From 124079816d6b67f0c8abd386b370820aefca4dee Mon Sep 17 00:00:00 2001
From: Nicolas Brieussel <nicolasbrieussel@Host-002.lan>
Date: Tue, 21 Jul 2026 16:17:03 +0200
Subject: [PATCH] feat: wire OpenBao KMS auto-unseal secrets on scaleway, add
 external-dns IAM

- 02-cluster/scaleway: create the openbao namespace + scaleway-s3-credentials
  and openbao-unseal-aws secrets (mirrors 02-cluster/local), drop Infisical
  in favor of a plain argocd_admin_password_hash var
- 04-dns/scaleway: new IAM root for the external-dns workload identity
  (DomainsDNSFullAccess, scoped to the project), output-only for now

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CCgyeSfKWH6m5mmJEg6t43
---
 02-cluster/local/variables.tf              | 12 ++--
 02-cluster/scaleway/argocd.tf              | 16 ++---
 02-cluster/scaleway/main.tf                | 39 ++++++++++++
 02-cluster/scaleway/variables.tf           | 67 +++++++++++++++------
 02-cluster/scaleway/version.tf             | 24 ++++----
 04-dns/scaleway/.terraform.lock.hcl        | 69 ++++++++++++++++++++++
 04-dns/scaleway/env/04-dns-scaleway.tfvars |  3 +
 04-dns/scaleway/main.tf                    | 36 +++++++++++
 04-dns/scaleway/outputs.tf                 | 10 ++++
 04-dns/scaleway/variables.tf               | 10 ++++
 04-dns/scaleway/version.tf                 | 24 ++++++++
 mise.toml                                  |  1 +
 12 files changed, 268 insertions(+), 43 deletions(-)
 create mode 100644 04-dns/scaleway/.terraform.lock.hcl
 create mode 100644 04-dns/scaleway/env/04-dns-scaleway.tfvars
 create mode 100644 04-dns/scaleway/main.tf
 create mode 100644 04-dns/scaleway/outputs.tf
 create mode 100644 04-dns/scaleway/variables.tf
 create mode 100644 04-dns/scaleway/version.tf

diff --git a/02-cluster/local/variables.tf b/02-cluster/local/variables.tf
index 6536812..1064c91 100644
--- a/02-cluster/local/variables.tf
+++ b/02-cluster/local/variables.tf
@@ -1,10 +1,10 @@
-variable "infisical_client_id" {
-  type = string
-}
+# variable "infisical_client_id" {
+#   type = string
+# }
 
-variable "infisical_client_secret" {
-  type = string
-}
+# variable "infisical_client_secret" {
+#   type = string
+# }
 
 variable "gitops_revision" {
   type    = string
diff --git a/02-cluster/scaleway/argocd.tf b/02-cluster/scaleway/argocd.tf
index 460d37c..389f747 100644
--- a/02-cluster/scaleway/argocd.tf
+++ b/02-cluster/scaleway/argocd.tf
@@ -1,8 +1,8 @@
-data "infisical_secrets" "this" {
-  env_slug     = "staging"
-  workspace_id = "7ecb6ed4-058a-46cd-ac9f-7e792469cf0f" // project ID
-  folder_path  = "/"
-}
+# data "infisical_secrets" "this" {
+#   env_slug     = "staging"
+#   workspace_id = "7ecb6ed4-058a-46cd-ac9f-7e792469cf0f" // project ID
+#   folder_path  = "/"
+# }
 
 resource "helm_release" "argocd" {
   name             = "argocd"
@@ -21,9 +21,9 @@ resource "helm_release" "argocd" {
 
   set_sensitive = [{
     name = "configs.secret.argocdServerAdminPassword"
-    # ArgoCD expects a bcrypt() hash here. bcrypt() would regenerate on every
-    # run, so we store the hash directly in Infisical to avoid spurious diffs.
-    value = data.infisical_secrets.this.secrets["ArgoCD_admin_encrypted"].value
+    # ArgoCD require a `bcrypt()` hashed password here. But `bcrypt` generate a new hash at each execution
+    # So instead, we store the hash directly, so terraform is not confused anymore by fake changes
+    value = var.argocd_admin_password_hash
   }]
 
