ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

248
terraform/internal/vault/project-delivery.tf Normal file
View file

@ -0,0 +1,248 @@
resource "vault_kv_secret_v2" "project_delivery_cache_reader" {
mount = vault_mount.secret.path
name = "versitygw/users/project-delivery-cache-reader"
data_json_wo_version = 1
data_json_wo = jsonencode({
secretAccessKey = "PLACEHOLDER"
})
}
resource "vault_kv_secret_v2" "rcon_publisher" {
mount = vault_mount.secret.path
name = "versitygw/users/rcon-publisher"
data_json_wo_version = 1
data_json_wo = jsonencode({
secretAccessKey = "PLACEHOLDER"
})
}
resource "vault_policy" "rcon_publisher" {
name = "rcon-publisher"
policy = <<-EOT
path "secret/data/versitygw/users/rcon-publisher" {
capabilities = ["read"]
}
EOT
}
resource "vault_kubernetes_auth_backend_role" "rcon_publisher" {
backend = vault_auth_backend.kubernetes.path
role_name = "rcon-publisher"
bound_service_account_names = ["rcon-publisher-vso"]
bound_service_account_namespaces = ["project-delivery"]
token_policies = [vault_policy.rcon_publisher.name]
token_ttl = 3600
token_max_ttl = 3600
}
resource "vault_kv_secret_v2" "project_delivery_cache_writer" {
mount = vault_mount.secret.path
name = "versitygw/users/project-delivery-cache-writer"
data_json_wo_version = 1
data_json_wo = jsonencode({
secretAccessKey = "PLACEHOLDER"
})
}
resource "vault_kv_secret_v2" "lazaret_publisher" {
mount = vault_mount.secret.path
name = "forgejo-public/tokens/lazaret-publisher"
data_json_wo_version = 1
data_json_wo = jsonencode({ token = "PLACEHOLDER" })
}
resource "vault_kv_secret_v2" "chultun_publisher" {
mount = vault_mount.secret.path
name = "forgejo-public/tokens/chultun-publisher"
data_json_wo_version = 1
data_json_wo = jsonencode({ token = "PLACEHOLDER" })
}
resource "vault_kv_secret_v2" "corago_publisher" {
mount = vault_mount.secret.path
name = "forgejo-public/tokens/corago-publisher"
data_json_wo_version = 1
data_json_wo = jsonencode({ token = "PLACEHOLDER" })
}
resource "vault_kv_secret_v2" "quorate_pull" {
mount = vault_mount.secret.path
name = "forgejo/tokens/quorate-pull"
data_json_wo_version = 1
data_json_wo = jsonencode({ token = "PLACEHOLDER" })
}
resource "vault_kv_secret_v2" "quorate_push" {
mount = vault_mount.secret.path
name = "forgejo-public/tokens/quorate-push"
data_json_wo_version = 1
data_json_wo = jsonencode({ token = "PLACEHOLDER" })
}
resource "vault_policy" "chultun_publisher" {
name = "chultun-publisher"
policy = <<-EOT
path "secret/data/forgejo-public/tokens/chultun-publisher" {
capabilities = ["read"]
}
EOT
}
resource "vault_kubernetes_auth_backend_role" "chultun_publisher" {
backend = vault_auth_backend.kubernetes.path
role_name = "chultun-publisher"
bound_service_account_names = ["chultun-pub-vso"]
bound_service_account_namespaces = ["project-delivery"]
token_policies = [vault_policy.chultun_publisher.name]
token_ttl = 3600
token_max_ttl = 3600
}
resource "vault_policy" "corago_publisher" {
name = "corago-publisher"
policy = <<-EOT
path "secret/data/forgejo-public/tokens/corago-publisher" {
capabilities = ["read"]
}
EOT
}
resource "vault_kubernetes_auth_backend_role" "corago_publisher" {
backend = vault_auth_backend.kubernetes.path
role_name = "corago-publisher"
bound_service_account_names = ["corago-pub-vso"]
bound_service_account_namespaces = ["project-delivery"]
