fix: issue-1776 - adjustment to accommodate new users with the password reset issue (#554)

johndietz · web-flow · commit bb408f8b4a25 · 2023-08-29T15:54:00.000-05:00
* managing user endpoint lifecycle differently for password

* fix: accommodate brand new user circumstance with 1776 fix

* chore: dedupe from merge
diff --git a/aws-github/atlantis.yaml b/aws-github/atlantis.yaml
@@ -15,7 +15,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/aws-github/terraform/users/modules/user/main.tf b/aws-github/terraform/users/modules/user/main.tf
@@ -25,6 +25,7 @@ resource "random_password" "password" {
 }
 
 resource "vault_generic_endpoint" "user" {
+  depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition
   path                 = "auth/userpass/users/${var.username}"
   ignore_absent_fields = true
 
@@ -43,11 +44,13 @@ resource "vault_generic_endpoint" "user_password" {
     ignore_changes=[data_json]
   }
 
-  # note: this resource only manages the user's initial password and has a lifecycle policy to
-  # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above
+  # note: this resource includes the initial password and only gets applied once
+  # changes to the user should be managed by the vault_generic_endpoint named "user" above
   data_json = jsonencode(
     {
-      password  = var.initial_password != "" ? var.initial_password : random_password.password.result
+      password  = var.initial_password != "" ? var.initial_password : random_password.password.result,
+      policies  = var.acl_policies,
+      token_ttl = "1h"
     }
   )
 }
diff --git a/aws-gitlab/atlantis.yaml b/aws-gitlab/atlantis.yaml
@@ -15,7 +15,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/aws-gitlab/terraform/users/modules/user/main.tf b/aws-gitlab/terraform/users/modules/user/main.tf
@@ -34,6 +34,7 @@ resource "random_password" "password" {
 }
 
 resource "vault_generic_endpoint" "user" {
+  depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition
   path                 = "auth/userpass/users/${var.username}"
   ignore_absent_fields = true
 
@@ -52,11 +53,13 @@ resource "vault_generic_endpoint" "user_password" {
     ignore_changes=[data_json]
   }
 
-  # note: this resource only manages the user's initial password and has a lifecycle policy to
-  # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above
+  # note: this resource includes the initial password and only gets applied once
+  # changes to the user should be managed by the vault_generic_endpoint named "user" above
   data_json = jsonencode(
     {
-      password  = var.initial_password != "" ? var.initial_password : random_password.password.result
+      password  = var.initial_password != "" ? var.initial_password : random_password.password.result,
+      policies  = var.acl_policies,
+      token_ttl = "1h"
     }
   )
 }
diff --git a/civo-github/atlantis.yaml b/civo-github/atlantis.yaml
@@ -15,7 +15,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/civo-github/terraform/users/modules/user/github/main.tf b/civo-github/terraform/users/modules/user/github/main.tf
@@ -25,6 +25,7 @@ resource "random_password" "password" {
 }
 
 resource "vault_generic_endpoint" "user" {
+  depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition
   path                 = "auth/userpass/users/${var.username}"
   ignore_absent_fields = true
 
@@ -43,11 +44,13 @@ resource "vault_generic_endpoint" "user_password" {
     ignore_changes=[data_json]
   }
 
-  # note: this resource only manages the user's initial password and has a lifecycle policy to
-  # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above
+  # note: this resource includes the initial password and only gets applied once
+  # changes to the user should be managed by the vault_generic_endpoint named "user" above
   data_json = jsonencode(
     {
-      password  = var.initial_password != "" ? var.initial_password : random_password.password.result
+      password  = var.initial_password != "" ? var.initial_password : random_password.password.result,
+      policies  = var.acl_policies,
+      token_ttl = "1h"
     }
   )
 }
diff --git a/civo-gitlab/atlantis.yaml b/civo-gitlab/atlantis.yaml
@@ -15,7 +15,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/civo-gitlab/terraform/users/modules/user/main.tf b/civo-gitlab/terraform/users/modules/user/main.tf
@@ -34,6 +34,7 @@ resource "random_password" "password" {
 }
 
 resource "vault_generic_endpoint" "user" {
+  depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition
   path                 = "auth/userpass/users/${var.username}"
   ignore_absent_fields = true
 
@@ -52,11 +53,13 @@ resource "vault_generic_endpoint" "user_password" {
     ignore_changes=[data_json]
   }
 
-  # note: this resource only manages the user's initial password and has a lifecycle policy to
-  # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above
+  # note: this resource includes the initial password and only gets applied once
+  # changes to the user should be managed by the vault_generic_endpoint named "user" above
   data_json = jsonencode(
     {
-      password  = var.initial_password != "" ? var.initial_password : random_password.password.result
+      password  = var.initial_password != "" ? var.initial_password : random_password.password.result,
+      policies  = var.acl_policies,
+      token_ttl = "1h"
     }
   )
 }
diff --git a/digitalocean-github/atlantis.yaml b/digitalocean-github/atlantis.yaml
@@ -15,7 +15,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/digitalocean-github/terraform/users/modules/user/github/main.tf b/digitalocean-github/terraform/users/modules/user/github/main.tf
@@ -25,6 +25,7 @@ resource "random_password" "password" {
 }
 
 resource "vault_generic_endpoint" "user" {
+  depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition
   path                 = "auth/userpass/users/${var.username}"
   ignore_absent_fields = true
 
