22 lines
717 B
Terraform
22 lines
717 B
Terraform
|
resource "vault_policy" "agentgateway" {
|
||
|
|
name = "agentgateway"
|
||
|
|
|
||
|
|
policy = <<-EOT
|
||
|
|
path "secret/data/agentgateway/*" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
path "secret/data/quay/robots/cluster_pull" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
EOT
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kubernetes_auth_backend_role" "agentgateway" {
|
||
|
|
backend = vault_auth_backend.kubernetes.path
|
||
|
|
role_name = "agentgateway"
|
||
|
|
bound_service_account_names = ["agentgateway-vso"]
|
||
|
|
bound_service_account_namespaces = ["agentgateway-system"]
|
||
|
|
token_policies = [vault_policy.agentgateway.name]
|
||
|
|
token_ttl = 3600
|
||
|
|
token_max_ttl = 3600
|
||
|
|
}
|