   values = [<<EOF
diff --git a/02-cluster/scaleway/main.tf b/02-cluster/scaleway/main.tf
index 78ddc53..bbedd2e 100644
--- a/02-cluster/scaleway/main.tf
+++ b/02-cluster/scaleway/main.tf
@@ -59,3 +59,42 @@ resource "null_resource" "update_kubeconfig" {
     EOT
   }
 }
+
+
+resource "kubernetes_namespace" "openbao" {
+  metadata {
+    name = "openbao"
+  }
+  depends_on = [scaleway_k8s_pool.default]
+}
+
+resource "kubernetes_secret" "scaleway_s3_credentials" {
+  metadata {
+    name      = "scaleway-s3-credentials"
+    namespace = kubernetes_namespace.openbao.metadata[0].name
+  }
+
+  data = {
+    bucket     = "backup-dev-id"
+    AWS_ACCESS_KEY_ID = "SCW8FGA70P4HY3A120KV"
+    AWS_SECRET_ACCESS_KEY = var.scaleway_s3_secret_key
+  }
+}
+
+# AWS credentials OpenBao reads at startup for KMS auto-unseal (seal "awskms").
+# Sourced here — outside OpenBao — by necessity: OpenBao can't supply the very
+# creds it needs to unseal itself (chicken-and-egg). Values come from the
+# 03-backup/scaleway kms.tf outputs, fed via the gitignored *.auto.tfvars.
+# Key names (access_key/secret_key) mirror scaleway-s3-credentials so the
+# OpenBao chart's extraSecretEnvironmentVars mapping stays uniform.
+resource "kubernetes_secret" "openbao_unseal_aws" {
+  metadata {
+    name      = "openbao-unseal-aws"
+    namespace = kubernetes_namespace.openbao.metadata[0].name
+  }
+
+  data = {
+    AWS_ACCESS_KEY_ID = var.openbao_unseal_aws_access_key_id
+    AWS_SECRET_ACCESS_KEY = var.openbao_unseal_aws_secret_access_key
+  }
+}
diff --git a/02-cluster/scaleway/variables.tf b/02-cluster/scaleway/variables.tf
index 6d64d53..c100731 100644
--- a/02-cluster/scaleway/variables.tf
+++ b/02-cluster/scaleway/variables.tf
@@ -1,22 +1,22 @@
-# Infisical provide many way to authenticate.
-# You can use `infisical_client_id` and `infisical_client_secret` when running terraform locally
-# Or use `infisical_oidc_identity_id` when OIDC integration is available.
-variable "infisical_client_id" {
-  type    = string
-  default = ""
-}
+# # Infisical provide many way to authenticate.
+# # You can use `infisical_client_id` and `infisical_client_secret` when running terraform locally
+# # Or use `infisical_oidc_identity_id` when OIDC integration is available.
+# variable "infisical_client_id" {
+#   type    = string
+#   default = ""
+# }
 
-variable "infisical_client_secret" {
-  type      = string
-  default   = ""
-  sensitive = true
-}
+# variable "infisical_client_secret" {
+#   type      = string
+#   default   = ""
+#   sensitive = true
+# }
 
-variable "infisical_oidc_identity_id" {
-  description = "Infisical OIDC machine-identity ID. When set, the provider authenticates via GitHub-OIDC; when empty, via universal auth."
-  type        = string
-  default     = ""
-}
+# variable "infisical_oidc_identity_id" {
+#   description = "Infisical OIDC machine-identity ID. When set, the provider authenticates via GitHub-OIDC; when empty, via universal auth."
+#   type        = string
+#   default     = ""
+# }
 
 variable "k8s_version" {
   type    = string
@@ -44,3 +44,36 @@ variable "update_kubeconfig" {
   default = false
   description = "Set to true when using locally to automatically update you ~/.kube/config. Require `kubectl` and `scw` installed & configured."
 }
+
+
+# variable "gitops_revision" {
+#   type    = string
+#   default = "main"
+# }
+
+variable "argocd_admin_password_hash" {
+  description = "Pre-computed bcrypt hash of the ArgoCD admin password. When set, Infisical is not consulted."
+  type        = string
+  # default     = ""
+}
+
+variable "scaleway_s3_secret_key" {
+  description = "Scaleway S3 secret key for OpenBao backup bucket"
+  type        = string
+  sensitive   = true
+  # default     = ""
+}
+
+variable "openbao_unseal_aws_access_key_id" {
+  description = "AWS access key id OpenBao uses for KMS auto-unseal. From 03-backup/scaleway output `openbao_unseal_access_key_id`."
+  type        = string
+  sensitive   = true
+  # default     = ""
+}
+
+variable "openbao_unseal_aws_secret_access_key" {
+  description = "AWS secret access key OpenBao uses for KMS auto-unseal. From 03-backup/scaleway output `openbao_unseal_secret_access_key`."
+  type        = string
+  sensitive   = true
+  # default     = ""
+}
diff --git a/02-cluster/scaleway/version.tf b/02-cluster/scaleway/version.tf
index 22034b8..e2e23e2 100644
--- a/02-cluster/scaleway/version.tf
+++ b/02-cluster/scaleway/version.tf
@@ -30,24 +30,24 @@ terraform {
       source  = "hashicorp/helm"
       version = "~> 3.0"
     }
-    infisical = {
-      source  = "infisical/infisical"
-      version = "~> 0.16"
-    }
+    # infisical = {
+    #   source  = "infisical/infisical"
+    #   version = "~> 0.16"
+    # }
   }
 }
 
