-
Notifications
You must be signed in to change notification settings - Fork 14
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #42 from philips-software/feature/pki
HSDP PKI support
- Loading branch information
Showing
17 changed files
with
931 additions
and
31 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,6 +4,7 @@ | |
| *.out | ||
| *.tf | ||
| *.exe | ||
| b.sh | ||
| .swp | ||
| .DS_Store | ||
| terraform-provider-hsdp | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| # hsdp_pki_policy | ||
| Retrieves the HSDP PKI Policy CA and CRL | ||
|
|
||
| # Example Usage | ||
|
|
||
| ```hcl | ||
| data "hsdp_pki_policy" "info" { | ||
| } | ||
| output "policy_ca" { | ||
| value = hsdp_pki_policy.info.ca_pem | ||
| } | ||
| ``` | ||
| # Argument reference | ||
| * `region` - (Optional) the HSDP PKI regional selection | ||
| * `environment` - (Optional) the HSDP PKI environment to use [`client_test` | `prod`] | ||
|
|
||
| # Attribute reference | ||
|
|
||
| * `ca_pem` - The root CA in PEM format | ||
| * `crl_pem` - The root CRL in PEM format |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| # hsdp_pki_root | ||
| Retrieves the HSDP PKI Root CA and CRL | ||
|
|
||
| # Example Usage | ||
|
|
||
| ```hcl | ||
| data "hsdp_pki_root" "info" { | ||
| } | ||
| output "root_ca" { | ||
| value = hsdp_pki_root.info.ca_pem | ||
| } | ||
| output "root_crl" { | ||
| value = hsdp_pki_root.info.crl_pem | ||
| } | ||
| ``` | ||
| # Argument reference | ||
| * `region` - (Optional) the HSDP PKI regional selection | ||
| * `environment` - (Optional) the HSDP PKI environment to use [`client_test` | `prod`] | ||
|
|
||
| # Attribute reference | ||
|
|
||
| * `ca_pem` - The root CA in PEM format | ||
| * `crl_pem` - The root CRL in PEM format |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| # hsdp_pki_cert | ||
| Create and manage HSDP PKI leaf certificates | ||
|
|
||
| ## Example usage | ||
|
|
||
| ```hcl | ||
| resource "hsdp_pki_cert" "cert" { | ||
| tenant_id = hsdp_pki_tenant.tenant.id | ||
| role = "ec384" | ||
| common_name = "myapp.com" | ||
| alt_name = "myapp.io" | ||
| ip_sans = [] | ||
| uri_sans = [] | ||
| other_sans = [] | ||
| ttl = "720h" | ||
| exclude_cn_from_sans = false | ||
| } | ||
| ``` | ||
|
|
||
| ## Argument reference | ||
| * `tenant_id` - (Required) The tenant ID to create this certificate under | ||
| * `role` - (Required) the Role to use as defined under a PKI Tenant resource | ||
| * `common_name` - (Required) The common name to use | ||
| * `alt_name` - (Optional) Alternative name to use | ||
| * `ip_sans` - (Optional, list(string)) A list of IP SANS to include | ||
| * `uri_sans` - (Optional, list(string)) A list of URI SANS to include | ||
| * `other_sans` - (Optional, list(string)) A list of other SANS to include | ||
| * `ttl` - (Optional, string regex `[0-9]+[hms]$`) The TTL, example `720h` for 1 month | ||
| * `exclude_cn_from_sans` - (Optional) Exclude common name from SAN | ||
|
|
||
| ## Attribute reference | ||
| * `cert_pem` - The certificate in PEM format | ||
| * `private_key_pem` - The private key in PEM format | ||
| * `issuing_ca_pem` - The issuing CA certicate in PEM format | ||
| * `serial_number` - The certificate serial number (equal to resource ID) | ||
| * `expiration` - (int) The Unix timestamp when the certificate will expire | ||
| * `ca_chain_pem` - The full CA chain in PEM format | ||
|
|
||
| ## Importing | ||
| Importing a HSDP PKI certificate is supported but not recommended as the private key will be missing, | ||
| rendering the resource more or less useless in most cases. You can import a certificate using the serial number |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| # hsdp_pki_tenant | ||
|
|
||
| Onboard tenant to PKI Service. Cloud foundry users with SpaceDeveloper role can onboard tenant | ||
|
|
||
| > This resource is only available when `uaa_*` (Cloud foundry) and `iam` credentials are set | ||
| ## Example usage | ||
|
|
||
| ```hcl | ||
| resource "hsdp_pki_tenant" "tenant" { | ||
| organization_name = "client-my-org" | ||
| space_name = "prod" | ||
| iam_orgs = [ | ||
| var.iam_org_id | ||
| ] | ||
| ca { | ||
| common_name = "Common Name Here" | ||
| } | ||
| role { | ||
| name = "ec384" | ||
| allow_any_name = true | ||
| allow_ip_sans = true | ||
| allow_subdomains = true | ||
| allowed_domains = [] | ||
| allowed_other_sans = [] | ||
| allowed_uri_sans = [] | ||
| client_flag = true | ||
| server_flag = true | ||
| enforce_hostnames = false | ||
| key_bits = 384 | ||
| key_type = "ec" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ## Argument reference | ||
| The following arguments are supported: | ||
|
|
||
| * `organization_name` - (Required) The CF organization name to use | ||
| * `space_name` - (Required) The CF space name to verify the user is part of | ||
| * `role` - (Required) A role definition. Muliple roles are supported | ||
| * `ca` - (Required) The Certificate Authority information to use. | ||
| * `common_name` - (Required) The common name to use | ||
|
|
||
| Each `role` definition takes the following arguments: | ||
| * `name` - (Required) The role name. This is used for lookup | ||
| * `key_type` - (Required) The key type. Values [`ec`, `rsa`] | ||
| * `key_bits` - (Required, int) Key length. Typically `384` for `ec` key types. | ||
| * `client_flags` - (Required, bool) Allow use on clients | ||
| * `server_flags` - (Required, bool) Allow use on servers | ||
| * `allow_any_name` - (Required, bool) Allow any name | ||
| * `allow_ip_sans` - (Required, bool) Allow IP Subject Alternative Names (SAN) | ||
| * `allow_subdomains` - (Required, bool) Allow subdomains to be created | ||
| * `allow_any_name` - (Required, bool) Allow any name to be used | ||
| * `allowed_domains` - (Optional, list(string)) List of allowed domains | ||
| * `allowed_other_sans` - (Optional, list(string)) List of allowed other SANs | ||
| * `allowed_uri_sans` - (Optional, list(string)) List of allowed URI SANs | ||
| * `enforce_hostnames` - (Optional, bool) Enforce hostnames. Default: `false` | ||
|
|
||
| ## Attribute reference | ||
| The following attributes are exported: | ||
|
|
||
| * `id` - The HSDP PKI `logical_path` of the tenant. The Terraform provider uses this as the Tenant ID | ||
| * `logical_path` - Same as `id`. This is for consistency. | ||
| * `private_key_pem` - The private key in PEM format |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.