Skip to content
Snippets Groups Projects
Commit eed1456d authored by František Dvořák's avatar František Dvořák
Browse files

Move generating of the secrets to terraform

parent 48f5014e
No related branches found
No related tags found
No related merge requests found
Pipeline #557 passed
......@@ -135,8 +135,12 @@ resource "openstack_compute_volume_attach_v2" "volume-attach" {
volume_id = openstack_blockstorage_volume_v3.volume[count.index].id
}
variable "secrets" {
type = map(string)
resource "random_password" "secrets" {
count = 3
length = "36"
keepers = {
masterid = openstack_compute_instance_v2.server[0].id
}
}
output "config" {
......@@ -147,7 +151,11 @@ output "config" {
master_hostname = var.master_hostname,
node_hostname = var.node_hostname,
type = var.type,
secrets = var.secrets,
secrets = {
http_signature_secret = random_password.secrets[0].result,
kerberos_admin_password = random_password.secrets[1].result,
kerberos_master_password = random_password.secrets[2].result,
},
volumes = var.volumes,
}
sensitive = true
......
......@@ -2,18 +2,6 @@
TERRAFORM="`PATH=$PATH:. which terraform`"
if [ ! -s ./secrets.auto.tfvars ]; then
touch ./secrets.auto.tfvars
chmod 0600 ./secrets.auto.tfvars
{
echo 'secrets = {'
for k in kerberos_master_password kerberos_admin_password http_signature_secret; do
echo " $k = \"`dd if=/dev/random bs=27 count=1 2>/dev/null | base64 -`\""
done
echo "}"
} >> ./secrets.auto.tfvars
fi
$TERRAFORM init >/dev/null
$TERRAFORM apply -auto-approve "$@"
......
secrets = {
kerberos_master_password = "SECRET"
kerberos_admin_password = "SECRET"
http_signature_secret = "SECRET"
}
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment