From 05d1624bddee0c20e127da4ebdb6a0ee3f1885bb Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sun, 11 May 2025 20:58:05 +0200 Subject: [PATCH] feat(terraform): update metallb version, refactor IAM policies, and enhance security --- ansible/roles/microk8s/defaults/main.yml | 2 +- terraform/aws-iac/config.tf | 20 +++++++++ terraform/aws-iac/kms.tf | 23 ---------- terraform/k8sapps/buckets.tf | 55 ++++++------------------ terraform/k8sapps/config.tf | 20 +++++++++ terraform/k8sapps/iam.tf | 26 ----------- 6 files changed, 53 insertions(+), 93 deletions(-) diff --git a/ansible/roles/microk8s/defaults/main.yml b/ansible/roles/microk8s/defaults/main.yml index 884d7c2..1b1571e 100644 --- a/ansible/roles/microk8s/defaults/main.yml +++ b/ansible/roles/microk8s/defaults/main.yml @@ -6,7 +6,7 @@ microk8s_lb_provider: "metallb" microk8s_lb_ips: "10.2.0.40-10.2.0.49" microk8s_lb_http_port: 80 microk8s_lb_https_port: 443 -microk8s_metallb_version: 0.14.5 +microk8s_metallb_version: 0.14.9 # certificate manager microk8s_issuer_email: webmaster@localhost.localdomain diff --git a/terraform/aws-iac/config.tf b/terraform/aws-iac/config.tf index 8fa2a46..2c8cd75 100644 --- a/terraform/aws-iac/config.tf +++ b/terraform/aws-iac/config.tf @@ -1,5 +1,25 @@ locals { billing_alarm_limit = 20 billing_alarm_emails = "c.alexandre.pires@alexpires.me" + instance_ips = [ + "${local.vps_1.ip}/32", + ] + + vps_1 = { + id = data.terraform_remote_state.contabo.outputs.instances[0].id + name = data.terraform_remote_state.contabo.outputs.instances[0].name + ip = data.terraform_remote_state.contabo.outputs.instances[0].ip_config[0].v4[0].ip + } } +data "terraform_remote_state" "contabo" { + backend = "s3" + config = { + bucket = "a13labs.infra.eu" + key = "contabo.core.infra.tfstate" + region = "eu-west-1" + } +} + +data "aws_caller_identity" "current" {} + diff --git a/terraform/aws-iac/kms.tf b/terraform/aws-iac/kms.tf index 4a3cf6c..ffb1810 100644 --- a/terraform/aws-iac/kms.tf +++ b/terraform/aws-iac/kms.tf @@ -81,26 +81,3 @@ resource "aws_iam_user_policy" "k8s_secrets_user_policy" { policy = data.aws_iam_policy_document.k8s_secrets_user_policy.json } -data "aws_caller_identity" "current" {} - -locals { - instance_ips = [ - "${local.vps_1.ip}/32", - ] - - vps_1 = { - id = data.terraform_remote_state.contabo.outputs.instances[0].id - name = data.terraform_remote_state.contabo.outputs.instances[0].name - ip = data.terraform_remote_state.contabo.outputs.instances[0].ip_config[0].v4[0].ip - } -} - -data "terraform_remote_state" "contabo" { - backend = "s3" - config = { - bucket = "a13labs.infra.eu" - key = "contabo.core.infra.tfstate" - region = "eu-west-1" - } -} - diff --git a/terraform/k8sapps/buckets.tf b/terraform/k8sapps/buckets.tf index 2d1fc47..88a350e 100644 --- a/terraform/k8sapps/buckets.tf +++ b/terraform/k8sapps/buckets.tf @@ -71,48 +71,12 @@ resource "scaleway_object_bucket_policy" "backup" { Resource = [ scaleway_object_bucket.backup.name, "${scaleway_object_bucket.backup.name}/*", - ] - }, - ] - }) -} -resource "scaleway_object_bucket" "dovecot" { - name = "a13labs-dovecot-${random_string.bucket_suffix.result}" - project_id = var.scaleway_project_id - region = "fr-par" -} - -resource "scaleway_object_bucket_policy" "dovecot" { - bucket = scaleway_object_bucket.dovecot.name - policy = jsonencode({ - Version = "2023-04-17", - Id = "AllowAccess", - Statement = [ - { - Effect = "Allow" - Action = [ - "s3:*", - ] - Principal = { - SCW = "user_id:${var.scaleway_user_id}" - } - Resource = [ - scaleway_object_bucket.dovecot.name, - "${scaleway_object_bucket.dovecot.name}/*", - ] - }, - { - Effect = "Allow" - Action = [ - "s3:*", - ] - Principal = { - SCW = "application_id:${scaleway_iam_application.dovecot_app.id}" - } - Resource = [ - scaleway_object_bucket.dovecot.name, - "${scaleway_object_bucket.dovecot.name}/*", - ] + ], + Condition = { + IpAddress = { + "aws:SourceIp" = local.instance_ips + } + }, }, ] }) @@ -154,7 +118,12 @@ resource "scaleway_object_bucket_policy" "sftpgo" { Resource = [ scaleway_object_bucket.sftpgo.name, "${scaleway_object_bucket.sftpgo.name}/*", - ] + ], + Condition = { + IpAddress = { + "aws:SourceIp" = local.instance_ips + } + }, }, ] }) diff --git a/terraform/k8sapps/config.tf b/terraform/k8sapps/config.tf index a70c667..794b49e 100644 --- a/terraform/k8sapps/config.tf +++ b/terraform/k8sapps/config.tf @@ -77,9 +77,29 @@ locals { } ] + instance_ips = [ + "${local.vps_1.ip}/32", + ] + + vps_1 = { + id = data.terraform_remote_state.contabo.outputs.instances[0].id + name = data.terraform_remote_state.contabo.outputs.instances[0].name + ip = data.terraform_remote_state.contabo.outputs.instances[0].ip_config[0].v4[0].ip + } + } data "scaleway_account_project" "default" { project_id = var.scaleway_project_id organization_id = var.scaleway_organization_id } + +data "terraform_remote_state" "contabo" { + backend = "s3" + config = { + bucket = "a13labs.infra.eu" + key = "contabo.core.infra.tfstate" + region = "eu-west-1" + } +} + diff --git a/terraform/k8sapps/iam.tf b/terraform/k8sapps/iam.tf index e44ff3d..4529a99 100644 --- a/terraform/k8sapps/iam.tf +++ b/terraform/k8sapps/iam.tf @@ -6,10 +6,6 @@ resource "scaleway_iam_application" "mail_app" { name = "mail_app" } -resource "scaleway_iam_application" "dovecot_app" { - name = "dovecot_app" -} - resource "scaleway_iam_application" "sftpgo_app" { name = "sftpgo_app" } @@ -43,23 +39,6 @@ resource "scaleway_iam_policy" "email_full_access" { } } -resource "scaleway_iam_policy" "object_read_write_dovecot" { - name = "Dovecot app policy" - description = "Gives dovecot job access to object storage in project" - application_id = scaleway_iam_application.dovecot_app.id - - rule { - project_ids = [data.scaleway_account_project.default.id] - permission_set_names = [ - "ObjectStorageObjectsWrite", - "ObjectStorageObjectsRead", - "ObjectStorageBucketsRead", - "ObjectStorageBucketsWrite", - "ObjectStorageObjectsDelete" - ] - } -} - resource "scaleway_iam_policy" "object_read_write_sftpgo" { name = "SFtpGo app policy" @@ -88,11 +67,6 @@ resource "scaleway_iam_api_key" "mail_app_api" { description = "mail access API key" } -resource "scaleway_iam_api_key" "dovecot_app_api" { - application_id = scaleway_iam_application.dovecot_app.id - description = "dovecot access API key" -} - resource "scaleway_iam_api_key" "sftpgo_app_api" { application_id = scaleway_iam_application.sftpgo_app.id description = "sftpgo access API key"