 provider "scaleway" {}
 
-provider "infisical" {
+# provider "infisical" {
   
-  auth = { 
-    ## Uncomment `universal` and comment `oidc` when running terraform locally.
-    ## By default, even with `INFISICAL_UNIVERSAL_AUTH_CLIENT_XXXX` environment variable, due to `auth.oidc` being present, infisical provider expect OIDC configuration, and nothing else.
-    # universal = {} 
-    oidc = {} 
-  }
-}
+#   auth = { 
+#     ## Uncomment `universal` and comment `oidc` when running terraform locally.
+#     ## By default, even with `INFISICAL_UNIVERSAL_AUTH_CLIENT_XXXX` environment variable, due to `auth.oidc` being present, infisical provider expect OIDC configuration, and nothing else.
+#     # universal = {} 
+#     oidc = {} 
+#   }
+# }
 
 provider "kubernetes" {
   host                   = scaleway_k8s_cluster.this.kubeconfig[0].host
diff --git a/04-dns/scaleway/.terraform.lock.hcl b/04-dns/scaleway/.terraform.lock.hcl
new file mode 100644
index 0000000..1b73528
--- /dev/null
+++ b/04-dns/scaleway/.terraform.lock.hcl
@@ -0,0 +1,69 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version = "6.55.0"
+  hashes = [
+    "h1:99+MYIg/y3gmsZkhAcffwOpMat+liRJ8b+eyCIax6hk=",
+    "zh:1161fb2d032ad982587b2662a5229e5d06598c5b7fc5c86b2ad64d49225047cd",
+    "zh:1f412b09bbece216da0ba08106f3bbb42d8c8971c02d032ab518629915086966",
+    "zh:2c8b789450bb67181b5f0546714bf6336ba21183c307e001fe848c22dac1f8a6",
+    "zh:31eec91f896743bab641c06930fe0c277143f17dd25b2510991c08e013c8da67",
+    "zh:4419d3e906f1ca9c99703b2c4c5082f58aaeb8b8b82e2657a187a6bdf42d8881",
+    "zh:58e9a7e0581e8cd5f35eb2ce308b2d572073c112facdd0a60aee032146b146b5",
+    "zh:72fdb02a0cb6351626df460c047d1471f26dad781160cc95abd84f8849daf950",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:aa527913348c33969d80527d424917876657741493f294e160f1191dbc7c1d45",
+    "zh:b66e5abd756064f55ff06e1ef83eb8d0b7ea6d96625cfcd24408df5472d5f899",
+    "zh:ba9ab4ba151ac69a854407e27d3a12a2eb260fc4205bbb5c25618e6c8ce69568",
+    "zh:e1bf63e8a6b9790836f74848b458cdf679a7841e66a25b4b9f6034efc9310b34",
+    "zh:ec4adcec426f7181faa5de976cedbd35e15d7d1ac2914bbd9cab9f4f8b018b7f",
+    "zh:f17b485ae74bb4272d2bd680e7d47b0cfd073d192a4f10c8bdfd9d9f25c990a1",
+    "zh:f6650c2d0d3e614c3ccd623bb027a52bce1f5285c4f1824a26f265eb7529a45a",
+    "zh:f7383732f8704099db2166a3516e0a803bf46f42c30cd20a0471b55658ae6e51",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/time" {
+  version     = "0.14.0"
+  constraints = "~> 0.12"
+  hashes = [
+    "h1:/hlxsUpuN/lvPTNL9+NyVGsOyRsK5NsxwFMsj5CdOp4=",
+    "h1:4EThC3ocCFiFPMZQSUvSGSxoJqBcGWxMcFYmL67uS7Y=",
+    "zh:12abfd6b800e4d7fa6db7310dec8ffd440b31993861ef188c7ed5260b3073937",
+    "zh:23005521e800bb19e1597bf755c5f70d675d30b685d4255001ed5fa47d9df3f1",
+    "zh:2fea249b582ae97cd1cc10385187ea50993bb47c28cc5df0305e57ceaabf0a10",
+    "zh:322018d3b987b7aad08697178029a2bb667bed699e88328f0c89c52a2fd41341",
+    "zh:32a08e98fce2d273cb9b2c89d6c54727cc9f0a32e15bfd896be4e02cc6b48f95",
+    "zh:3db89aabd0e619616bd4b0f8b373a7586dfe60feffcea12a84a0bdbc445714b3",
+    "zh:7488f56c81d742dc020f29063626c8f07ca188aa97be61e7307e8d62397020a2",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:7cb4067f2e7559b13f7562ef722f948950901eb37834873e98360ab28f66e9d7",
