ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/vault/ca.tf

@@ -0,0 +1,59 @@
+locals {
+  ca_roots = {
+    internal = "pki"
+    postgres = "pki_postgres"
+    opnsense = "pki_opnsense"
+  }
+}
+
+resource "vault_kv_secret_v2" "ca" {
+  for_each             = local.ca_roots
+  mount                = vault_mount.secret.path
+  name                 = "ca/${each.key}"
+  data_json_wo_version = 1
+  data_json_wo         = jsonencode({ certificate = "PLACEHOLDER" })
+}
+
+resource "vault_policy" "ca_sync" {
+  name = "ca-sync"
+  policy = join("\n", concat(
+    [for mount in values(local.ca_roots) :
+      "path \"${mount}/cert/ca\" { capabilities = [\"read\"] }"
+    ],
+    [for name in keys(local.ca_roots) :
+      "path \"secret/data/ca/${name}\" { capabilities = [\"read\", \"update\"] }"
+    ],
+  ))
+}
+
+resource "vault_kubernetes_auth_backend_role" "ca_sync" {
+  backend                          = vault_auth_backend.kubernetes.path
+  role_name                        = "ca-sync"
+  bound_service_account_names      = ["ca-sync"]
+  bound_service_account_namespaces = ["vault"]
+  token_policies                   = [vault_policy.ca_sync.name]
+  token_ttl                        = 300
+  token_max_ttl                    = 300
+}
+
+resource "vault_policy" "ca_sync_pull" {
+  name   = "ca-sync-pull"
+  policy = <<-EOT
+    path "secret/data/quay/robots/cluster_pull" {
+      capabilities = ["read"]
+    }
+    path "pki/cert/ca" {
+      capabilities = ["read"]
+    }
+  EOT
+}
+
+resource "vault_kubernetes_auth_backend_role" "ca_sync_pull" {
+  backend                          = vault_auth_backend.kubernetes.path
+  role_name                        = "ca-sync-pull"
+  bound_service_account_names      = ["ca-sync-vso"]
+  bound_service_account_namespaces = ["vault"]
+  token_policies                   = [vault_policy.ca_sync_pull.name]
+  token_ttl                        = 3600
+  token_max_ttl                    = 3600
+}