hashicorp / terraform-google-vault

A Terraform Module for how to run Vault on Google Cloud using Terraform and Packer
Apache License 2.0
113 stars 75 forks source link

Remove nginx dependency #16

Closed madmod closed 6 years ago

madmod commented 6 years ago

This PR fixes issue #9 by implementing a Google Load Balancer HTTPS health check. Because this requires removal of the concept of a web proxy from the modules It contains several breaking changes, listed below. I think these breaking changes are justified by the significant increase in complexity required to continue supporting the old pattern, and the improved security posture from removing the dependency. Because the public interfaces to the modules are backwards incompatible I recommend that any release of this PR be a major release. (Eg. v1.0.0)

Anyone using these modules in production should be locked to the earlier versions as is explained in the README so these changes are reasonably safe IMO.

This PR also fixes several typos and other minor issues, including using HTTPS for module sources instead of SSH. This allows use of the modules in an environment which does not have GitHub SSH credentials in place.

I am currently unable to test this myself (Though I have validated all of it.) so it would be great if someone could take on that task. In particular it is necessary to test what impact this PR has on the examples when a previous version of the stack is already deployed. (Does it destroy any resources unnecessarily?)

josh-padnick commented 6 years ago

In an attempt to get this merged, I began testing these changes and got pretty far down the rabbit hole of GCP Load Balancing. Unfortunately, I wasn't able to get this to work. Here are the specific issues I ran into:

It's possible there's a configuration here that will in fact allow us to specify a HTTPS Health Check without all the hacky workarounds, but I'm not aware of it today. Therefore, I'm going to close this PR but would invite anyone to revive this if there's another path forward.