Vault/OpenBao setup for GatePlane

This Terraform module enables a Vault/OpenBao instance to use GatePlane.

• It can register all GatePlane plugins to the Vault/OpenBao instance's Plugin Catalog. This is a requirement for using gateplane-io/terraform-gateplane-policy-gate and the rest of the gates.

• It can enable Cross-Origin Resource Sharing (CORS) and Content Security Policy (CSP) for IFrames to allow browser access from additional origins, such as https://app.gateplane.io (domain can be changed).

Requirements

No requirements.

Providers

Name	Version
vault	5.4.0

Resources

Name	Type
vault_auth_backend.approle	resource
vault_generic_endpoint.cache_cors_headers	resource
vault_generic_endpoint.content_security_policy	resource
vault_generic_endpoint.cross_origin_requests	resource
vault_plugin.mock	resource
vault_plugin.okta_group_gate	resource
vault_plugin.policy_gate	resource
vault_policy.policy_gate_policy	resource
vault_policy.ui	resource

Inputs

Name	Description	Type	Default	Required
approle_mount	The Vault/OpenBao AppRole Auth Method mount that the plugin will authenticate against.	string	"gateplane/approle"	no
create_ui_policy	A Vault/OpenBao Policy that can be used to allow usage of the GatePlane UI (app.gateplane.io)	bool	true	no
mock_plugin	Filename, version and SHA256 HexDigest of the GatePlane Mock plugin (only used for testing).	object({ filename = string sha256 = string version = string })	{ "filename": null, "sha256": null, "version": null }	no
okta_group_gate_plugin	Filename, version and SHA256 HexDigest of the GatePlane Okta Group Gate plugin.	object({ filename = string sha256 = string version = string })	{ "filename": null, "sha256": null, "version": null }	no
policy_gate_plugin	Filename, version and SHA256 HexDigest of the GatePlane Policy Gate plugin.	object({ filename = string sha256 = string version = string approle_policy = string })	{ "approle_policy": "gateplane-policy-gate-policy", "filename": null, "sha256": null, "version": null }	no
url_origins	URLs to be allowed CORS and HTML iFrame access by the Vault/OpenBao instance.	list	[]	no

Outputs

Name	Description
approle_mount	The path where the dedicated GatePlane AppRole Auth Method is mounted (used by Policy Gate plugin)
enabled_plugins	The GatePlane Plugins registered in the Vault/OpenBao instance.
ui_policy	The name of the Vault/OpenBao Policy used to grant access to GatePlane UI.

License

This project is licensed under the Elastic License v2.

This means:

• ✅ You can use, fork, and modify it for yourself or within your company.
• ✅ You can submit pull requests and redistribute modified versions (with the license attached).
• ❌ You may not sell it, offer it as a paid product, or use it in a hosted service (e.g., SaaS).
• ❌ You may not re-license it under a different license.

In short: You can use and extend the code freely, privately or inside your business - just don’t build a business around it without our permission. This FAQ by Elastic greatly summarizes things.

See the ./LICENSES/Elastic-2.0.txt file for full details.