125 lines
3.5 KiB
HCL
125 lines
3.5 KiB
HCL
locals {
|
|
mirror_personas = toset([
|
|
"candidates-bot",
|
|
"mirror-bot",
|
|
])
|
|
mirror_oauth = {
|
|
candidates-reader = {
|
|
service_account = "cand-read-vso"
|
|
}
|
|
candidates-writer = {
|
|
service_account = "cand-write-vso"
|
|
}
|
|
mirror-reader = {
|
|
service_account = "mirror-read-vso"
|
|
}
|
|
mirror-writer = {
|
|
service_account = "mirror-write-vso"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "mirror_persona" {
|
|
for_each = local.mirror_personas
|
|
|
|
mount = vault_mount.secret.path
|
|
name = "quay/personas/${each.key}"
|
|
|
|
data_json_wo_version = 1
|
|
data_json_wo = jsonencode({ password = "PLACEHOLDER" })
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "mirror_oauth" {
|
|
for_each = local.mirror_oauth
|
|
|
|
mount = vault_mount.secret.path
|
|
name = "quay/oauth/${each.key}"
|
|
|
|
data_json_wo_version = 1
|
|
data_json_wo = jsonencode({ token = "PLACEHOLDER" })
|
|
}
|
|
|
|
resource "vault_policy" "mirror_oauth" {
|
|
for_each = local.mirror_oauth
|
|
|
|
name = each.key
|
|
|
|
policy = <<-EOT
|
|
path "secret/data/quay/oauth/${each.key}" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "mirror_oauth" {
|
|
for_each = local.mirror_oauth
|
|
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = each.key
|
|
bound_service_account_names = [each.value.service_account]
|
|
bound_service_account_namespaces = ["mirrored-image"]
|
|
token_policies = [vault_policy.mirror_oauth[each.key].name]
|
|
token_ttl = 3600
|
|
token_max_ttl = 3600
|
|
}
|
|
|
|
resource "vault_policy" "mirror_support" {
|
|
name = "mirror-support"
|
|
|
|
policy = <<-EOT
|
|
path "secret/data/argo/artifacts" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "secret/data/quay/robots/cluster_pull" {
|
|
capabilities = ["read"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "mirror_support" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "mirror-support"
|
|
bound_service_account_names = ["mirror-sup-vso"]
|
|
bound_service_account_namespaces = ["mirrored-image"]
|
|
token_policies = [vault_policy.mirror_support.name]
|
|
token_ttl = 3600
|
|
token_max_ttl = 3600
|
|
}
|
|
|
|
resource "vault_policy" "mirror_bootstrap" {
|
|
name = "mirror-bootstrap"
|
|
|
|
policy = <<-EOT
|
|
path "secret/data/quay/bootstrap" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "secret/data/quay/personas/candidates-bot" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "secret/data/quay/personas/mirror-bot" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "secret/data/quay/oauth/candidates-reader" {
|
|
capabilities = ["read", "update"]
|
|
}
|
|
path "secret/data/quay/oauth/candidates-writer" {
|
|
capabilities = ["read", "update"]
|
|
}
|
|
path "secret/data/quay/oauth/mirror-reader" {
|
|
capabilities = ["read", "update"]
|
|
}
|
|
path "secret/data/quay/oauth/mirror-writer" {
|
|
capabilities = ["read", "update"]
|
|
}
|
|
EOT
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "mirror_bootstrap" {
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = "mirror-bootstrap"
|
|
bound_service_account_names = ["mirror-bootstrap"]
|
|
bound_service_account_namespaces = ["mirrored-image"]
|
|
token_policies = [vault_policy.mirror_bootstrap.name]
|
|
token_ttl = 3600
|
|
token_max_ttl = 3600
|
|
}
|