ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

38
terraform/internal/vault/hf-chat-ui.tf Normal file
View file

@ -0,0 +1,38 @@
resource "vault_database_secret_backend_static_role" "hf_chat_ui" {
backend = vault_mount.database.path
name = "hf-chat-ui"
db_name = vault_database_secret_backend_connection.postgres.name
username = "hf_chat_ui"
rotation_schedule = local.db_static_rotation_schedule
}
resource "vault_policy" "hf_chat_ui" {
name = "hf-chat-ui"
policy = <<-EOT
path "secret/data/hf-chat-ui/oidc/zitadel" {
capabilities = ["read"]
}
path "database/static-creds/hf-chat-ui" {
capabilities = ["read"]
}
path "secret/data/quay/robots/cluster_pull" {
capabilities = ["read"]
}
path "secret/data/ca/internal" {
capabilities = ["read"]
}
path "secret/data/ca/postgres" {
capabilities = ["read"]
}
EOT
}
resource "vault_kubernetes_auth_backend_role" "hf_chat_ui" {
backend = vault_auth_backend.kubernetes.path
role_name = "hf-chat-ui"
bound_service_account_names = ["hf-chat-ui-vso"]
bound_service_account_namespaces = ["hf-chat-ui"]
token_policies = [vault_policy.hf_chat_ui.name]
token_ttl = 3600
token_max_ttl = 3600
}