diff --git a/terraform/gcp/modules/sigstore/sigstore.tf b/terraform/gcp/modules/sigstore/sigstore.tf index 251198e6..78cee1cd 100644 --- a/terraform/gcp/modules/sigstore/sigstore.tf +++ b/terraform/gcp/modules/sigstore/sigstore.tf @@ -257,29 +257,6 @@ module "fulcio" { ] } -module "timestamp" { - source = "../timestamp" - - region = var.region - project_id = var.project_id - cluster_name = var.cluster_name - - // KMS - timestamp_keyring_name = var.timestamp_keyring_name - timestamp_encryption_key_name = var.timestamp_encryption_key_name - timestamp_intermediate_ca_key_name = var.timestamp_intermediate_ca_key_name - - dns_zone_name = var.dns_zone_name - dns_domain_name = var.dns_domain_name - load_balancer_ipv4 = module.network.external_ipv4_address - - depends_on = [ - module.gke-cluster, - module.network, - module.project_roles - ] -} - // Audit module "audit" { source = "../audit" diff --git a/terraform/gcp/modules/sigstore/variables.tf b/terraform/gcp/modules/sigstore/variables.tf index 18a1d4cc..8d046d90 100644 --- a/terraform/gcp/modules/sigstore/variables.tf +++ b/terraform/gcp/modules/sigstore/variables.tf @@ -226,24 +226,6 @@ variable "rekor_key_name" { default = "rekor-key" } -variable "timestamp_keyring_name" { - type = string - description = "Name of Timestamp Authority keyring." - default = "timestamp-keyring" -} - -variable "timestamp_encryption_key_name" { - type = string - description = "Name of KMS key for encrypting Tink private key for Timestamp Authority." - default = "timestamp-encryption-key" -} - -variable "timestamp_intermediate_ca_key_name" { - type = string - description = "Name of KMS key for intermediate CA for Timestamp Authority" - default = "timestamp-intermediate-ca-key" -} - variable "iam_members_to_roles" { description = "Map of IAM member (e.g. group:foo@sigstore.dev) to a set of IAM roles (e.g. roles/viewer)" type = map(set(string)) diff --git a/terraform/gcp/modules/timestamp/kms.tf b/terraform/gcp/modules/timestamp/kms.tf deleted file mode 100644 index f40ac44e..00000000 --- a/terraform/gcp/modules/timestamp/kms.tf +++ /dev/null @@ -1,63 +0,0 @@ -/** - * Copyright 2022 The Sigstore Authors - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// Enable required services for this module -resource "google_project_service" "service" { - for_each = toset([ - "dns.googleapis.com", // For configuring DNS records - "cloudkms.googleapis.com", // For KMS keyring and crypto key. roles/cloudkms.admin - ]) - project = var.project_id - service = each.key - - // Do not disable the service on destroy. On destroy, we are going to - // destroy the project, but we need the APIs available to destroy the - // underlying resources. - disable_on_destroy = false -} - -resource "google_kms_key_ring" "timestamp-keyring" { - name = var.timestamp_keyring_name - location = var.kms_location - project = var.project_id - depends_on = [google_project_service.service] -} - -resource "google_kms_crypto_key" "timestamp-encryption-key" { - name = var.timestamp_encryption_key_name - key_ring = google_kms_key_ring.timestamp-keyring.id - # purpose defaults to symmetric encryption/decryption - lifecycle { - prevent_destroy = true - } - - depends_on = [google_kms_key_ring.timestamp-keyring] -} - -resource "google_kms_crypto_key" "timestamp-intermediate-ca-key" { - name = var.timestamp_intermediate_ca_key_name - key_ring = google_kms_key_ring.timestamp-keyring.id - purpose = "ASYMMETRIC_SIGN" - version_template { - algorithm = "EC_SIGN_P384_SHA384" - protection_level = "SOFTWARE" - } - lifecycle { - prevent_destroy = true - } - - depends_on = [google_kms_key_ring.timestamp-keyring] -} \ No newline at end of file diff --git a/terraform/gcp/modules/timestamp/service_accounts.tf b/terraform/gcp/modules/timestamp/service_accounts.tf deleted file mode 100644 index 8953256a..00000000 --- a/terraform/gcp/modules/timestamp/service_accounts.tf +++ /dev/null @@ -1,51 +0,0 @@ -/** - * Copyright 2022 The Sigstore Authors - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -// Create the Timestamp Authority service account -resource "google_service_account" "timestamp-sa" { - account_id = format("%s-timestamp-sa", var.cluster_name) - display_name = "Timestamp Authority Service Account" - project = var.project_id -} - -resource "google_service_account_iam_member" "gke_sa_iam_member_timestamp" { - service_account_id = google_service_account.timestamp-sa.name - role = "roles/iam.workloadIdentityUser" - member = "serviceAccount:${var.project_id}.svc.id.goog[timestamp-system/timestamp-server]" - depends_on = [google_service_account.timestamp-sa] -} - -resource "google_project_iam_member" "timestamp_kms_signer_verifier_member" { - project = var.project_id - role = "roles/cloudkms.signerVerifier" - member = "serviceAccount:${google_service_account.timestamp-sa.email}" - depends_on = [google_service_account.timestamp-sa] -} - -// Decrypt encrypted Tink keyset to get signing key -resource "google_project_iam_member" "timestamp_kms_decrypter_member" { - project = var.project_id - role = "roles/cloudkms.cryptoKeyDecrypter" - member = "serviceAccount:${google_service_account.timestamp-sa.email}" - depends_on = [google_service_account.timestamp-sa] -} - -resource "google_project_iam_member" "timestamp_kms_viewer_member" { - project = var.project_id - role = "roles/cloudkms.viewer" - member = "serviceAccount:${google_service_account.timestamp-sa.email}" - depends_on = [google_service_account.timestamp-sa] -} \ No newline at end of file diff --git a/terraform/gcp/modules/timestamp/timestamp.tf b/terraform/gcp/modules/timestamp/timestamp.tf deleted file mode 100644 index 96787d26..00000000 --- a/terraform/gcp/modules/timestamp/timestamp.tf +++ /dev/null @@ -1,26 +0,0 @@ -/** - * Copyright 2022 The Sigstore Authors - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -resource "google_dns_record_set" "A_timestamp" { - name = "timestamp.${var.dns_domain_name}" - type = "A" - ttl = 60 - - project = var.project_id - managed_zone = var.dns_zone_name - - rrdatas = [var.load_balancer_ipv4] -} diff --git a/terraform/gcp/modules/timestamp/variables.tf b/terraform/gcp/modules/timestamp/variables.tf deleted file mode 100644 index d3055810..00000000 --- a/terraform/gcp/modules/timestamp/variables.tf +++ /dev/null @@ -1,74 +0,0 @@ -/** - * Copyright 2022 The Sigstore Authors - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -variable "project_id" { - type = string - default = "" - validation { - condition = length(var.project_id) > 0 - error_message = "Must specify project_id variable." - } -} - -variable "region" { - type = string - description = "GCP region" -} - -variable "cluster_name" { - description = "The name to give the new Kubernetes cluster." - type = string -} - -// KMS -variable "timestamp_keyring_name" { - type = string - description = "Name of KMS keyring for Timestamp Authority" - default = "timestamp-keyring" -} - -variable "timestamp_encryption_key_name" { - type = string - description = "Name of KMS key for encrypting Tink private key for Timestamp Authority" - default = "timestamp-encryption-key" -} - -variable "timestamp_intermediate_ca_key_name" { - type = string - description = "Name of KMS key for intermediate CA for Timestamp Authority" - default = "timestamp-intermediate-ca-key" -} - -variable "kms_location" { - type = string - description = "Location of KMS keyring" - default = "global" -} - -variable "dns_zone_name" { - description = "Name of DNS Zone object in Google Cloud DNS" - type = string -} - -variable "dns_domain_name" { - description = "Name of DNS domain name in Google Cloud DNS" - type = string -} - -variable "load_balancer_ipv4" { - description = "IPv4 adddress of external load balancer" - type = string -} diff --git a/terraform/gcp/modules/timestamp/versions.tf b/terraform/gcp/modules/timestamp/versions.tf deleted file mode 100644 index 4076acd5..00000000 --- a/terraform/gcp/modules/timestamp/versions.tf +++ /dev/null @@ -1,34 +0,0 @@ -/** - * Copyright 2022 The Sigstore Authors - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -terraform { - required_version = ">= 1.1.3, < 1.4.0" - - required_providers { - google = { - version = ">= 4.11.0, < 4.38.0" - source = "hashicorp/google" - } - google-beta = { - version = ">= 4.11.0, < 4.26.0" - source = "hashicorp/google-beta" - } - random = { - version = ">= 3.1.0, < 3.2.0" - source = "hashicorp/random" - } - } -}