mirror of
https://github.com/kemko/nomad.git
synced 2026-01-07 10:55:42 +03:00
020fa6f8ba
Use HCP Consul and HCP Vault for the Consul and Vault clusters used in E2E testing. This has the following benefits: * Without the need to support mTLS bootstrapping for Consul and Vault, we can simplify the mTLS configuration by leaning on Terraform instead of janky bash shell scripting. * Vault bootstrapping is no longer required, so we can eliminate even more janky shell scripting * Our E2E exercises HCP, which is important to us as an organization * With the reduction in configurability, we can simplify the Terraform configuration and drop the complicated `provision.sh`/`provision.ps1` scripts we were using previously. We can template Nomad configuration files and upload them with the `file` provisioner. * Packer builds for Linux and Windows become much simpler. tl;dr way less janky shell scripting!
32 lines
712 B
HCL
32 lines
712 B
HCL
# tls_ca.tf defines the certificate authority we use for mTLS
|
|
|
|
resource "tls_private_key" "ca" {
|
|
algorithm = "ECDSA"
|
|
ecdsa_curve = "P384"
|
|
}
|
|
|
|
resource "tls_self_signed_cert" "ca" {
|
|
key_algorithm = "ECDSA"
|
|
private_key_pem = tls_private_key.ca.private_key_pem
|
|
|
|
subject {
|
|
common_name = "${local.random_name} Nomad E2E Cluster"
|
|
organization = local.random_name
|
|
}
|
|
|
|
validity_period_hours = 720
|
|
|
|
is_ca_certificate = true
|
|
allowed_uses = ["cert_signing"]
|
|
}
|
|
|
|
resource "local_file" "ca_key" {
|
|
filename = "keys/tls_ca.key"
|
|
content = tls_private_key.ca.private_key_pem
|
|
}
|
|
|
|
resource "local_file" "ca_cert" {
|
|
filename = "keys/tls_ca.crt"
|
|
content = tls_self_signed_cert.ca.cert_pem
|
|
}
|