Skip to content

[terraform-ibm-cloud-monitoring] Changed needed to sysdig resource key creation #28

Open
@ocofaigh

Description

@ocofaigh

Problem:
In https://github.com/terraform-ibm-modules/terraform-ibm-observability-instances/blob/main/modules/cloud_monitoring/main.tf a resource key is always created. Consumers are reporting it is hard to follow secret rotation best practises because:

  • 1 key is always created - even if its not needed
  • You currently cannot rotate the key value using terraform. Simply changing the value of manager_key_name will not rotate the key.
  • You really need the ability to have 2 active keys at any given time to be able to rotate key consumers (e.g. sysdig agents) non disruptively

Proposal:

  • Remove the manager_key_name input and replace it with a new input resource_keys (copy this approach)

Considerations:

  • Should the default value of resource_keys be a way where it will create the manager key by default? Or it should create no key by default?
  • This will be a breaking change that will impact consumers. How should we handle?

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions