38 lines
1.2 KiB
Terraform
38 lines
1.2 KiB
Terraform
|
resource "vault_database_secret_backend_static_role" "hf_chat_ui" {
|
||
|
|
backend = vault_mount.database.path
|
||
|
|
name = "hf-chat-ui"
|
||
|
|
db_name = vault_database_secret_backend_connection.postgres.name
|
||
|
|
username = "hf_chat_ui"
|
||
|
|
rotation_schedule = local.db_static_rotation_schedule
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_policy" "hf_chat_ui" {
|
||
|
|
name = "hf-chat-ui"
|
||
|
|
policy = <<-EOT
|
||
|
|
path "secret/data/hf-chat-ui/oidc/zitadel" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
path "database/static-creds/hf-chat-ui" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
path "secret/data/quay/robots/cluster_pull" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
path "secret/data/ca/internal" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
path "secret/data/ca/postgres" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
EOT
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kubernetes_auth_backend_role" "hf_chat_ui" {
|
||
|
|
backend = vault_auth_backend.kubernetes.path
|
||
|
|
role_name = "hf-chat-ui"
|
||
|
|
bound_service_account_names = ["hf-chat-ui-vso"]
|
||
|
|
bound_service_account_namespaces = ["hf-chat-ui"]
|
||
|
|
token_policies = [vault_policy.hf_chat_ui.name]
|
||
|
|
token_ttl = 3600
|
||
|
|
token_max_ttl = 3600
|
||
|
|
}
|