unkin-agent
5faaff8d19
Drop the bespoke ghp SA/role/policy (terraform-vault#120 closed). The default
k8s auth role, bound to SA default in every namespace, already has a templated
read grant on kv/kubernetes/namespace/<ns>/default/*, so ghp needs zero
terraform-vault change.
- Remove the custom ServiceAccount; run as the namespace default SA.
- Deployment + migrate Job: serviceAccountName default.
- VaultAuth: role/serviceAccount default (mirrors artifactapi).
- VaultStaticSecrets: source paths move to the templated location
kubernetes/namespace/ghp/default/{github-app,app}; Secret names unchanged.
20 lines
360 B
YAML
20 lines
360 B
YAML
---
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- configmap.yaml
|
|
- cnpg_cluster.yaml
|
|
- cnpg_backup.yaml
|
|
- vaultauth.yaml
|
|
- vaultstaticsecret.yaml
|
|
- certificate.yaml
|
|
- deployment.yaml
|
|
- migrate-job.yaml
|
|
- service.yaml
|
|
- pdb.yaml
|
|
- vmservicescrape.yaml
|
|
- gateway.yaml
|
|
- httproute.yaml
|