36 lines
1 KiB
Terraform
36 lines
1 KiB
Terraform
|
resource "random_password" "pg_backup_key" {
|
||
|
|
length = 48
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "pg_backup" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "versitygw/users/pg-backup"
|
||
|
|
|
||
|
|
data_json_wo_version = 1
|
||
|
|
data_json_wo = jsonencode({
|
||
|
|
access_key_id = "********"
|
||
|
|
secret_access_key = random_password.pg_backup_key.result
|
||
|
|
internal_ca_cert = vault_pki_secret_backend_root_cert.root.certificate
|
||
|
|
})
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_policy" "pg_backup" {
|
||
|
|
name = "pg-backup"
|
||
|
|
|
||
|
|
policy = <<-EOT
|
||
|
|
path "secret/data/versitygw/users/pg-backup" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
EOT
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kubernetes_auth_backend_role" "pg_backup" {
|
||
|
|
backend = vault_auth_backend.kubernetes.path
|
||
|
|
role_name = "pg-backup"
|
||
|
|
bound_service_account_names = ["pg-vso"]
|
||
|
|
bound_service_account_namespaces = ["postgres"]
|
||
|
|
token_policies = [vault_policy.pg_backup.name]
|
||
|
|
token_ttl = 3600
|
||
|
|
token_max_ttl = 3600
|
||
|
|
}
|