mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-24 16:11:08 +02:00
27ab988205
Add `config_mode` variant to some scenarios so we can dynamically change how we primarily configure the Vault cluster, either by a configuration file or with environment variables. As part of this change we also: * Start consuming the Enos terraform provider from public Terraform registry. * Remove the old `seal_ha_beta` variant as it is no longer required. * Add a module that performs a `vault operator step-down` so that we can force leader elections in scenarios. * Wire up an operator step-down into some scenarios to test both the old and new multiseal code paths during leader elections. Signed-off-by: Ryan Cragun <me@ryan.ec>
82 lines
1.7 KiB
HCL
82 lines
1.7 KiB
HCL
# Copyright (c) HashiCorp, Inc.
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
terraform {
|
|
required_providers {
|
|
enos = {
|
|
source = "registry.terraform.io/hashicorp-forge/enos"
|
|
version = ">= 0.4.9"
|
|
}
|
|
}
|
|
}
|
|
|
|
variable "hosts" {
|
|
type = map(object({
|
|
private_ip = string
|
|
public_ip = string
|
|
}))
|
|
description = "The hosts for whom default softhsm configuration will be applied"
|
|
}
|
|
|
|
variable "skip" {
|
|
type = bool
|
|
default = false
|
|
description = "Whether or not to skip initializing softhsm"
|
|
}
|
|
|
|
locals {
|
|
// The location on disk to write the softhsm tokens to
|
|
token_dir = "/var/lib/softhsm/tokens"
|
|
|
|
// Where the default configuration is
|
|
config_paths = {
|
|
"rhel" = "/etc/softhsm2.conf"
|
|
"ubuntu" = "/etc/softhsm/softhsm2.conf"
|
|
}
|
|
|
|
host_key = element(keys(enos_host_info.hosts), 0)
|
|
config_path = local.config_paths[enos_host_info.hosts[local.host_key].distro]
|
|
}
|
|
|
|
resource "enos_host_info" "hosts" {
|
|
for_each = var.hosts
|
|
|
|
transport = {
|
|
ssh = {
|
|
host = each.value.public_ip
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "enos_remote_exec" "init_softhsm" {
|
|
for_each = var.hosts
|
|
depends_on = [enos_host_info.hosts]
|
|
|
|
environment = {
|
|
CONFIG_PATH = local.config_paths[enos_host_info.hosts[each.key].distro]
|
|
TOKEN_DIR = local.token_dir
|
|
SKIP = var.skip ? "true" : "false"
|
|
}
|
|
|
|
scripts = [abspath("${path.module}/scripts/init-softhsm.sh")]
|
|
|
|
transport = {
|
|
ssh = {
|
|
host = each.value.public_ip
|
|
}
|
|
}
|
|
}
|
|
|
|
output "config_path" {
|
|
// Technically this is actually just the first config path of our hosts.
|
|
value = local.config_path
|
|
}
|
|
|
|
output "token_dir" {
|
|
value = local.token_dir
|
|
}
|
|
|
|
output "skipped" {
|
|
value = var.skip
|
|
}
|