unkin/terraform-vault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: update k8s csi roles

Browse Source 
- ensure the new service accounts can read cephrbd/cephfs
- ensure correct namespace is allowed
This commit is contained in:
Ben Vincent 2025-11-26 21:00:18 +11:00
parent f217dbaeca
commit 4cf1b43960
2 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
auth_kubernetes_roles.tf
View File

@ -61,13 +61,20 @@ resource "vault_kubernetes_auth_backend_role" "cert_manager_issuer" {
} }
resource "vault_kubernetes_auth_backend_role" "ceph-csi" { resource "vault_kubernetes_auth_backend_role" "ceph-csi" {
backend = vault_auth_backend.kubernetes.path backend = vault_auth_backend.kubernetes.path
role_name = "ceph-csi" role_name = "ceph-csi"
bound_service_account_names = ["ceph-csi-rbd-csi-rbdplugin-provisioner"] bound_service_account_names = [
bound_service_account_namespaces = ["ceph-csi"] "ceph-csi-rbd-csi-rbd-provisioner",
token_ttl = 60 "ceph-csi-cephfs-csi-cephfs-provisioner",
]
bound_service_account_namespaces = [
"csi-cephrbd",
"csi-cephfs",
]
token_ttl = 60
token_policies = [ token_policies = [
"kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read", "kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read",
"kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read",
] ]
audience = "vault" audience = "vault"
} }

3
policies/kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read.hcl Normal file
View File

@ -0,0 +1,3 @@
path "kv/data/service/kubernetes/au/syd1/csi/ceph-cephfs-secret" {
capabilities = ["read"]
}