57 lines
1.7 KiB
Terraform
57 lines
1.7 KiB
Terraform
|
resource "vault_mount" "layshaft" {
|
||
|
|
path = "layshaft"
|
||
|
|
type = "kv"
|
||
|
|
options = { version = "2" }
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_policy" "layshaft" {
|
||
|
|
name = "layshaft"
|
||
|
|
|
||
|
|
policy = <<-EOT
|
||
|
|
path "${vault_mount.layshaft.path}/data/server" {
|
||
|
|
capabilities = ["create", "read", "update"]
|
||
|
|
}
|
||
|
|
path "${vault_mount.layshaft.path}/data/unlock/+" {
|
||
|
|
capabilities = ["create", "read", "update"]
|
||
|
|
}
|
||
|
|
EOT
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kubernetes_auth_backend_role" "layshaft" {
|
||
|
|
backend = vault_auth_backend.kubernetes.path
|
||
|
|
role_name = "layshaft"
|
||
|
|
bound_service_account_names = ["layshaft"]
|
||
|
|
bound_service_account_namespaces = ["layshaft"]
|
||
|
|
audience = "layshaft-vault"
|
||
|
|
token_policies = [vault_policy.layshaft.name]
|
||
|
|
token_no_default_policy = true
|
||
|
|
token_ttl = 300
|
||
|
|
token_max_ttl = 300
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_policy" "layshaft_vso" {
|
||
|
|
name = "layshaft-vso"
|
||
|
|
|
||
|
|
policy = <<-EOT
|
||
|
|
path "auth/token/renew-self" {
|
||
|
|
capabilities = ["update"]
|
||
|
|
}
|
||
|
|
path "secret/data/quay/robots/cluster_pull" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
path "pki/cert/ca" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
EOT
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kubernetes_auth_backend_role" "layshaft_vso" {
|
||
|
|
backend = vault_auth_backend.kubernetes.path
|
||
|
|
role_name = "layshaft-vso"
|
||
|
|
bound_service_account_names = ["layshaft-vso"]
|
||
|
|
bound_service_account_namespaces = ["layshaft"]
|
||
|
|
token_policies = [vault_policy.layshaft_vso.name]
|
||
|
|
token_no_default_policy = true
|
||
|
|
token_ttl = 300
|
||
|
|
token_max_ttl = 300
|
||
|
|
}
|