ce7cb702218693d08ea6d83464d2457c9250027c

2026-11-12 20:46:28 +09:00 · 2026-11-12 20:46:28 +09:00 · 34c5f8963c
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
--- a/terraform/internal/vault/mirrored-image.tf
+++ b/terraform/internal/vault/mirrored-image.tf
@ -0,0 +1,125 @@
+locals {
+  mirror_personas = toset([
+    "candidates-bot",
+    "mirror-bot",
+  ])
+  mirror_oauth = {
+    candidates-reader = {
+      service_account = "cand-read-vso"
+    }
+    candidates-writer = {
+      service_account = "cand-write-vso"
+    }
+    mirror-reader = {
+      service_account = "mirror-read-vso"
+    }
+    mirror-writer = {
+      service_account = "mirror-write-vso"
+    }
+  }
+}
+
+resource "vault_kv_secret_v2" "mirror_persona" {
+  for_each = local.mirror_personas
+
+  mount = vault_mount.secret.path
+  name  = "quay/personas/${each.key}"
+
+  data_json_wo_version = 1
+  data_json_wo         = jsonencode({ password = "PLACEHOLDER" })
+}
+
+resource "vault_kv_secret_v2" "mirror_oauth" {
+  for_each = local.mirror_oauth
+
+  mount = vault_mount.secret.path
+  name  = "quay/oauth/${each.key}"
+
+  data_json_wo_version = 1
+  data_json_wo         = jsonencode({ token = "PLACEHOLDER" })
+}
+
+resource "vault_policy" "mirror_oauth" {
+  for_each = local.mirror_oauth
+
+  name = each.key
+
+  policy = <<-EOT
+    path "secret/data/quay/oauth/${each.key}" {
+      capabilities = ["read"]
+    }
+  EOT
+}
+
+resource "vault_kubernetes_auth_backend_role" "mirror_oauth" {
+  for_each = local.mirror_oauth
+
+  backend                          = vault_auth_backend.kubernetes.path
+  role_name                        = each.key
+  bound_service_account_names      = [each.value.service_account]
+  bound_service_account_namespaces = ["mirrored-image"]
+  token_policies                   = [vault_policy.mirror_oauth[each.key].name]
+  token_ttl                        = 3600
+  token_max_ttl                    = 3600
+}
+
+resource "vault_policy" "mirror_support" {
+  name = "mirror-support"
+
+  policy = <<-EOT
+    path "secret/data/argo/artifacts" {
+      capabilities = ["read"]
+    }
+    path "secret/data/quay/robots/cluster_pull" {
+      capabilities = ["read"]
+    }
+  EOT
+}
+
+resource "vault_kubernetes_auth_backend_role" "mirror_support" {
+  backend                          = vault_auth_backend.kubernetes.path
+  role_name                        = "mirror-support"
+  bound_service_account_names      = ["mirror-sup-vso"]
+  bound_service_account_namespaces = ["mirrored-image"]
+  token_policies                   = [vault_policy.mirror_support.name]
+  token_ttl                        = 3600
+  token_max_ttl                    = 3600
+}
+
+resource "vault_policy" "mirror_bootstrap" {
+  name = "mirror-bootstrap"
+
+  policy = <<-EOT
+    path "secret/data/quay/bootstrap" {
+      capabilities = ["read"]
+    }
+    path "secret/data/quay/personas/candidates-bot" {
+      capabilities = ["read"]
+    }
+    path "secret/data/quay/personas/mirror-bot" {
+      capabilities = ["read"]
+    }
+    path "secret/data/quay/oauth/candidates-reader" {
+      capabilities = ["read", "update"]
+    }
+    path "secret/data/quay/oauth/candidates-writer" {
+      capabilities = ["read", "update"]
+    }
+    path "secret/data/quay/oauth/mirror-reader" {
+      capabilities = ["read", "update"]
+    }
+    path "secret/data/quay/oauth/mirror-writer" {
+      capabilities = ["read", "update"]
+    }
+  EOT
+}
+
+resource "vault_kubernetes_auth_backend_role" "mirror_bootstrap" {
+  backend                          = vault_auth_backend.kubernetes.path
+  role_name                        = "mirror-bootstrap"
+  bound_service_account_names      = ["mirror-bootstrap"]
+  bound_service_account_namespaces = ["mirrored-image"]
+  token_policies                   = [vault_policy.mirror_bootstrap.name]
+  token_ttl                        = 3600
+  token_max_ttl                    = 3600
+}