From d0b0ba4cbb297dee1e7bce55dcbbd6e1d1f28279 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Diogo=20Ferr=C3=A3o?= Date: Tue, 26 Mar 2024 08:39:47 +0000 Subject: [PATCH] Create guide to document Vault usage with Secrets Manager (#310) * create guide * Address comments * remove frontmatter description and subsection * Move guide to template file for generation * update description and note --- docs/guides/vault_secrets_manager.md | 83 +++++++++++++++++++ .../guides/vault_secrets_manager.md.tmpl | 83 +++++++++++++++++++ 2 files changed, 166 insertions(+) create mode 100644 docs/guides/vault_secrets_manager.md create mode 100644 templates/guides/vault_secrets_manager.md.tmpl diff --git a/docs/guides/vault_secrets_manager.md b/docs/guides/vault_secrets_manager.md new file mode 100644 index 00000000..b290a374 --- /dev/null +++ b/docs/guides/vault_secrets_manager.md @@ -0,0 +1,83 @@ +--- +page_title: "Using Vault Provider with STACKIT Secrets Manager" +--- +# Using Vault Provider with STACKIT Secrets Manager + +### Overview + +This guide outlines the process of utilizing the HashiCorp Vault provider alongside the STACKIT provider to write secrets in the STACKIT Secrets Manager. The guide focuses on secrets from STACKIT Cloud resources but can be adapted for any secret. + +### Steps + +1. **Configure STACKIT Provider** + + ```hcl + provider "stackit" { + region = "eu01" + } + ``` + +2. **Create STACKIT Secrets Manager Instance** + + ```hcl + resource "stackit_secretsmanager_instance" "example" { + project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"" + name = "example-instance" + } + ``` + +3. **Define STACKIT Secrets Manager User** + + ```hcl + resource "stackit_secretsmanager_user" "example" { + project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" + instance_id = stackit_secretsmanager_instance.example.instance_id + description = "Example user" + write_enabled = true + } + ``` + +4. **Configure Vault Provider** + + ```hcl + provider "vault" { + address = "https://prod.sm.eu01.stackit.cloud" + skip_child_token = true + + auth_login_userpass { + username = stackit_secretsmanager_user.example.username + password = stackit_secretsmanager_user.example.password + } + } + ``` + +5. **Define Terraform Resource (Example: Argus Monitoring Instance)** + + ```hcl + resource "stackit_argus_instance" "example" { + project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" + name = "example-instance" + plan_name = "Monitoring-Medium-EU01" + } + ``` + +6. **Store Secret in Vault** + + ```hcl + resource "vault_kv_secret_v2" "example" { + mount = stackit_secretsmanager_instance.example.instance_id + name = "my-secret" + cas = 1 + delete_all_versions = true + data_json = jsonencode( + { + grafana_password = stackit_argus_instance.example.grafana_initial_admin_password, + other_secret = ..., + } + ) + } + ``` + +### Note + +This example can be adapted for various resources within the provider as well as any other Secret the user wants to set in the Secrets Manager instance. Adapting this examples means replacing the Argus Monitoring Grafana password with the appropriate value. \ No newline at end of file diff --git a/templates/guides/vault_secrets_manager.md.tmpl b/templates/guides/vault_secrets_manager.md.tmpl new file mode 100644 index 00000000..b290a374 --- /dev/null +++ b/templates/guides/vault_secrets_manager.md.tmpl @@ -0,0 +1,83 @@ +--- +page_title: "Using Vault Provider with STACKIT Secrets Manager" +--- +# Using Vault Provider with STACKIT Secrets Manager + +### Overview + +This guide outlines the process of utilizing the HashiCorp Vault provider alongside the STACKIT provider to write secrets in the STACKIT Secrets Manager. The guide focuses on secrets from STACKIT Cloud resources but can be adapted for any secret. + +### Steps + +1. **Configure STACKIT Provider** + + ```hcl + provider "stackit" { + region = "eu01" + } + ``` + +2. **Create STACKIT Secrets Manager Instance** + + ```hcl + resource "stackit_secretsmanager_instance" "example" { + project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"" + name = "example-instance" + } + ``` + +3. **Define STACKIT Secrets Manager User** + + ```hcl + resource "stackit_secretsmanager_user" "example" { + project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" + instance_id = stackit_secretsmanager_instance.example.instance_id + description = "Example user" + write_enabled = true + } + ``` + +4. **Configure Vault Provider** + + ```hcl + provider "vault" { + address = "https://prod.sm.eu01.stackit.cloud" + skip_child_token = true + + auth_login_userpass { + username = stackit_secretsmanager_user.example.username + password = stackit_secretsmanager_user.example.password + } + } + ``` + +5. **Define Terraform Resource (Example: Argus Monitoring Instance)** + + ```hcl + resource "stackit_argus_instance" "example" { + project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" + name = "example-instance" + plan_name = "Monitoring-Medium-EU01" + } + ``` + +6. **Store Secret in Vault** + + ```hcl + resource "vault_kv_secret_v2" "example" { + mount = stackit_secretsmanager_instance.example.instance_id + name = "my-secret" + cas = 1 + delete_all_versions = true + data_json = jsonencode( + { + grafana_password = stackit_argus_instance.example.grafana_initial_admin_password, + other_secret = ..., + } + ) + } + ``` + +### Note + +This example can be adapted for various resources within the provider as well as any other Secret the user wants to set in the Secrets Manager instance. Adapting this examples means replacing the Argus Monitoring Grafana password with the appropriate value. \ No newline at end of file