feat: major restructuring in migration to terragrunt
- migrate from individual terraform files to config-driven terragrunt module structure - add vault_cluster module with config discovery system - replace individual .tf files with centralized config.hcl - restructure auth and secret backends as configurable modules - move auth roles and secret backends to yaml-based configuration - convert policies from .hcl to .yaml format, add rules/auth definition - add pre-commit hooks for yaml formatting and file cleanup - add terragrunt cache to gitignore - update makefile with terragrunt commands and format target
This commit is contained in:
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/gitea/unkinben/tokens/read-only-packages" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Gitea read-only package tokens
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/gitea/unkinben/tokens/read-only-packages"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- rpmbuilder
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/github/neoloc/tokens/read-only-token" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading GitHub read-only tokens
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/github/neoloc/tokens/read-only-token"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- rpmbuilder
|
||||
@@ -0,0 +1,11 @@
|
||||
# Allow reading GLAuth service vault configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/glauth/services/svc_vault"
|
||||
capabilities:
|
||||
- list
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/glauth/services/svc_vault" {
|
||||
capabilities = ["list", "read"]
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
# Allow access to Incus cluster join tokens
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/incus/cluster-join-tokens"
|
||||
capabilities:
|
||||
- create
|
||||
- read
|
||||
- update
|
||||
- delete
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- incus_cluster
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/incus/cluster-join-tokens" {
|
||||
capabilities = ["create", "read", "update", "delete"]
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/kubernetes/au/syd1/csi/ceph-cephfs-secret" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Ceph CephFS CSI secrets
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/kubernetes/au/syd1/csi/ceph-cephfs-secret"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- ceph-csi
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/kubernetes/au/syd1/csi/ceph-rbd-secret" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Ceph RBD CSI secrets
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/kubernetes/au/syd1/csi/ceph-rbd-secret"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- ceph-csi
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/kubernetes/au/syd1/externaldns/tsig" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading ExternalDNS TSIG keys
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/kubernetes/au/syd1/externaldns/tsig"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- externaldns
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/kubernetes/au/syd1/service_account_jwt" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Kubernetes service account JWT
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/kubernetes/au/syd1/service_account_jwt"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/kubernetes/au/syd1/token_reviewer_jwt" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Kubernetes token reviewer JWT
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/kubernetes/au/syd1/token_reviewer_jwt"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Prowlarr configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/media-apps/nzbget"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- media-apps
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Prowlarr configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/media-apps/prowlarr"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- media-apps
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/media-apps/radarr" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Radarr configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/media-apps/radarr"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- media-apps
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/media-apps/sonarr" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Sonarr configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/media-apps/sonarr"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- media-apps
|
||||
@@ -0,0 +1,13 @@
|
||||
# Allow Packer builder to read configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/packer/builder/env"
|
||||
capabilities:
|
||||
- read
|
||||
- path: "kv/data/service/packer/builder/docker-incus-client"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- packer_builder
|
||||
@@ -1,6 +0,0 @@
|
||||
path "kv/data/service/packer/builder/env" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
path "kv/data/service/packer/builder/docker-incus-client" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Puppet CA Certificate
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/puppet/certificates/ca"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- terraform_incus
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Puppet certificates for Terraform
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/puppet/certificates/terraform"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- terraform_incus
|
||||
@@ -1,6 +0,0 @@
|
||||
path "kv/data/service/puppet/certificates/terraform" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
path "kv/data/service/puppet/certificates/ca" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/puppetapi/tokens" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Puppet API tokens
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/puppetapi/tokens"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- puppetapi
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/repoflow/au/syd1/ceph-s3" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Repoflow Ceph S3 configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/repoflow/au/syd1/ceph-s3"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- repoflow
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/repoflow/au/syd1/elasticsearch" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Repoflow Elasticsearch configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/repoflow/au/syd1/elasticsearch"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- repoflow
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/repoflow/au/syd1/hasura" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Repoflow Hasura configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/repoflow/au/syd1/hasura"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- repoflow
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/repoflow/au/syd1/postgres" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Repoflow PostgreSQL configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/repoflow/au/syd1/postgres"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- repoflow
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/repoflow/au/syd1/repoflow-server" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Repoflow server configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/repoflow/au/syd1/repoflow-server"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- repoflow
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/repoflow/unkinadmin/tokens/terraform" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Repoflow admin Terraform tokens
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/repoflow/unkinadmin/tokens/terraform"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- terraform_repoflow
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/terraform/incus" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Terraform Incus configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/terraform/incus"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- terraform_incus
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/terraform/nomad" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Terraform Nomad configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/terraform/nomad"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- terraform_nomad
|
||||
@@ -1,3 +0,0 @@
|
||||
path "kv/data/service/terraform/repoflow" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
# Allow reading Terraform Repoflow configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/terraform/repoflow"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- terraform_repoflow
|
||||
@@ -0,0 +1,11 @@
|
||||
# Allow reading Vault auth AppRole role configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/vault/+/+/auth_approle_role/*"
|
||||
capabilities:
|
||||
- list
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
@@ -0,0 +1,11 @@
|
||||
# Allow reading Vault auth backend configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/vault/+/+/auth_backend/*"
|
||||
capabilities:
|
||||
- list
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
@@ -0,0 +1,11 @@
|
||||
# Allow reading Vault secret backend configuration
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/vault/+/+/secret_backend/*"
|
||||
capabilities:
|
||||
- list
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
Reference in New Issue
Block a user