Wire Forge-native release infrastructure

infra/openbao/google.tf

@@ -0,0 +1,65 @@
+locals {
+  google_required_services = toset([
+    "cloudkms.googleapis.com",
+    "cloudresourcemanager.googleapis.com",
+    "iam.googleapis.com",
+  ])
+
+  google_existing_kms_key_ring_id = var.google_kms_key_ring_id != "" ? var.google_kms_key_ring_id : "projects/${var.google_project_id}/locations/${var.google_kms_key_ring_location}/keyRings/${var.google_kms_key_ring_name}"
+
+  google_kms_key_ring_id = var.manage_google_kms_key_ring ? (
+    google_kms_key_ring.openbao[0].id
+  ) : local.google_existing_kms_key_ring_id
+}
+
+resource "google_project_service" "openbao" {
+  for_each = var.manage_google ? local.google_required_services : toset([])
+
+  project            = var.google_project_id
+  service            = each.value
+  disable_on_destroy = false
+}
+
+resource "google_kms_key_ring" "openbao" {
+  count = var.manage_google && var.manage_google_kms_key_ring ? 1 : 0
+
+  project  = var.google_project_id
+  location = var.google_kms_key_ring_location
+  name     = var.google_kms_key_ring_name
+
+  depends_on = [google_project_service.openbao]
+}
+
+resource "google_kms_crypto_key" "openbao_seal" {
+  count = var.manage_google && local.google_kms_key_ring_id != "" ? 1 : 0
+
+  name     = var.google_openbao_seal_key_name
+  key_ring = local.google_kms_key_ring_id
+  purpose  = "ENCRYPT_DECRYPT"
+  labels = merge(
+    {
+      project    = "burrow"
+      component  = "openbao"
+      managed_by = "opentofu"
+      key_target = "seal"
+    },
+    var.tags,
+  )
+
+  version_template {
+    algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
+    protection_level = "HSM"
+  }
+
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+resource "google_kms_crypto_key_iam_member" "openbao_seal" {
+  for_each = var.manage_google && local.google_kms_key_ring_id != "" ? var.google_openbao_seal_members : toset([])
+
+  crypto_key_id = google_kms_crypto_key.openbao_seal[0].id
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member        = each.value
+}