27 lines
1.1 KiB
Terraform
27 lines
1.1 KiB
Terraform
|
# Kubernetes auth method — workloads authenticate using their pod service account token.
|
||
|
|
resource "vault_auth_backend" "kubernetes" {
|
||
|
|
type = "kubernetes"
|
||
|
|
path = "kubernetes"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kubernetes_auth_backend_config" "kubernetes" {
|
||
|
|
backend = vault_auth_backend.kubernetes.path
|
||
|
|
kubernetes_host = var.k8s_host
|
||
|
|
# Vault reads the cluster CA and its own service account token from the pod
|
||
|
|
# filesystem automatically when running inside the cluster. No explicit
|
||
|
|
# token_reviewer_jwt or kubernetes_ca_cert needed.
|
||
|
|
disable_iss_validation = true
|
||
|
|
}
|
||
|
|
|
||
|
|
# cert-manager role
|
||
|
|
# Bound to cert-manager's service account; grants the cert-manager policy
|
||
|
|
# so it can sign certificates via pki_int.
|
||
|
|
resource "vault_kubernetes_auth_backend_role" "cert_manager" {
|
||
|
|
backend = vault_auth_backend.kubernetes.path
|
||
|
|
role_name = "cert-manager"
|
||
|
|
bound_service_account_names = ["cert-manager"]
|
||
|
|
bound_service_account_namespaces = ["cert-manager"]
|
||
|
|
token_policies = [vault_policy.cert_manager.name]
|
||
|
|
token_ttl = 3600
|
||
|
|
token_max_ttl = 3600
|
||
|
|
}
|