104 lines
2.7 KiB
Terraform
104 lines
2.7 KiB
Terraform
|
resource "random_password" "versitygw_zot_secret_access_key" {
|
||
|
|
length = 48
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "versitygw_zot_user" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "versitygw/users/zot"
|
||
|
|
|
||
|
|
data_json_wo_version = 1
|
||
|
|
data_json_wo = jsonencode({
|
||
|
|
secretAccessKey = random_password.versitygw_zot_secret_access_key.result
|
||
|
|
})
|
||
|
|
|
||
|
|
# Vault is source of truth after first write. Re-runs do not rotate user credentials.
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "random_password" "zot_admin_password" {
|
||
|
|
length = 48
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "random_password" "quay_custom" {
|
||
|
|
length = 48
|
||
|
|
special = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "quay_custom" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "zot/quay-custom"
|
||
|
|
|
||
|
|
data_json_wo_version = 1
|
||
|
|
data_json_wo = jsonencode({
|
||
|
|
username = "********"
|
||
|
|
password = random_password.quay_custom.result
|
||
|
|
})
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_policy" "quay_custom" {
|
||
|
|
name = "quay-custom-writer"
|
||
|
|
|
||
|
|
policy = <<-EOT
|
||
|
|
path "secret/data/zot/quay-custom" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
EOT
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kubernetes_auth_backend_role" "quay_custom" {
|
||
|
|
backend = vault_auth_backend.kubernetes.path
|
||
|
|
role_name = "quay-custom-writer"
|
||
|
|
bound_service_account_names = ["quay-custom-zot-vso"]
|
||
|
|
bound_service_account_namespaces = ["project-delivery"]
|
||
|
|
token_policies = [vault_policy.quay_custom.name]
|
||
|
|
token_ttl = 3600
|
||
|
|
token_max_ttl = 3600
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "zot_config" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "zot/config"
|
||
|
|
|
||
|
|
data_json_wo_version = 2
|
||
|
|
data_json_wo = jsonencode({
|
||
|
|
AWS_ACCESS_KEY_ID = "********"
|
||
|
|
AWS_SECRET_ACCESS_KEY = random_password.versitygw_zot_secret_access_key.result
|
||
|
|
htpasswd = "********"
|
||
|
|
})
|
||
|
|
|
||
|
|
# Vault is source of truth after first write. Re-runs do not rotate Zot config.
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "zot_admin" {
|
||
|
|
mount = vault_mount.secret.path
|
||
|
|
name = "zot/admin"
|
||
|
|
|
||
|
|
data_json_wo_version = 1
|
||
|
|
data_json_wo = jsonencode({
|
||
|
|
username = "********"
|
||
|
|
password = random_password.zot_admin_password.result
|
||
|
|
})
|
||
|
|
|
||
|
|
# Vault is source of truth after first write. Re-runs do not rotate admin credentials.
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_policy" "zot" {
|
||
|
|
name = "zot"
|
||
|
|
|
||
|
|
policy = <<-EOT
|
||
|
|
path "secret/data/zot/config" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
EOT
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kubernetes_auth_backend_role" "zot" {
|
||
|
|
backend = vault_auth_backend.kubernetes.path
|
||
|
|
role_name = "zot"
|
||
|
|
bound_service_account_names = ["zot-vso"]
|
||
|
|
bound_service_account_namespaces = ["zot"]
|
||
|
|
token_policies = [vault_policy.zot.name]
|
||
|
|
token_ttl = 3600
|
||
|
|
token_max_ttl = 3600
|
||
|
|
}
|