ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/vault/cluster-health.tf

@@ -0,0 +1,18 @@
+resource "vault_policy" "cluster_health" {
+  name   = "cluster-health"
+  policy = <<-EOT
+    path "secret/data/quay/robots/cluster_pull" {
+      capabilities = ["read"]
+    }
+  EOT
+}
+
+resource "vault_kubernetes_auth_backend_role" "cluster_health" {
+  backend                          = vault_auth_backend.kubernetes.path
+  role_name                        = "cluster-health"
+  bound_service_account_names      = ["cluster-health-vso"]
+  bound_service_account_namespaces = ["cluster-health"]
+  token_policies                   = [vault_policy.cluster_health.name]
+  token_ttl                        = 3600
+  token_max_ttl                    = 3600
+}