unkin/terraform-vault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add repoflow service vault configuration

Browse Source 
- add secrets for s3, elasticsearch, hasura, postgres and repoflow
This commit is contained in:
Ben Vincent 2025-12-13 09:20:41 +11:00
parent 2466a6fe5c
commit 7b81abfa9e
6 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
auth_kubernetes_roles.tf
View File

@ -95,3 +95,23 @@ resource "vault_kubernetes_auth_backend_role" "media-apps" {
]
audience = "vault"
}
resource "vault_kubernetes_auth_backend_role" "repoflow" {
backend = vault_auth_backend.kubernetes.path
role_name = "repoflow"
bound_service_account_names = [
"default",
]
bound_service_account_namespaces = [
"repoflow",
]
token_ttl = 60
token_policies = [
"kv/service/repoflow/au/syd1/ceph-s3/read",
"kv/service/repoflow/au/syd1/elasticsearch/read",
"kv/service/repoflow/au/syd1/hasura/read",
"kv/service/repoflow/au/syd1/postgres/read",
"kv/service/repoflow/au/syd1/repoflow-server/read",
]
audience = "vault"
}

3
policies/kv/service/repoflow/au/syd1/ceph-s3/read.hcl Normal file
View File

@ -0,0 +1,3 @@
path "kv/data/service/repoflow/au/syd1/ceph-s3" {
capabilities = ["read"]
}

3
policies/kv/service/repoflow/au/syd1/elasticsearch/read.hcl Normal file
View File

@ -0,0 +1,3 @@
path "kv/data/service/repoflow/au/syd1/elasticsearch" {
capabilities = ["read"]
}

3
policies/kv/service/repoflow/au/syd1/hasura/read.hcl Normal file
View File

@ -0,0 +1,3 @@
path "kv/data/service/repoflow/au/syd1/hasura" {
capabilities = ["read"]
}

3
policies/kv/service/repoflow/au/syd1/postgres/read.hcl Normal file
View File

@ -0,0 +1,3 @@
path "kv/data/service/repoflow/au/syd1/postgres" {
capabilities = ["read"]
}

3
policies/kv/service/repoflow/au/syd1/repoflow-server/read.hcl Normal file
View File

@ -0,0 +1,3 @@
path "kv/data/service/repoflow/au/syd1/repoflow-server" {
capabilities = ["read"]
}