Certificate revocation list #20
Description
Use case is the following:
If you have a server which requires a valid certificate to log in, you would also want to keep the CRL of the revoked certificates in order to prevent the deleted users get authorized.
When you iterate over a list with users, you need to create new certificates for new users and revoke the certificates for the deleted users, which have disappeared from the list.
I'm not sure whether the current architecture of the terraform states allows us to keep the history of changes, but we need to think about generating the CRL somehow. In theory, we may use some kind of index file to keep the history of certificates.
Currently, when you iterate over a list with users, terraform will destroy resources for disappeared users. As a solution we might iterate over a map instead and do something like this (some kind of the index file in a variable)
users = {
"1" = "user1"
"2" = "user2"
"3" = false # user3 retired
}
resource "tls_locally_signed_cert" "client" {
count = "${length(var.users)}"
...
is_valid = "${lookup(var.users, count.index+1) == 0 ? 0 : 1}"
}
If is_valid true, CRL will be generated in a new attribute