token_policies = [vault_policy.corago_publisher.name]
token_ttl = 3600
token_max_ttl = 3600
}
resource "vault_kv_secret_v2" "zygostates_publisher" {
mount = vault_mount.secret.path
name = "forgejo-public/tokens/zygostates-publisher"
data_json_wo_version = 1
data_json_wo = jsonencode({ token = "PLACEHOLDER" })
}
resource "vault_policy" "zygostates_publisher" {
name = "zygostates-publisher"
policy = <<-EOT
path "secret/data/forgejo-public/tokens/zygostates-publisher" {
capabilities = ["read"]
}
EOT
}
resource "vault_kubernetes_auth_backend_role" "zygostates_publisher" {
backend = vault_auth_backend.kubernetes.path
role_name = "zygostates-publisher"
bound_service_account_names = ["zygostates-pub-vso"]
bound_service_account_namespaces = ["project-delivery"]
token_policies = [vault_policy.zygostates_publisher.name]
token_ttl = 3600
token_max_ttl = 3600
}
resource "vault_kv_secret_v2" "ostension_publisher" {
mount = vault_mount.secret.path
name = "forgejo-public/tokens/ostension-publisher"
data_json_wo_version = 1
data_json_wo = jsonencode({ token = "PLACEHOLDER" })
}
resource "vault_policy" "ostension_publisher" {
name = "ostension-publisher"
policy = <<-EOT
path "secret/data/forgejo-public/tokens/ostension-publisher" {
capabilities = ["read"]
}
EOT
}
resource "vault_kubernetes_auth_backend_role" "ostension_publisher" {
backend = vault_auth_backend.kubernetes.path
role_name = "ostension-publisher"
bound_service_account_names = ["ostension-pub-vso"]
bound_service_account_namespaces = ["project-delivery"]
token_policies = [vault_policy.ostension_publisher.name]
token_ttl = 3600
token_max_ttl = 3600
}
resource "vault_kv_secret_v2" "saltatory_publisher" {
mount = vault_mount.secret.path
name = "forgejo-public/tokens/saltatory-publisher"
data_json_wo_version = 1
data_json_wo = jsonencode({ token = "PLACEHOLDER" })
}
resource "vault_policy" "saltatory_publisher" {
name = "saltatory-publisher"
policy = <<-EOT
path "secret/data/forgejo-public/tokens/saltatory-publisher" {
capabilities = ["read"]
}
EOT
}
resource "vault_kubernetes_auth_backend_role" "saltatory_publisher" {
backend = vault_auth_backend.kubernetes.path
role_name = "saltatory-publisher"
bound_service_account_names = ["saltatory-pub-vso"]
bound_service_account_namespaces = ["project-delivery"]
token_policies = [vault_policy.saltatory_publisher.name]
token_ttl = 3600
token_max_ttl = 3600
}
resource "vault_kv_secret_v2" "project_source" {
mount = vault_mount.secret.path
name = "forgejo-public/tokens/project-delivery-source"
data_json_wo_version = 1
data_json_wo = jsonencode({ token = "PLACEHOLDER" })
}
resource "vault_kv_secret_v2" "layshaft_publisher" {
mount = vault_mount.secret.path
name = "forgejo-public/tokens/layshaft-publisher"
data_json_wo_version = 1
data_json_wo = jsonencode({ token = "PLACEHOLDER" })
}
resource "vault_policy" "layshaft_publisher" {
name = "layshaft-publisher"
policy = <<-EOT
path "secret/data/forgejo-public/tokens/layshaft-publisher" {
capabilities = ["read"]
}
EOT
}
resource "vault_kubernetes_auth_backend_role" "layshaft_publisher" {
backend = vault_auth_backend.kubernetes.path
role_name = "layshaft-publisher"
bound_service_account_names = ["layshaft-pub-vso"]
bound_service_account_namespaces = ["project-delivery"]
token_policies = [vault_policy.layshaft_publisher.name]
token_ttl = 3600
token_max_ttl = 3600
}