Skip to content

Commit e93fb8c

Browse files
areedareed
authored
Add more examples (#16)
Use custom docs templates to support multiple examples.
1 parent 8435566 commit e93fb8c

File tree

12 files changed

+306
-118
lines changed

12 files changed

+306
-118
lines changed

‎CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
## 0.4.2
2+
3+
CHANGES:
4+
* Add more examples to smallstep_device_collection and smallstep_workload docs.
5+
16
## 0.4.1
27

38
BUG FIXES:

‎docs/resources/device_collection.md‎

Lines changed: 49 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,52 @@ Configuration to create a new device collection.
1212

1313
## Example Usage
1414

15+
### GCP VM Device Collection with GCE Instance
16+
17+
```terraform
18+
resource "smallstep_device_collection" "gcp" {
19+
slug = "gce"
20+
display_name = "GCE"
21+
device_type = "gcp-vm"
22+
gcp_vm = {
23+
service_accounts = ["[email protected]"]
24+
}
25+
admin_emails = ["[email protected]"]
26+
}
27+
28+
data "google_compute_instance" "dbserver" {
29+
name = "dbserver"
30+
zone = "us-central1-b"
31+
}
32+
33+
resource "smallstep_collection_instance" "dbserver" {
34+
depends_on = [smallstep_device_collection.gcp]
35+
collection_slug = smallstep_device_collection.gcp.slug
36+
id = data.google_compute_instance.dbserver.instance_id
37+
data = jsonencode({
38+
"hostname" = data.google_compute_instance.dbserver.name
39+
"private_ip" = data.google_compute_instance.dbserver.network_interface.0.network_ip
40+
"public_ip" = data.google_compute_instance.dbserver.network_interface.0.access_config[0].nat_ip
41+
})
42+
}
43+
```
44+
45+
### TPM Device Collection
46+
47+
```terraform
48+
resource "smallstep_device_collection" "tpm" {
49+
slug = "tmpservers"
50+
display_name = "TPM Servers"
51+
admin_emails = ["[email protected]"]
52+
device_type = "tpm"
53+
tpm = {
54+
attestor_roots = file("${path.module}/root.crt")
55+
}
56+
}
57+
```
58+
59+
### EC2 Device Collection
60+
1561
```terraform
1662
resource "smallstep_device_collection" "aws" {
1763
slug = "ec2west"
@@ -23,19 +69,11 @@ resource "smallstep_device_collection" "aws" {
2369
disable_custom_sans = false
2470
}
2571
}
72+
```
2673

27-
resource "smallstep_device_collection" "gcp" {
28-
slug = "gce"
29-
display_name = "GCE"
30-
admin_emails = ["[email protected]"]
31-
device_type = "gcp-vm"
32-
gcp_vm = {
33-
service_accounts = ["[email protected]"]
34-
project_ids = ["prod-1234"]
35-
disable_custom_sans = false
36-
}
37-
}
74+
### Azure VM Device Collection
3875

76+
```terraform
3977
resource "smallstep_device_collection" "azure" {
4078
slug = "azure"
4179
display_name = "Azure VMs"
@@ -48,19 +86,6 @@ resource "smallstep_device_collection" "azure" {
4886
audience = ""
4987
}
5088
}
51-
52-
resource "smallstep_device_collection" "tpm" {
53-
slug = "tmpservers"
54-
display_name = "TPM Servers"
55-
admin_emails = ["[email protected]"]
56-
device_type = "tpm"
57-
tpm = {
58-
attestor_roots = "-----BEGIN..."
59-
attestor_intermediates = "-----BEGIN..."
60-
force_cn = false
61-
require_eab = false
62-
}
63-
}
6489
```
6590

6691
<!-- schema generated by tfplugindocs -->
@@ -129,5 +154,3 @@ Optional:
129154
- `attestor_roots` (String) The pem-encoded list of certificates used to verify the attestation certificates submitted by agents. Ignored if the team already has an attestation authority. Required if the team does not already have an attestation authority.
130155
- `force_cn` (Boolean) Force one of the SANs to become the Common Name, if a Common Name is not provided.
131156
- `require_eab` (Boolean) Only ACME clients that have been preconfigured with valid EAB credentials will be able to create an account with this provisioner.
132-
133-

