alexpires.me/a13labs.infra
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(terraform): update metallb version, refactor IAM policies, and enhance security

Browse Source
This commit is contained in:
Alexandre Pires
2025-05-11 20:58:05 +02:00
parent 19f599e502
commit 05d1624bdd
6 changed files with 53 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/roles/microk8s/defaults/main.yml
+1 -1
View File
@@ -6,7 +6,7 @@ microk8s_lb_provider: "metallb"
microk8s_lb_ips: "10.2.0.40-10.2.0.49"
microk8s_lb_http_port: 80
microk8s_lb_https_port: 443
microk8s_metallb_version: 0.14.5
microk8s_metallb_version: 0.14.9
# certificate manager
microk8s_issuer_email: webmaster@localhost.localdomain
terraform/aws-iac/config.tf
+20
View File
@@ -1,5 +1,25 @@
locals {
billing_alarm_limit = 20
billing_alarm_emails = "c.alexandre.pires@alexpires.me"
instance_ips = [
"${local.vps_1.ip}/32",
]
vps_1 = {
id = data.terraform_remote_state.contabo.outputs.instances[0].id
name = data.terraform_remote_state.contabo.outputs.instances[0].name
ip = data.terraform_remote_state.contabo.outputs.instances[0].ip_config[0].v4[0].ip
}
}
data "terraform_remote_state" "contabo" {
backend = "s3"
config = {
bucket = "a13labs.infra.eu"
key = "contabo.core.infra.tfstate"
region = "eu-west-1"
}
}
data "aws_caller_identity" "current" {}
terraform/aws-iac/kms.tf
-23
View File
@@ -81,26 +81,3 @@ resource "aws_iam_user_policy" "k8s_secrets_user_policy" {
policy = data.aws_iam_policy_document.k8s_secrets_user_policy.json
}
data "aws_caller_identity" "current" {}
locals {
instance_ips = [
"${local.vps_1.ip}/32",
]
vps_1 = {
id = data.terraform_remote_state.contabo.outputs.instances[0].id
name = data.terraform_remote_state.contabo.outputs.instances[0].name
ip = data.terraform_remote_state.contabo.outputs.instances[0].ip_config[0].v4[0].ip
}
}
data "terraform_remote_state" "contabo" {
backend = "s3"
config = {
bucket = "a13labs.infra.eu"
key = "contabo.core.infra.tfstate"
region = "eu-west-1"
}
}
terraform/k8sapps/buckets.tf
+12 -43
View File
@@ -71,48 +71,12 @@ resource "scaleway_object_bucket_policy" "backup" {
Resource = [
scaleway_object_bucket.backup.name,
"${scaleway_object_bucket.backup.name}/*",
]
},
]
})
}
resource "scaleway_object_bucket" "dovecot" {
name = "a13labs-dovecot-${random_string.bucket_suffix.result}"
project_id = var.scaleway_project_id
region = "fr-par"
}
resource "scaleway_object_bucket_policy" "dovecot" {
bucket = scaleway_object_bucket.dovecot.name
policy = jsonencode({
Version = "2023-04-17",
Id = "AllowAccess",
Statement = [
{
Effect = "Allow"
Action = [
"s3:*",
]
Principal = {
SCW = "user_id:${var.scaleway_user_id}"
}
Resource = [
scaleway_object_bucket.dovecot.name,
"${scaleway_object_bucket.dovecot.name}/*",
]
},
{
Effect = "Allow"
Action = [
"s3:*",
]
Principal = {
SCW = "application_id:${scaleway_iam_application.dovecot_app.id}"
}
Resource = [
scaleway_object_bucket.dovecot.name,
"${scaleway_object_bucket.dovecot.name}/*",
]
],
Condition = {
IpAddress = {
"aws:SourceIp" = local.instance_ips
}
},
},
]
})
@@ -154,7 +118,12 @@ resource "scaleway_object_bucket_policy" "sftpgo" {
Resource = [
scaleway_object_bucket.sftpgo.name,
"${scaleway_object_bucket.sftpgo.name}/*",
]
],
Condition = {
IpAddress = {
"aws:SourceIp" = local.instance_ips
}
},
},
]
})
terraform/k8sapps/config.tf
+20
View File
@@ -77,9 +77,29 @@ locals {
}
]
instance_ips = [
"${local.vps_1.ip}/32",
]
vps_1 = {
id = data.terraform_remote_state.contabo.outputs.instances[0].id
name = data.terraform_remote_state.contabo.outputs.instances[0].name
ip = data.terraform_remote_state.contabo.outputs.instances[0].ip_config[0].v4[0].ip
}
}
data "scaleway_account_project" "default" {
project_id = var.scaleway_project_id
organization_id = var.scaleway_organization_id
}
data "terraform_remote_state" "contabo" {
backend = "s3"
config = {
bucket = "a13labs.infra.eu"
key = "contabo.core.infra.tfstate"
region = "eu-west-1"
}
}
terraform/k8sapps/iam.tf
-26
View File
@@ -6,10 +6,6 @@ resource "scaleway_iam_application" "mail_app" {
name = "mail_app"
}
resource "scaleway_iam_application" "dovecot_app" {
name = "dovecot_app"
}
resource "scaleway_iam_application" "sftpgo_app" {
name = "sftpgo_app"
}
@@ -43,23 +39,6 @@ resource "scaleway_iam_policy" "email_full_access" {
}
}
resource "scaleway_iam_policy" "object_read_write_dovecot" {
name = "Dovecot app policy"
description = "Gives dovecot job access to object storage in project"
application_id = scaleway_iam_application.dovecot_app.id
rule {
project_ids = [data.scaleway_account_project.default.id]
permission_set_names = [
"ObjectStorageObjectsWrite",
"ObjectStorageObjectsRead",
"ObjectStorageBucketsRead",
"ObjectStorageBucketsWrite",
"ObjectStorageObjectsDelete"
]
}
}
resource "scaleway_iam_policy" "object_read_write_sftpgo" {
name = "SFtpGo app policy"
@@ -88,11 +67,6 @@ resource "scaleway_iam_api_key" "mail_app_api" {
description = "mail access API key"
}
resource "scaleway_iam_api_key" "dovecot_app_api" {
application_id = scaleway_iam_application.dovecot_app.id
description = "dovecot access API key"
}
resource "scaleway_iam_api_key" "sftpgo_app_api" {
application_id = scaleway_iam_application.sftpgo_app.id
description = "sftpgo access API key"