@@ -43,11 +44,13 @@ resource "vault_generic_endpoint" "user_password" {
     ignore_changes=[data_json]
   }
 
-  # note: this resource only manages the user's initial password and has a lifecycle policy to
-  # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above
+  # note: this resource includes the initial password and only gets applied once
+  # changes to the user should be managed by the vault_generic_endpoint named "user" above
   data_json = jsonencode(
     {
-      password  = var.initial_password != "" ? var.initial_password : random_password.password.result
+      password  = var.initial_password != "" ? var.initial_password : random_password.password.result,
+      policies  = var.acl_policies,
+      token_ttl = "1h"
     }
   )
 }
diff --git a/digitalocean-gitlab/atlantis.yaml b/digitalocean-gitlab/atlantis.yaml
@@ -15,7 +15,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/digitalocean-gitlab/terraform/users/modules/user/main.tf b/digitalocean-gitlab/terraform/users/modules/user/main.tf
@@ -34,6 +34,7 @@ resource "random_password" "password" {
 }
 
 resource "vault_generic_endpoint" "user" {
+  depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition
   path                 = "auth/userpass/users/${var.username}"
   ignore_absent_fields = true
 
@@ -52,11 +53,13 @@ resource "vault_generic_endpoint" "user_password" {
     ignore_changes=[data_json]
   }
 
-  # note: this resource only manages the user's initial password and has a lifecycle policy to
-  # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above
+  # note: this resource includes the initial password and only gets applied once
+  # changes to the user should be managed by the vault_generic_endpoint named "user" above
   data_json = jsonencode(
     {
-      password  = var.initial_password != "" ? var.initial_password : random_password.password.result
+      password  = var.initial_password != "" ? var.initial_password : random_password.password.result,
+      policies  = var.acl_policies,
+      token_ttl = "1h"
     }
   )
 }
diff --git a/gcp-github/atlantis.yaml b/gcp-github/atlantis.yaml
@@ -15,7 +15,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/gcp-github/terraform/users/modules/user/github/main.tf b/gcp-github/terraform/users/modules/user/github/main.tf
@@ -25,6 +25,7 @@ resource "random_password" "password" {
 }
 
 resource "vault_generic_endpoint" "user" {
+  depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition
   path                 = "auth/userpass/users/${var.username}"
   ignore_absent_fields = true
 
@@ -43,15 +44,19 @@ resource "vault_generic_endpoint" "user_password" {
     ignore_changes=[data_json]
   }
 
-  # note: this resource only manages the user's initial password and has a lifecycle policy to
-  # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above
+  # note: this resource includes the initial password and only gets applied once
+  # changes to the user should be managed by the vault_generic_endpoint named "user" above
   data_json = jsonencode(
     {
-      password  = var.initial_password != "" ? var.initial_password : random_password.password.result
+      password  = var.initial_password != "" ? var.initial_password : random_password.password.result,
+      policies  = var.acl_policies,
+      token_ttl = "1h"
     }
   )
 }
 
+
+
 resource "vault_generic_secret" "user" {
   path = "users/${var.username}"
 
diff --git a/gcp-gitlab/atlantis.yaml b/gcp-gitlab/atlantis.yaml
@@ -15,7 +15,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/gcp-gitlab/terraform/users/modules/user/main.tf b/gcp-gitlab/terraform/users/modules/user/main.tf
@@ -34,6 +34,7 @@ resource "random_password" "password" {
 }
 
 resource "vault_generic_endpoint" "user" {
+  depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition
   path                 = "auth/userpass/users/${var.username}"
   ignore_absent_fields = true
 
@@ -52,11 +53,13 @@ resource "vault_generic_endpoint" "user_password" {
     ignore_changes=[data_json]
   }
 
-  # note: this resource only manages the user's initial password and has a lifecycle policy to
-  # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above
+  # note: this resource includes the initial password and only gets applied once
+  # changes to the user should be managed by the vault_generic_endpoint named "user" above
   data_json = jsonencode(
     {
-      password  = var.initial_password != "" ? var.initial_password : random_password.password.result
+      password  = var.initial_password != "" ? var.initial_password : random_password.password.result,
+      policies  = var.acl_policies,
+      token_ttl = "1h"
     }
   )
 }
diff --git a/k3d-github/atlantis.yaml b/k3d-github/atlantis.yaml
@@ -10,7 +10,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/k3d-gitlab/atlantis.yaml b/k3d-gitlab/atlantis.yaml
@@ -10,7 +10,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/vultr-github/atlantis.yaml b/vultr-github/atlantis.yaml
@@ -15,7 +15,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/vultr-github/terraform/users/modules/user/github/main.tf b/vultr-github/terraform/users/modules/user/github/main.tf
@@ -25,6 +25,7 @@ resource "random_password" "password" {
 }
 
 resource "vault_generic_endpoint" "user" {
+  depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition
   path                 = "auth/userpass/users/${var.username}"
   ignore_absent_fields = true
 
