group" {
32+
default = false
33+
description = "Creates policies to allow the user applying the stack to manage vault and keys. If you are on the Administrators group or already have the policies for a compartment, this policy is not needed. If you do not have access to allow the policy, ask your administrator to include it for you"
34+
}
35+
variable "user_admin_group_for_vault_policy" {
36+
default = "Administrators"
37+
description = "User Identity Group to allow manage vault and keys. The user running the Terraform scripts or Applying the ORM Stack need to be on this group"
38+
}
39+
## Create Dynamic Group and Policies
40+
variable "create_dynamic_group_for_nodes_in_compartment" {
41+
default = false
42+
description = "Creates dynamic group of Nodes in the compartment. Note: You need to have proper rights on the Tenancy. If you only have rights in a compartment, uncheck and ask you administrator to create the Dynamic Group for you"
43+
}
44+
variable "create_compartment_policies" {
45+
default = false
46+
description = "Creates policies for KMS that will reside on the compartment."
47+
}
48+
49+
# OCI Provider
50+
variable "tenancy_ocid" {}
51+
52+
# Deployment Tags
53+
locals {
54+
freeform_deployment_tags = {
55+
"DeploymentID" = "${var.app_details.app_deployment_id}",
56+
"AppName" = "${var.app_details.app_name}",
57+
"Environment" = "${var.app_details.app_deployment_environment}",
58+
"DeploymentType" = "${var.app_details.app_deployment_type}" }
59+
}

0 commit comments

Comments
 (0)