ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

60
terraform/internal/vault/short.tf Normal file
View file

@ -0,0 +1,60 @@
resource "vault_kv_secret_v2" "short_api" {
mount = vault_mount.secret.path
name = "short/api"
data_json_wo_version = 1
data_json_wo = jsonencode({ private_key = "PLACEHOLDER" })
}
resource "vault_kv_secret_v2" "short_public" {
mount = vault_mount.secret.path
name = "short/public"
data_json_wo_version = 1
data_json_wo = jsonencode({ public_key = "PLACEHOLDER" })
}
resource "vault_kv_secret_v2" "short_peers" {
mount = vault_mount.secret.path
name = "short/peers"
data_json_wo_version = 1
data_json_wo = jsonencode({ config = "{}" })
}
locals {
short_policies = {
short-seed = {
"secret/data/short/api" = ["read", "update"]
"secret/data/short/public" = ["read", "update"]
}
short-controller = {
"secret/data/short/peers" = ["read", "update"]
}
short-vso = {
"secret/data/short/api" = ["read"]
"secret/data/short/cloud" = ["read"]
"secret/data/short/peers" = ["read"]
"secret/data/quay/robots/cluster_pull" = ["read"]
"secret/data/opnsense/interface-watcher" = ["read"]
"secret/data/ca/opnsense" = ["read"]
"pki/cert/ca" = ["read"]
}
}
}
resource "vault_policy" "short" {
for_each = local.short_policies
name = each.key
policy = join("\n", [for path, capabilities in each.value :
"path \"${path}\" { capabilities = ${jsonencode(capabilities)} }"
])
}
resource "vault_kubernetes_auth_backend_role" "short" {
for_each = local.short_policies
backend = vault_auth_backend.kubernetes.path
role_name = each.key
bound_service_account_names = [each.key]
bound_service_account_namespaces = ["short"]
token_policies = [vault_policy.short[each.key].name]
token_ttl = 3600
token_max_ttl = 3600
}