Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added expire_time option to the secret-manager module #2373

Merged
merged 3 commits into from
Jun 23, 2024
Merged

Added expire_time option to the secret-manager module #2373

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
856ec68
Added expire_time option to the secret module
deanosaurx Jun 23, 2024
a4adb73
Ran tfdoc to update the readme file
deanosaurx Jun 23, 2024
dd6cdcd
Fixed a failed test, moved the expire_time variable to the top and ra…
deanosaurx Jun 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions modules/secret-manager/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,11 +110,12 @@ module "secret-manager" {

| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [project_id](variables.tf#L29) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
| [iam](variables.tf#L17) | IAM bindings in {SECRET => {ROLE => [MEMBERS]}} format. | <code>map&#40;map&#40;list&#40;string&#41;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [labels](variables.tf#L23) | Optional labels for each secret. | <code>map&#40;map&#40;string&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [secrets](variables.tf#L34) | Map of secrets to manage, their locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set. | <code title="map&#40;object&#40;&#123;&#10; locations &#61; optional&#40;list&#40;string&#41;, null&#41;&#10; keys &#61; optional&#40;map&#40;string&#41;, null&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [versions](variables.tf#L43) | Optional versions to manage for each secret. Version names are only used internally to track individual versions. | <code title="map&#40;map&#40;object&#40;&#123;&#10; enabled &#61; bool&#10; data &#61; string&#10;&#125;&#41;&#41;&#41;">map&#40;map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [project_id](variables.tf#L34) | Project id where the keyring will be created. | <code>string</code> | ✓ | |
| [expire_time](variables.tf#L16) | Timestamp in UTC when the Secret is scheduled to expire. | <code>string</code> | | <code>null</code> |
| [iam](variables.tf#L22) | IAM bindings in {SECRET => {ROLE => [MEMBERS]}} format. | <code>map&#40;map&#40;list&#40;string&#41;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [labels](variables.tf#L28) | Optional labels for each secret. | <code>map&#40;map&#40;string&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [secrets](variables.tf#L39) | Map of secrets to manage, their locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set. | <code title="map&#40;object&#40;&#123;&#10; locations &#61; optional&#40;list&#40;string&#41;, null&#41;&#10; keys &#61; optional&#40;map&#40;string&#41;, null&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> | | <code>&#123;&#125;</code> |
| [versions](variables.tf#L48) | Optional versions to manage for each secret. Version names are only used internally to track individual versions. | <code title="map&#40;map&#40;object&#40;&#123;&#10; enabled &#61; bool&#10; data &#61; string&#10;&#125;&#41;&#41;&#41;">map&#40;map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;&#41;</code> | | <code>&#123;&#125;</code> |

## Outputs

Expand Down
12 changes: 7 additions & 5 deletions modules/secret-manager/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,13 +33,15 @@ locals {
version_keypairs = {
for pair in local.version_pairs : "${pair.secret}:${pair.name}" => pair
}
expire_time = var.expire_time != null ? var.expire_time : ""
}

resource "google_secret_manager_secret" "default" {
for_each = var.secrets
project = var.project_id
secret_id = each.key
labels = lookup(var.labels, each.key, null)
for_each = var.secrets
project = var.project_id
secret_id = each.key
labels = lookup(var.labels, each.key, null)
expire_time = local.expire_time != "" ? local.expire_time : null

dynamic "replication" {
for_each = each.value.locations == null ? [""] : []
Expand Down Expand Up @@ -93,4 +95,4 @@ resource "google_secret_manager_secret_iam_binding" "default" {
role = each.value.role
secret_id = google_secret_manager_secret.default[each.value.secret].id
members = each.value.members
}
}
7 changes: 6 additions & 1 deletion modules/secret-manager/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,11 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
variable "expire_time" {
description = "Timestamp in UTC when the Secret is scheduled to expire."
type = string
default = null
}

variable "iam" {
description = "IAM bindings in {SECRET => {ROLE => [MEMBERS]}} format."
Expand Down Expand Up @@ -47,4 +52,4 @@ variable "versions" {
data = string
})))
default = {}
}
}