Operations grimoire/Deploy with Terraform - Revision history

Yousra: /* CARP OVH secrets usage */

2026-03-29T18:27:37Z

CARP OVH secrets usage

← Older revision		Revision as of 18:27, 29 March 2026
Line 68:		Line 68:
	'''ops/secrets/network/router/vault'''		'''ops/secrets/network/router/vault'''

	Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt. ~~This done easily thanks~~ to ~~Linked~~ to ~~{{D\|4026}}~~.		Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

			The Vault Secrets may need to be rotated, so we need a simple way to propagate
			updated credentials to routers. This is enabled by the mechanism
			introduced in D4026.

	== Table of Terraform states ==		== Table of Terraform states ==

2026-03-29T15:11:03Z

CARP OVH secrets usage

← Older revision		Revision as of 15:11, 29 March 2026
Line 69:		Line 69:

	Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt. This done easily thanks to Linked to {{D\|4026}}.		Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt. This done easily thanks to Linked to {{D\|4026}}.



	~~When rotating the secrets OVH :~~

	* Terraform must be applied again to update the secrets in Vault

	~~Failing to do so may cause CARP failover to break due to invalid OVH credentials or expired Vault authentication.~~

	== Table of Terraform states ==		== Table of Terraform states ==

2026-03-29T15:04:21Z

CARP OVH secrets usage

← Older revision		Revision as of 15:04, 29 March 2026
Line 71:		Line 71:


	~~When rotating Vault secrets managed through Terraform:~~

	* Terraform must be applied again to update them in Vault
	* if Vault AppRole credentials are changed, they must also be propagated to the routers using Salt

	When rotating the secrets OVH :		When rotating the secrets OVH :

2026-03-29T15:02:37Z

CARP OVH secrets usage

← Older revision		Revision as of 15:02, 29 March 2026
Line 68:		Line 68:
	'''ops/secrets/network/router/vault'''		'''ops/secrets/network/router/vault'''

	Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt. This done thanks to Linked to {{D\|4026}}		Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt. This done easily thanks to Linked to {{D\|4026}}.

2026-03-29T15:01:12Z

CARP OVH secrets usage

← Older revision		Revision as of 15:01, 29 March 2026
Line 68:		Line 68:
	'''ops/secrets/network/router/vault'''		'''ops/secrets/network/router/vault'''

	Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.		Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt. This done thanks to Linked to {{D\|4026}}


			When rotating Vault secrets managed through Terraform:

			* Terraform must be applied again to update them in Vault
			* if Vault AppRole credentials are changed, they must also be propagated to the routers using Salt

	When rotating the secrets OVH :		When rotating the secrets OVH :

2026-03-29T14:34:51Z

CARP OVH secrets usage

← Older revision		Revision as of 14:34, 29 March 2026
Line 71:		Line 71:


	When rotating the secrets ~~Vault or~~ OVH :		When rotating the secrets OVH :

	* Terraform must be applied again to update the secrets in Vault		* Terraform must be applied again to update the secrets in Vault

2026-03-29T14:33:57Z

CARP OVH secrets usage

← Older revision		Revision as of 14:33, 29 March 2026
Line 70:		Line 70:
	Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.		Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

	When rotating the secrets:
			When rotating the secrets Vault or OVH :

	* Terraform must be applied again to update the secrets in Vault		* Terraform must be applied again to update the secrets in Vault

2026-03-29T14:33:11Z

CARP OVH secrets usage

← Older revision		Revision as of 14:33, 29 March 2026
Line 68:		Line 68:
	'''ops/secrets/network/router/vault'''		'''ops/secrets/network/router/vault'''

	~~Secrets~~ are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.		Vault secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

	When rotating the secrets:		When rotating the secrets:

2026-03-29T14:29:49Z

CARP OVH secrets usage

← Older revision		Revision as of 14:29, 29 March 2026
Line 67:		Line 67:

	'''ops/secrets/network/router/vault'''		'''ops/secrets/network/router/vault'''

	~~These are provisioned via Terraform and deployed to the routers using Salt.~~

	Secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.		Secrets are provisioned using Terraform (openbao module), and must be propagated to the routers using Salt.

	When rotating ~~these~~ secrets:		When rotating the secrets:

	* Terraform must be applied again to update the secrets in Vault		* Terraform must be applied again to update the secrets in Vault
	* Salt states must be re-applied to propagate updated AppRole credentials to the routers

	Failing to do so may cause CARP failover to break due to invalid OVH credentials or expired Vault authentication.		Failing to do so may cause CARP failover to break due to invalid OVH credentials or expired Vault authentication.

2026-03-29T14:24:27Z

CARP OVH secrets usage

← Older revision		Revision as of 14:24, 29 March 2026
Line 62:		Line 62:
	'''apps/network/carp-hyper-001-switch'''		'''apps/network/carp-hyper-001-switch'''

	These credentials are accessed by router-002 and router-003.		These credentials are accessed by router-002 and router-003. They are then used by a script triggered by devd to update the OVH failover IP MAC address depending on the CARP state (MASTER/BACKUP). The script authenticates to Vault using AppRole (via secretsmith) to retrieve them.
	The script authenticates to Vault using AppRole (via secretsmith) to retrieve them.

	~~They are then used by a script triggered by devd to update the OVH failover IP MAC address depending on the CARP state (MASTER/BACKUP).~~		The AppRole credentials (role_id and secret_id) used by the script are stored in:

	The AppRole credentials (role_id and secret_id) used by the ~~routers~~ are stored in:

	'''ops/secrets/network/router/vault'''		'''ops/secrets/network/router/vault'''