Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: added dynamic_keyvault_certificates to caf_solution #449

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions caf_solution/dynamic_certificates.tf
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do you add the module "dynamic_keyvault_certificates" in the caf solution?

I would assume it can be be handled in the aztfmod module directly.

The only reason we put the dynamic_keyvault_secrets into caf_solution is to prevent circular references and to be able to include in a secret value any output attribute of the aztfmod module. Looks like it is not required for the certificates.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@LaurentLesle I was just following the pattern. If not here, can you identify the location within the modules where this should be implemented, please.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason dynamic secrets was done that way was to have the option to inject as a keyvault secret's value any output object's attribute from the aztfmod module. Based on my deeper review of your PR is looks like it is only the outcome of the self_signed cert that you may want to add as a certificate value. In that case it can be handled within the module and terraform will deal with the dependencies.

image

Either you propose an update or I can submit a PR and share it with you for review

Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
module "dynamic_keyvault_certificates" {
# source = "aztfmod/caf/azurerm//modules/security/dynamic_keyvault_certificates"
# version = "5.6.5"

source = "git::https://github.com/aztfmod/terraform-azurerm-caf.git//modules/security/dynamic_keyvault_certificates?ref=main"

for_each = {
for keyvault_key, certificates in try(var.dynamic_keyvault_certificates, {}) : keyvault_key => {
for key, value in certificates : key => value
if try(value.value, null) == null
}
}

settings = each.value
keyvault = module.solution.keyvaults[each.key]
objects = module.solution
}
1 change: 1 addition & 0 deletions caf_solution/local.security.tf
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ locals {
var.security,
{
disk_encryption_sets = var.disk_encryption_sets
dynamic_keyvault_certificates = var.dynamic_keyvault_certificates
dynamic_keyvault_secrets = var.dynamic_keyvault_secrets
keyvault_certificate_issuers = var.keyvault_certificate_issuers
keyvault_certificate_requests = var.keyvault_certificate_requests
Expand Down
5 changes: 4 additions & 1 deletion caf_solution/variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -204,10 +204,13 @@ variable "role_mapping" {
}
}

variable "dynamic_keyvault_secrets" {
variable "dynamic_keyvault_certificates" {
default = {}
}

variable "dynamic_keyvault_secrets" {
default = {}
}

variable "diagnostic_storage_accounts" {
default = {}
Expand Down