+    "zh:9d552c8345f61e1b7db8e725144981345f18ac1014d58d6f5ddf0928a195fffb",
+    "zh:a8e69fb6b97fc9d86fb19a9f4d42abe33c4a68e700b15387ce2e17d2b9934bed",
+    "zh:aeeb900eb8dd0f790c60ea5c0e0c8d42bd6e4a54f391681d4decca15b544394b",
+    "zh:c239c619101a8c95e1f14061eb973c57a8d15fa0e68878ced5bbd76858ee5b79",
+  ]
+}
+
+provider "registry.terraform.io/scaleway/scaleway" {
+  version     = "2.79.0"
+  constraints = "~> 2.0"
+  hashes = [
+    "h1:LcxR9sNfLg0lMcPGni34/aFAIL0A3x06mZ8Lhg9LYtk=",
+    "h1:ppfv4S+zXnjoESuhtHx/wE3GZO1sIn+d7c54uouZQrs=",
+    "zh:01ec419b6692bd0ee6c1b64c6a7a9823bc2b757ea6d37958ebf7bf0057ef8083",
+    "zh:025a88b258bd3283439c3380e27edefb4529af875a281e111e43bff9ecc28244",
+    "zh:1ce6ab69fbf08ae529dc7978ccaad00a2b13752f086372f4916d063cf65f5ae8",
+    "zh:2268334e310d0b20d138d32c179d136acc4092c4d5567340074f260f785c2a37",
+    "zh:4ad399c3331a1411839411574f956f08f85617e0c4b66430375e1fe45898182b",
+    "zh:4ed10f0369526d35de7c4d7a178830e6214660f29d6ee88d7beaf31008ee0408",
+    "zh:646b9c6cfb9d8b73e3fa7db856e8792569d78aa8eb54ef1e742ba6ce9783c7dc",
+    "zh:7f7e42809dd20511fa60c16ad36b04510f6b95b3b5570ab0c5405d3374cb5421",
+    "zh:8c143b87770d36736caf381f4c96f724ab7b5f74c720a068f328d4fe558a7c10",
+    "zh:9620776be5cf216efcaff00a592c5d30770230d311b6398b3b7cf533c8b318ee",
+    "zh:99ccd4a8ff73f0670e9f5d9f57ab32c37ee71ded27ea650a62953fa66953826c",
+    "zh:a2dd8abd76c9ebd75cd52f0993d5ee06ce7e1b55d5a215f9b156dc1062898782",
+    "zh:b12575d192032eae656ab4ccce4c92b1047838d77a0c35255e7595a97e72feab",
+  ]
+}
diff --git a/04-dns/scaleway/env/04-dns-scaleway.tfvars b/04-dns/scaleway/env/04-dns-scaleway.tfvars
new file mode 100644
index 0000000..aa58c58
--- /dev/null
+++ b/04-dns/scaleway/env/04-dns-scaleway.tfvars
@@ -0,0 +1,3 @@
+project_id = "6283c05b-a4c7-4f83-a75f-83adad236d54"
+
+# api_key_rotation_days defaults to 365
diff --git a/04-dns/scaleway/main.tf b/04-dns/scaleway/main.tf
new file mode 100644
index 0000000..b3c9587
--- /dev/null
+++ b/04-dns/scaleway/main.tf
@@ -0,0 +1,36 @@
+# IAM identity for external-dns (gitops: platform/scaleway/external-dns.yml),
+# scoped to Domains & DNS zone record management only — it can read/write DNS
+# records, nothing else (no domain registration/transfer, no other product).
+#
+# scalepack.fr was bought directly through Scaleway Domains & DNS, so its zone
+# already lives in the project this key is scoped to.
+resource "scaleway_iam_application" "external_dns" {
+  name        = "external-dns-${terraform.workspace}"
+  description = "Kubernetes workload identity for external-dns (${terraform.workspace}) — manages DNS zone records for domains bought through Scaleway."
+}
+
+resource "scaleway_iam_policy" "external_dns" {
+  name           = "external-dns-${terraform.workspace}"
+  description    = "DNS zone record read/write for the external-dns workload. No domain registration/transfer access."
+  application_id = scaleway_iam_application.external_dns.id
+
+  rule {
+    project_ids          = [var.project_id]
+    permission_set_names = ["DomainsDNSFullAccess"]
+  }
+}
+
+# Scaleway requires every API key to carry an expiry. time_rotating keeps the
