unkin/terraform-vault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add rpmbuilder approle

Browse Source 
- add rpmbuilder approle
- add policies to acces gitea/github read-only tokens
This commit is contained in:
Ben Vincent 2025-11-29 18:00:20 +11:00
parent 756286c231
commit 5afd1ad9c1
3 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
auth_approle_rpmbuilder.tf Normal file
View File

@ -0,0 +1,16 @@
resource "vault_approle_auth_backend_role" "rpmbuilder" {
role_name = "rpmbuilder"
bind_secret_id = false
token_policies = [
"kv/service/github/neoloc/tokens/read-only-token",
"kv/service/gitea/unkinben/tokens/read-only-packages",
]
token_ttl = 30
token_max_ttl = 30
token_bound_cidrs = [
"10.10.12.200/32",
"198.18.25.102/32",
"198.18.26.91/32",
"198.18.27.40/32",
]
}

3
policies/kv/service/gitea/unkinben/tokens/read-only-packages/read.hcl Normal file
View File

@ -0,0 +1,3 @@
path "kv/data/service/gitea/unkinben/tokens/read-only-packages" {
capabilities = ["read"]
}

3
policies/kv/service/github/neoloc/tokens/read-only-token/read.hcl Normal file
View File

@ -0,0 +1,3 @@
path "kv/data/service/github/neoloc/tokens/read-only-token" {
capabilities = ["read"]
}