feat: add kubernetes ldap groups

vault's terraform approle doesnt need to access all of these kubernetes
roles, it was just added as a placeholder and access to the kubernetes
roles was via the `vault_admin` to-much-access account. this is an
effort to roll back that and make access more targeted.

- add kubernetes* ldap groups for specific cluster/role combinations
- remove tf_vault from kubernetes* roles

This commit is contained in:

Ben Vincent

2026-02-14 19:46:39 +11:00

parent 4fe0e0de73

commit 33a746e545

6 changed files with 15 additions and 4 deletions

									
										policies/kubernetes/au/syd1/creds/cluster-root.yaml
									
		+2
		
												View File
												
				@@ -8,3 +8,5 @@ rules:

				auth:

				  approle:

				    - terraform_k8s

				  ldap:

				    - kubernetes_au_syd1_cluster_root