‎docs/resources/workload.md‎

Lines changed: 39 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,14 +12,48 @@ A workload represents anything that uses a certificate.
1212

1313
## Example Usage
1414

15+
### Generic Workload on EC2
16+
17+
```terraform
18+
resource "smallstep_device_collection" "ec2_west" {
19+
slug = "ec2west"
20+
display_name = "EC2 West"
21+
device_type = "aws-vm"
22+
aws_vm = {
23+
accounts = ["0123456789"]
24+
}
25+
admin_emails = ["[email protected]"]
26+
}
27+
28+
resource "smallstep_workload" "generic" {
29+
depends_on = [smallstep_device_collection.ec2_west]
30+
workload_type = "generic"
31+
device_collection_slug = resource.smallstep_device_collection.ec2_west.slug
32+
slug = "ec2generic"
33+
display_name = "Generic Workload"
34+
admin_emails = ["[email protected]"]
35+
36+
certificate_info = {
37+
type = "X509"
38+
}
39+
40+
key_info = {
41+
format = "DEFAULT"
42+
type = "ECDSA_P256"
43+
}
44+
}
45+
```
46+
47+
### Redis Workload with All Optionas
48+
1549
```terraform
1650
resource "smallstep_workload" "redis" {
17-
depends_on = [smallstep_device_collection.ec2_east]
18-
device_collection_slug = resource.smallstep_device_collection.ec2_east.slug
51+
depends_on = [smallstep_device_collection.ec2_west]
52+
device_collection_slug = resource.smallstep_device_collection.ec2_west.slug
1953
workload_type = "redis"
20-
slug = "redisec2east"
21-
display_name = "Redis EC2 East"
22-
admin_emails = ["andrew@smallstep.com"]
54+
slug = "redisec2west"
55+
display_name = "Redis EC2 West"
56+
admin_emails = ["admin@example.com"]
2357
2458
certificate_info = {
2559
type = "X509"
@@ -171,5 +205,3 @@ Optional:
171205
- `pid_file` (String) File that holds the pid of the process to signal. Required when method is SIGNAL.
172206
- `signal` (Number) The signal to send to a process when a certificate should be reloaded. Required when method is SIGNAL.
173207
- `unit_name` (String) The systemd unit name to reload when a certificate should be reloaded. Required when method is DBUS.
174-
175-

‎examples/resources/smallstep_device_collection/aws.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
2+
resource "smallstep_device_collection" "aws" {
3+
slug = "ec2west"
4+
display_name = "EC2 West"
5+
admin_emails = ["[email protected]"]
6+
device_type = "aws-vm"
7+
aws_vm = {
8+
accounts = ["0123456789"]
9+
disable_custom_sans = false
10+
}
11+
}

‎examples/resources/smallstep_device_collection/azure.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
2+
resource "smallstep_device_collection" "azure" {
3+
slug = "azure"
4+
display_name = "Azure VMs"
5+
admin_emails = ["[email protected]"]
6+
device_type = "azure-vm"
7+
azure_vm = {
8+
tenant_id = "76543210"
9+
resource_groups = ["0123456789"]
10+
disable_custom_sans = false
11+
audience = ""
12+
}
13+
}

‎examples/resources/smallstep_device_collection/provider.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# This file is not shown in example docs but is used for testing
2+
terraform {
3+
required_providers {
4+
smallstep = {
5+
source = "smallstep/smallstep"
6+
}
7+
google = {
8+
source = "hashicorp/google"
9+
version = "5.2.0"
10+
}
11+
}
12+
}
13+
14+
provider "smallstep" {}
15+
16+
provider "google" {
17+
project = "prod-1234"
18+
region = "us-central1"
19+
}

‎examples/resources/smallstep_device_collection/resource.tf‎

Lines changed: 14 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,49 +1,26 @@
