ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/vault/frigate.tf

@@ -0,0 +1,63 @@
+resource "random_password" "frigate_s3" {
+  length  = 48
+  special = false
+}
+
+resource "vault_kv_secret_v2" "frigate_s3" {
+  mount                = vault_mount.secret.path
+  name                 = "versitygw/users/model-reader"
+  data_json_wo_version = 1
+  data_json_wo = jsonencode({
+    accessKeyId     = "model-reader"
+    secretAccessKey = random_password.frigate_s3.result
+  })
+}
+
+resource "vault_kv_secret_v2" "frigate_oauth2_proxy" {
+  mount                = vault_mount.secret.path
+  name                 = "frigate/oauth2-proxy"
+  data_json_wo_version = 1
+  data_json_wo         = jsonencode({})
+}
+
+resource "vault_kv_secret_v2" "frigate_oauth2_proxy_cookie" {
+  mount                = vault_mount.secret.path
+  name                 = "frigate/oauth2-proxy-cookie"
+  data_json_wo_version = 1
+  data_json_wo         = jsonencode({})
+}
+
+resource "vault_policy" "frigate" {
+  name = "frigate"
+
+  policy = <<-EOT
+    path "secret/data/frigate/rtsp" {
+      capabilities = ["read"]
+    }
+    path "secret/data/frigate/oauth2-proxy" {
+      capabilities = ["read"]
+    }
+    path "secret/data/frigate/oauth2-proxy-cookie" {
+      capabilities = ["read"]
+    }
+    path "secret/data/quay/robots/cluster_pull" {
+      capabilities = ["read"]
+    }
+    path "secret/data/versitygw/users/model-reader" {
+      capabilities = ["read"]
+    }
+    path "pki/cert/ca" {
+      capabilities = ["read"]
+    }
+  EOT
+}
+
+resource "vault_kubernetes_auth_backend_role" "frigate" {
+  backend                          = vault_auth_backend.kubernetes.path
+  role_name                        = "frigate"
+  bound_service_account_names      = ["frigate-vso"]
+  bound_service_account_namespaces = ["frigate"]
+  token_policies                   = [vault_policy.frigate.name]
+  token_ttl                        = 3600
+  token_max_ttl                    = 3600
+}