@@ -43,11 +44,13 @@ resource "vault_generic_endpoint" "user_password" {
     ignore_changes=[data_json]
   }
 
-  # note: this resource only manages the user's initial password and has a lifecycle policy to
-  # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above
+  # note: this resource includes the initial password and only gets applied once
+  # changes to the user should be managed by the vault_generic_endpoint named "user" above
   data_json = jsonencode(
     {
-      password  = var.initial_password != "" ? var.initial_password : random_password.password.result
+      password  = var.initial_password != "" ? var.initial_password : random_password.password.result,
+      policies  = var.acl_policies,
+      token_ttl = "1h"
     }
   )
 }
diff --git a/vultr-gitlab/atlantis.yaml b/vultr-gitlab/atlantis.yaml
@@ -15,7 +15,7 @@ projects:
     terraform_version: 1.3.8
     autoplan:
       enabled: true
-      when_modified: ['**/*.tf', '*.tf*']
+      when_modified: ['**/*.tf', '**/modules/*.tf', '**/admins/*.tf', '**/developers/*.tf', '*.tf*']
   - dir: terraform/vault
     terraform_version: 1.3.8
     autoplan:
diff --git a/vultr-gitlab/terraform/users/modules/user/main.tf b/vultr-gitlab/terraform/users/modules/user/main.tf
@@ -34,6 +34,7 @@ resource "random_password" "password" {
 }
 
 resource "vault_generic_endpoint" "user" {
+  depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition
   path                 = "auth/userpass/users/${var.username}"
   ignore_absent_fields = true
 
@@ -52,11 +53,13 @@ resource "vault_generic_endpoint" "user_password" {
     ignore_changes=[data_json]
   }
 
-  # note: this resource only manages the user's initial password and has a lifecycle policy to
-  # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above
+  # note: this resource includes the initial password and only gets applied once
+  # changes to the user should be managed by the vault_generic_endpoint named "user" above
   data_json = jsonencode(
     {
-      password  = var.initial_password != "" ? var.initial_password : random_password.password.result
+      password  = var.initial_password != "" ? var.initial_password : random_password.password.result,
+      policies  = var.acl_policies,
+      token_ttl = "1h"
     }
   )
 }

Original file line number	Diff line number	Diff line change
`@@ -25,6 +25,7 @@ resource "random_password" "password" {`
`25`	`25`	`}`
`26`	`26`
`27`	`27`	`resource "vault_generic_endpoint" "user" {`
	`28`	`+ depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition`
`28`	`29`	`path = "auth/userpass/users/${var.username}"`
`29`	`30`	`ignore_absent_fields = true`
`30`	`31`
`@@ -43,11 +44,13 @@ resource "vault_generic_endpoint" "user_password" {`
`43`	`44`	`ignore_changes=[data_json]`
`44`	`45`	`}`
`45`	`46`
`46`		`- # note: this resource only manages the user's initial password and has a lifecycle policy to`
`47`		`- # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above`
	`47`	`+ # note: this resource includes the initial password and only gets applied once`
	`48`	`+ # changes to the user should be managed by the vault_generic_endpoint named "user" above`
`48`	`49`	`data_json = jsonencode(`
`49`	`50`	`{`
`50`		`- password = var.initial_password != "" ? var.initial_password : random_password.password.result`
	`51`	`+ password = var.initial_password != "" ? var.initial_password : random_password.password.result,`
	`52`	`+ policies = var.acl_policies,`
	`53`	`+ token_ttl = "1h"`
`51`	`54`	`}`
`52`	`55`	`)`
`53`	`56`	`}`
Original file line number	Diff line number	Diff line change
`@@ -34,6 +34,7 @@ resource "random_password" "password" {`
`34`	`34`	`}`
`35`	`35`
`36`	`36`	`resource "vault_generic_endpoint" "user" {`
	`37`	`+ depends_on = [ vault_generic_endpoint.user_password ] # avoids race condition`
`37`	`38`	`path = "auth/userpass/users/${var.username}"`
`38`	`39`	`ignore_absent_fields = true`
`39`	`40`
`@@ -52,11 +53,13 @@ resource "vault_generic_endpoint" "user_password" {`
`52`	`53`	`ignore_changes=[data_json]`
`53`	`54`	`}`
`54`	`55`
`55`		`- # note: this resource only manages the user's initial password and has a lifecycle policy to`
`56`		`- # ignore changes. to change other vault_generic_endpoint properties see the "user" resource above`
	`56`	`+ # note: this resource includes the initial password and only gets applied once`
	`57`	`+ # changes to the user should be managed by the vault_generic_endpoint named "user" above`
`57`	`58`	`data_json = jsonencode(`
`58`	`59`	`{`
`59`		`- password = var.initial_password != "" ? var.initial_password : random_password.password.result`
	`60`	`+ password = var.initial_password != "" ? var.initial_password : random_password.password.result,`
	`61`	`+ policies = var.acl_policies,`
	`62`	`+ token_ttl = "1h"`
`60`	`63`	`}`
`61`	`64`	`)`
`62`	`65`	`}`