+# expiry self-renewing: once the window elapses, the next apply rotates the
+# key — re-copy it into OpenBao by hand afterward (no automated push yet, see
+# gitops apps/external-dns-init).
+resource "time_rotating" "external_dns_key" {
+  rotation_days = var.api_key_rotation_days
+}
+
+resource "scaleway_iam_api_key" "external_dns" {
+  application_id     = scaleway_iam_application.external_dns.id
+  description        = "external-dns workload credentials (${terraform.workspace})."
+  default_project_id = var.project_id
+  expires_at         = time_rotating.external_dns_key.rotation_rfc3339
+}
diff --git a/04-dns/scaleway/outputs.tf b/04-dns/scaleway/outputs.tf
new file mode 100644
index 0000000..50fd9fb
--- /dev/null
+++ b/04-dns/scaleway/outputs.tf
@@ -0,0 +1,10 @@
+output "workload_access_key" {
+  description = "Public access key for the external-dns workload identity."
+  value       = scaleway_iam_api_key.external_dns.access_key
+}
+
+output "workload_secret_key" {
+  description = "Secret key for the external-dns workload identity. Not pushed anywhere yet (terraform output) — copy into OpenBao by hand at apps/external-dns/scaleway-dns-credentials (see gitops apps/external-dns-init)."
+  sensitive   = true
+  value       = scaleway_iam_api_key.external_dns.secret_key
+}
diff --git a/04-dns/scaleway/variables.tf b/04-dns/scaleway/variables.tf
new file mode 100644
index 0000000..817aeae
--- /dev/null
+++ b/04-dns/scaleway/variables.tf
@@ -0,0 +1,10 @@
+variable "project_id" {
+  description = "Scaleway project ID for IAM resource scoping. Must be the project scalepack.fr's DNS zone lives in."
+  type        = string
+}
+
+variable "api_key_rotation_days" {
+  description = "Rotation window (days) for the external-dns API key expiry."
+  type        = number
+  default     = 365
+}
diff --git a/04-dns/scaleway/version.tf b/04-dns/scaleway/version.tf
new file mode 100644
index 0000000..4392bd7
--- /dev/null
+++ b/04-dns/scaleway/version.tf
@@ -0,0 +1,24 @@
+terraform {
+  backend "s3" {
+    bucket               = "id-terraform-state20260612164136440800000001"
+    region               = "eu-west-3"
+    workspace_key_prefix = "dns/scaleway"
+    key                  = "terraform.tfstate"
+    encrypt              = true
+    use_lockfile         = true
+  }
+
+  required_providers {
+    scaleway = {
+      source  = "scaleway/scaleway"
+      version = "~> 2.0"
+    }
+    time = {
+      source  = "hashicorp/time"
+      version = "~> 0.12"
+    }
+  }
+}
+
+# Creds, region and project_id come from the scw CLI config (like the other roots).
+provider "scaleway" {}
diff --git a/mise.toml b/mise.toml
index d7b8deb..335cebd 100644
--- a/mise.toml
+++ b/mise.toml
@@ -68,4 +68,5 @@ terraform -chdir=01-iam/ci-managed/aws-state-access providers lock -platform=dar
 terraform -chdir=02-cluster/local                   providers lock -platform=darwin_arm64 -platform=linux_amd64
 terraform -chdir=02-cluster/scaleway                providers lock -platform=darwin_arm64 -platform=linux_amd64
 terraform -chdir=03-backup/scaleway                 providers lock -platform=darwin_arm64 -platform=linux_amd64
+terraform -chdir=04-dns/scaleway                    providers lock -platform=darwin_arm64 -platform=linux_amd64
 """