Compute instance metadata does not contain sensitive data

# Terraform: use Barbican for secrets instead of metadata

# Store secret in Barbican
resource "openstack_keymanager_secret_v1" "db_password" {
  name                 = "database-password"
  payload              = random_password.db_password.result
  payload_content_type = "text/plain"
  secret_type          = "passphrase"
}

resource "random_password" "db_password" {
  length  = 32
  special = true
}

# Instance WITHOUT sensitive data in metadata
resource "openstack_compute_instance_v2" "secure_instance" {
  name            = "app-server"
  image_id        = var.image_id
  flavor_id       = var.flavor_id
  key_pair        = var.key_pair_name
  security_groups = ["app-sg"]

  # Safe metadata (non-sensitive labels only)
  metadata = {
    environment       = "production"
    application       = "web-app"
    cost_center       = "engineering"
    barbican_secret_id = openstack_keymanager_secret_v1.db_password.secret_ref
  }

  network {
    name = "private-network"
  }

  # Use cloud-init to retrieve secrets from Barbican
  user_data = <<-EOF
    #!/bin/bash
    # Retrieve database password from Barbican
    SECRET_REF="${openstack_keymanager_secret_v1.db_password.secret_ref}"
    DB_PASSWORD=$(openstack secret get "$SECRET_REF" --payload -f value)
    
    # Configure application with retrieved secret
    echo "DATABASE_URL=<scheme>://user:$DB_PASSWORD@db-host/dbname" > /etc/app/config.env
    chmod 600 /etc/app/config.env
  EOF
}

# ANTI-PATTERN: DO NOT DO THIS
# resource "openstack_compute_instance_v2" "insecure_instance" {
#   metadata = {
#     db_password = "hardcoded-secret-123"  # NEVER store secrets in metadata
#     api_key     = "sk-1234567890abcdef"   # Exposed via metadata service
#   }
# }