60 lines
2 KiB
HCL
60 lines
2 KiB
HCL
resource "vault_kv_secret_v2" "short_api" {
|
|
mount = vault_mount.secret.path
|
|
name = "short/api"
|
|
data_json_wo_version = 1
|
|
data_json_wo = jsonencode({ private_key = "PLACEHOLDER" })
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "short_public" {
|
|
mount = vault_mount.secret.path
|
|
name = "short/public"
|
|
data_json_wo_version = 1
|
|
data_json_wo = jsonencode({ public_key = "PLACEHOLDER" })
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "short_peers" {
|
|
mount = vault_mount.secret.path
|
|
name = "short/peers"
|
|
data_json_wo_version = 1
|
|
data_json_wo = jsonencode({ config = "{}" })
|
|
}
|
|
|
|
locals {
|
|
short_policies = {
|
|
short-seed = {
|
|
"secret/data/short/api" = ["read", "update"]
|
|
"secret/data/short/public" = ["read", "update"]
|
|
}
|
|
short-controller = {
|
|
"secret/data/short/peers" = ["read", "update"]
|
|
}
|
|
short-vso = {
|
|
"secret/data/short/api" = ["read"]
|
|
"secret/data/short/cloud" = ["read"]
|
|
"secret/data/short/peers" = ["read"]
|
|
"secret/data/quay/robots/cluster_pull" = ["read"]
|
|
"secret/data/opnsense/interface-watcher" = ["read"]
|
|
"secret/data/ca/opnsense" = ["read"]
|
|
"pki/cert/ca" = ["read"]
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "vault_policy" "short" {
|
|
for_each = local.short_policies
|
|
name = each.key
|
|
policy = join("\n", [for path, capabilities in each.value :
|
|
"path \"${path}\" { capabilities = ${jsonencode(capabilities)} }"
|
|
])
|
|
}
|
|
|
|
resource "vault_kubernetes_auth_backend_role" "short" {
|
|
for_each = local.short_policies
|
|
backend = vault_auth_backend.kubernetes.path
|
|
role_name = each.key
|
|
bound_service_account_names = [each.key]
|
|
bound_service_account_namespaces = ["short"]
|
|
token_policies = [vault_policy.short[each.key].name]
|
|
token_ttl = 3600
|
|
token_max_ttl = 3600
|
|
}
|