59 lines
1.8 KiB
HCL
59 lines
1.8 KiB
HCL
locals {
|
|
ca_roots = {
|
|
internal = "pki"
|
|
postgres = "pki_postgres"
|
|
opnsense = "pki_opnsense"
|
|
}
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "ca" {
|
|
for_each = local.ca_roots
|
|
mount = vault_mount.secret.path
|
|
name = "ca/${each.key}"
|
|
data_json_wo_version = 1
|
|
data_json_wo = jsonencode({ certificate = "PLACEHOLDER" })
|
|
}
|
|
|
|
resource "vault_policy" "ca_sync" {
|
|
name = "ca-sync"
|
|
policy = join("\n", concat(
|
|
[for mount in values(local.ca_roots) :
|
|
"path \"${mount}/cert/ca\" { capabilities = [\"read\"] }"
|
|
],
|
|
[for name in keys(local.ca_roots) :
|
|
"path \"secret/data/ca/${name}\" { capabilities = [\"read\", \"update\"] }"
|
|
],
|
|
))
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "ca_sync" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "ca-sync"
|
|
bound_service_account_names = ["ca-sync"]
|
|
bound_service_account_namespaces = ["vault"]
|
|
token_policies = [vault_policy.ca_sync.name]
|
|
token_ttl = 300
|
|
token_max_ttl = 300
|
|
}
|
|
|
|
resource "vault_policy" "ca_sync_pull" {
|
|
name = "ca-sync-pull"
|
|
policy = <<-EOT
|
|
path "secret/data/quay/robots/cluster_pull" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "pki/cert/ca" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "ca_sync_pull" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "ca-sync-pull"
|
|
bound_service_account_names = ["ca-sync-vso"]
|
|
bound_service_account_namespaces = ["vault"]
|
|
token_policies = [vault_policy.ca_sync_pull.name]
|
|
token_ttl = 3600
|
|
token_max_ttl = 3600
|
|
}
|