ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

57
terraform/internal/vault/layshaft.tf Normal file
View file

@ -0,0 +1,57 @@
resource "vault_mount" "layshaft" {
path = "layshaft"
type = "kv"
options = { version = "2" }
}
resource "vault_policy" "layshaft" {
name = "layshaft"
policy = <<-EOT
path "${vault_mount.layshaft.path}/data/server" {
capabilities = ["create", "read", "update"]
}
path "${vault_mount.layshaft.path}/data/unlock/+" {
capabilities = ["create", "read", "update"]
}
EOT
}
resource "vault_kubernetes_auth_backend_role" "layshaft" {
backend = vault_auth_backend.kubernetes.path
role_name = "layshaft"
bound_service_account_names = ["layshaft"]
bound_service_account_namespaces = ["layshaft"]
audience = "layshaft-vault"
token_policies = [vault_policy.layshaft.name]
token_no_default_policy = true
token_ttl = 300
token_max_ttl = 300
}
resource "vault_policy" "layshaft_vso" {
name = "layshaft-vso"
policy = <<-EOT
path "auth/token/renew-self" {
capabilities = ["update"]
}
path "secret/data/quay/robots/cluster_pull" {
capabilities = ["read"]
}
path "pki/cert/ca" {
capabilities = ["read"]
}
EOT
}
resource "vault_kubernetes_auth_backend_role" "layshaft_vso" {
backend = vault_auth_backend.kubernetes.path
role_name = "layshaft-vso"
bound_service_account_names = ["layshaft-vso"]
bound_service_account_namespaces = ["layshaft"]
token_policies = [vault_policy.layshaft_vso.name]
token_no_default_policy = true
token_ttl = 300
token_max_ttl = 300
}