3668b94644
+++ dbaas/README.md +++ dbaas/ovh/credentials.tf +++ dbaas/ovh/main.tf +++ dbaas/ovh/outputs.tf +++ dbaas/ovh/variables.tf +++ dbaas/ovh/versions.tf
29 lines
1.6 KiB
HCL
29 lines
1.6 KiB
HCL
// The consumer credential is generated by OVHcloud (server side password)
|
|
// and delivered only through Vault, never through outputs or the user body.
|
|
// The Vault entry follows the existing contract:
|
|
// secret/{provider}/{cloud_account}/{requester_unique_id}/{username}
|
|
// Only the Vault path of the entry is exposed as an output. There is no
|
|
// admin sibling entry: day 2 credential renewal follows the same Terraform
|
|
// rotation flow as the other catalog modules (the renewal workflow rewrites
|
|
// a rotation marker next to the deployment script and the apply regenerates
|
|
// the password, republishing this entry); the rotation marker input is
|
|
// added by the credential renewal ticket.
|
|
|
|
locals {
|
|
database_host = one([for e in ovh_cloud_project_database.this.endpoints : e.domain if e.component == "postgresql"])
|
|
database_port = one([for e in ovh_cloud_project_database.this.endpoints : e.port if e.component == "postgresql"])
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "consumer" {
|
|
mount = "secret"
|
|
name = "ovh/${var.cloud_account}/${var.requester_unique_id}/${var.username}"
|
|
data_json = jsonencode({
|
|
username = ovh_cloud_project_database_postgresql_user.this.name
|
|
password = ovh_cloud_project_database_postgresql_user.this.password
|
|
host = local.database_host
|
|
port = local.database_port
|
|
database = ovh_cloud_project_database_database.this.name
|
|
uri = "postgres://${ovh_cloud_project_database_postgresql_user.this.name}:${ovh_cloud_project_database_postgresql_user.this.password}@${local.database_host}:${local.database_port}/${ovh_cloud_project_database_database.this.name}?sslmode=require"
|
|
})
|
|
}
|