ce7cb702218693d08ea6d83464d2457c9250027c

terraform/internal/versitygw/quay.tf

@@ -0,0 +1,63 @@
+ephemeral "vault_kv_secret_v2" "quay_user" {
+  mount = "secret"
+  name  = var.quay_vault_secret_path
+}
+
+locals {
+  quay_secret_access_key = ephemeral.vault_kv_secret_v2.quay_user.data["secretAccessKey"]
+}
+
+resource "versitygw_user" "quay" {
+  access_key_id     = var.quay_principal
+  secret_access_key = local.quay_secret_access_key
+  role              = "user"
+}
+
+resource "minio_s3_bucket" "quay_registry" {
+  bucket = var.quay_bucket_name
+}
+
+resource "minio_s3_bucket_policy" "quay_registry" {
+  bucket = minio_s3_bucket.quay_registry.bucket
+
+  depends_on = [
+    versitygw_user.quay,
+  ]
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid       = "QuayBucketAccess"
+        Effect    = "Allow"
+        Principal = var.quay_principal
+        Action = [
+          "s3:GetBucketAcl",
+          "s3:GetBucketLocation",
+          "s3:ListBucket",
+          "s3:ListBucketMultipartUploads",
+        ]
+        Resource = [
+          "arn:aws:s3:::${var.quay_bucket_name}",
+        ]
+      },
+      {
+        Sid       = "QuayObjectAccess"
+        Effect    = "Allow"
+        Principal = var.quay_principal
+        Action = [
+          "s3:AbortMultipartUpload",
+          "s3:DeleteObject",
+          "s3:GetObject",
+          "s3:GetObjectAcl",
+          "s3:ListMultipartUploadParts",
+          "s3:PutObject",
+          "s3:PutObjectAcl",
+        ]
+        Resource = [
+          "arn:aws:s3:::${var.quay_bucket_name}/*",
+        ]
+      },
+    ]
+  })
+}