11

2-
resource "smallstep_device_collection" "aws" {
3-
slug = "ec2west"
4-
display_name = "EC2 West"
5-
admin_emails = ["[email protected]"]
6-
device_type = "aws-vm"
7-
aws_vm = {
8-
accounts = ["0123456789"]
9-
disable_custom_sans = false
10-
}
11-
}
12-
132
resource "smallstep_device_collection" "gcp" {
143
slug = "gce"
154
display_name = "GCE"
16-
admin_emails = ["[email protected]"]
175
device_type = "gcp-vm"
186
gcp_vm = {
19-
service_accounts = ["[email protected]"]
20-
project_ids = ["prod-1234"]
21-
disable_custom_sans = false
7+
service_accounts = ["[email protected]"]
228
}
9+
admin_emails = ["[email protected]"]
2310
}
2411

25-
resource "smallstep_device_collection" "azure" {
26-
slug = "azure"
27-
display_name = "Azure VMs"
28-
admin_emails = ["[email protected]"]
29-
device_type = "azure-vm"
30-
azure_vm = {
31-
tenant_id = "76543210"
32-
resource_groups = ["0123456789"]
33-
disable_custom_sans = false
34-
audience = ""
35-
}
12+
data "google_compute_instance" "dbserver" {
13+
name = "dbserver"
14+
zone = "us-central1-b"
3615
}
3716

38-
resource "smallstep_device_collection" "tpm" {
39-
slug = "tmpservers"
40-
display_name = "TPM Servers"
41-
admin_emails = ["[email protected]"]
42-
device_type = "tpm"
43-
tpm = {
44-
attestor_roots = "-----BEGIN..."
45-
attestor_intermediates = "-----BEGIN..."
46-
force_cn = false
47-
require_eab = false
48-
}
17+
resource "smallstep_collection_instance" "dbserver" {
18+
depends_on = [smallstep_device_collection.gcp]
19+
collection_slug = smallstep_device_collection.gcp.slug
20+
id = data.google_compute_instance.dbserver.instance_id
21+
data = jsonencode({
22+
"hostname" = data.google_compute_instance.dbserver.name
23+
"private_ip" = data.google_compute_instance.dbserver.network_interface.0.network_ip
24+
"public_ip" = data.google_compute_instance.dbserver.network_interface.0.access_config[0].nat_ip
25+
})
4926
}

‎examples/resources/smallstep_device_collection/tpm.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
2+
resource "smallstep_device_collection" "tpm" {
3+
slug = "tmpservers"
4+
display_name = "TPM Servers"
5+
admin_emails = ["[email protected]"]
6+
device_type = "tpm"
7+
tpm = {
8+
attestor_roots = file("${path.module}/root.crt")
9+
}
10+
}

‎examples/resources/smallstep_workload/redis.tf‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
2+
resource "smallstep_workload" "redis" {
3+
depends_on = [smallstep_device_collection.ec2_west]
4+
device_collection_slug = resource.smallstep_device_collection.ec2_west.slug
5+
workload_type = "redis"
6+
slug = "redisec2west"
7+
display_name = "Redis EC2 West"
8+
admin_emails = ["[email protected]"]
9+
10+
certificate_info = {
11+
type = "X509"
12+
duration = "168h"
13+
crt_file = "db.crt"
14+
key_file = "db.key"
15+
root_file = "ca.crt"
16+
uid = 1001
17+
gid = 999
18+
mode = 256
19+
}
20+
21+
hooks = {
22+
renew = {
23+
shell = "/bin/sh"
24+
before = [
25+
"echo renewing",
26+
]
27+
after = [
28+
"echo renewed",
29+
]
30+
on_error = [
31+
"echo failed renew",
32+
]
33+
}
34+
sign = {
35+
shell = "/bin/bash"
36+
before = [
37+
"echo signing",
38+
]
39+
after = [
40+
"echo signed",
41+
]
42+
on_error = [
43+
"echo failed sign",
44+
]
45+
}
46+
}
47+
48+
key_info = {
49+
format = "DEFAULT"
50+
type = "ECDSA_P256"
51+
}
52+
53+
reload_info = {
54+
method = "SIGNAL"
55+
pid_file = "db.pid"
56+
signal = 1
57+
}
58+
}

0 commit comments

Comments
 (0)