zecfoundation
/
cloud-foundation-fabric
mirror of https://github.com/ZcashFoundation/cloud-foundation-fabric.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added expire_time option to the secret-manager module (#2373) 

* Added expire_time option to the secret module

* Ran tfdoc to update the readme file

* Fixed a failed test, moved the expire_time variable to the top and ran tfdoc again
This commit is contained in:
Dean Sorie 2024-06-23 18:20:10 +03:00 committed by GitHub
parent 0bb75f3ae1
commit 270f61a75a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 19 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
modules/secret-manager/README.md
View File

@ -110,11 +110,12 @@ module "secret-manager" {
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [project_id](variables.tf#L29) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
| [iam](variables.tf#L17) | IAM bindings in {SECRET => {ROLE => [MEMBERS]}} format. | <code>map&#40;map&#40;list&#40;string&#41;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [labels](variables.tf#L23) | Optional labels for each secret. | <code>map&#40;map&#40;string&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [secrets](variables.tf#L34) | Map of secrets to manage, their locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set. | <code title="map&#40;object&#40;&#123;&#10; locations &#61; optional&#40;list&#40;string&#41;, null&#41;&#10; keys &#61; optional&#40;map&#40;string&#41;, null&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [versions](variables.tf#L43) | Optional versions to manage for each secret. Version names are only used internally to track individual versions. | <code title="map&#40;map&#40;object&#40;&#123;&#10; enabled &#61; bool&#10; data &#61; string&#10;&#125;&#41;&#41;&#41;">map&#40;map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [project_id](variables.tf#L34) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
| [expire_time](variables.tf#L16) | Timestamp in UTC when the Secret is scheduled to expire. | <code>string</code> | | <code>null</code> |
| [iam](variables.tf#L22) | IAM bindings in {SECRET => {ROLE => [MEMBERS]}} format. | <code>map&#40;map&#40;list&#40;string&#41;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [labels](variables.tf#L28) | Optional labels for each secret. | <code>map&#40;map&#40;string&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [secrets](variables.tf#L39) | Map of secrets to manage, their locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set. | <code title="map&#40;object&#40;&#123;&#10; locations &#61; optional&#40;list&#40;string&#41;, null&#41;&#10; keys &#61; optional&#40;map&#40;string&#41;, null&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [versions](variables.tf#L48) | Optional versions to manage for each secret. Version names are only used internally to track individual versions. | <code title="map&#40;map&#40;object&#40;&#123;&#10; enabled &#61; bool&#10; data &#61; string&#10;&#125;&#41;&#41;&#41;">map&#40;map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
## Outputs

2
modules/secret-manager/main.tf
View File

@ -33,6 +33,7 @@ locals {
version_keypairs = {
for pair in local.version_pairs : "${pair.secret}:${pair.name}" => pair
}
expire_time = var.expire_time != null ? var.expire_time : ""
}
resource "google_secret_manager_secret" "default" {
@ -40,6 +41,7 @@ resource "google_secret_manager_secret" "default" {
project = var.project_id
secret_id = each.key
labels = lookup(var.labels, each.key, null)
expire_time = local.expire_time != "" ? local.expire_time : null
dynamic "replication" {
for_each = each.value.locations == null ? [""] : []

5
modules/secret-manager/variables.tf
View File

@ -13,6 +13,11 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
variable "expire_time" {
description = "Timestamp in UTC when the Secret is scheduled to expire."
type = string
default = null
}
variable "iam" {
description = "IAM bindings in {SECRET => {ROLE => [MEMBERS]}} format."