ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/vault/auth.tf

@@ -0,0 +1,27 @@
+# Kubernetes auth method — workloads authenticate using their pod service account token.
+resource "vault_auth_backend" "kubernetes" {
+  type = "kubernetes"
+  path = "kubernetes"
+}
+
+resource "vault_kubernetes_auth_backend_config" "kubernetes" {
+  backend         = vault_auth_backend.kubernetes.path
+  kubernetes_host = var.k8s_host
+  # Vault reads the cluster CA and its own service account token from the pod
+  # filesystem automatically when running inside the cluster. No explicit
+  # token_reviewer_jwt or kubernetes_ca_cert needed.
+  disable_iss_validation = true
+}
+
+# cert-manager role
+# Bound to cert-manager's service account; grants the cert-manager policy
+# so it can sign certificates via pki_int.
+resource "vault_kubernetes_auth_backend_role" "cert_manager" {
+  backend                          = vault_auth_backend.kubernetes.path
+  role_name                        = "cert-manager"
+  bound_service_account_names      = ["cert-manager"]
+  bound_service_account_namespaces = ["cert-manager"]
+  token_policies                   = [vault_policy.cert_manager.name]
+  token_ttl                        = 3600
+  token_max_ttl                    = 3600
+}