Add ability to specify my own certificate for client connection, but let everything else be managed by module about terraform-google-vault HOT 6 CLOSED

It's actually quite easy to provide files (i.e TLS certificate and key) inside the virtual machine with cloud-init. Even easier than via google storage bucket.

from terraform-google-vault.

@Andor sorry for the slow response here. While it would be easy to specify a certificate outside of Vault with Terraform, that still leaves your private key in plaintext within the terraform state. That is the reason we'd like to specify those values encrypted in a GCS bucket instead. I hope this helps answer your question.

from terraform-google-vault.

@onetwopunch So we need to upload our own cert to gcs and restart vault instances every time it updates, right? Maybe this is a good idea for documentation update?

from terraform-google-vault.

I'm happy to review a PR to update the documentation to something that makes more sense. Currently changing TLS certs even in Terraform would require restarting Vault to pick up the changes.

from terraform-google-vault.

@Andor we've made some updates around TLS and added to the documentation. Can you please have a look here and see if this update satisfies your ask? https://github.com/terraform-google-modules/terraform-google-vault#managing-tls

from terraform-google-vault.

Closing this due to inactivity.

from terraform-google-vault.