unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add plan workflow
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details

Browse Source 
- update makefile to enable kubernetes auth or roleid auth
- add plan workflow
- update all policies to allow the terraform-vault kubernetes role
This commit is contained in:
Ben Vincent
2026-05-21 23:20:07 +10:00
parent 73aaaaeb99
commit 9cbac6d3ef
42 changed files with 125 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.woodpecker/plan.yaml
+21
View File
@@ -0,0 +1,21 @@
when:
- event: pull_request
steps:
- name: plan
image: git.unkin.net/unkin/almalinux9-opentofu:20260308
environment:
VAULT_AUTH_METHOD: kubernetes
commands:
- dnf install vault -y
- make plan
backend_options:
kubernetes:
serviceAccountName: terraform-vault
resources:
requests:
memory: 512Mi
cpu: 1
limits:
memory: 2Gi
cpu: 2
.woodpecker/pre-commit.yaml
+10
View File
@@ -6,3 +6,13 @@ steps:
image: git.unkin.net/unkin/almalinux9-opentofu:20260308
commands:
- uvx pre-commit run --all-files
backend_options:
kubernetes:
serviceAccountName: default
resources:
requests:
memory: 512Mi
cpu: 1
limits:
memory: 2Gi
cpu: 2
Makefile
+11 -2
View File
@@ -1,10 +1,19 @@
.PHONY: init plan apply format
VAULT_AUTH_METHOD ?= approle
VAULT_K8S_ROLE ?= woodpecker_terraform_vault
VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
# Define vault_env function to set up vault environment
define vault_env
@export VAULT_ADDR="https://vault.service.consul:8200" && \
export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID) && \
export CONSUL_HTTP_TOKEN=$$(vault read -format=json consul_root/au/syd1/creds/terraform-vault | jq '.data.token')
if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
else \
export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
fi && \
export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-vault)
endef
init:
config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_vault.yaml
+7
View File
@@ -0,0 +1,7 @@
bound_service_account_names:
- terraform-vault
bound_service_account_namespaces:
- woodpecker
token_ttl: 600
token_max_ttl: 600
audience: https://kubernetes.default.svc.cluster.local
policies/auth/approle/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/approle/login.yaml
+2
View File
@@ -8,3 +8,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/k8s/au/syd1/admin.yaml
+2
View File
@@ -21,3 +21,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/ldap/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/token/create.yaml
+2
View File
@@ -15,3 +15,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/token/lookup.yaml
+2
View File
@@ -9,3 +9,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/token/renew.yaml
+2
View File
@@ -8,3 +8,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/token/roles/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/token/self.yaml
+2
View File
@@ -14,3 +14,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/consul_root/au/syd1/config/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/consul_root/au/syd1/creds/terraform-vault.yaml
+2
View File
@@ -8,3 +8,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/consul_root/au/syd1/roles/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kubernetes/au/config_admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kubernetes/au/roles_admin.yaml
+2
View File
@@ -15,3 +15,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kubernetes/au/syd1/creds/media-apps-operator.yaml
+2
View File
@@ -8,3 +8,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/config/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/glauth/services/svc_vault/read.yaml
+2
View File
@@ -9,3 +9,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/kubernetes/au/syd1/service_account_jwt/read.yaml
+2
View File
@@ -8,3 +8,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/kubernetes/au/syd1/token_reviewer_jwt/read.yaml
+2
View File
@@ -8,3 +8,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/vault/auth_approle_roles_read.yaml
+2
View File
@@ -9,3 +9,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/vault/auth_backends_read.yaml
+2
View File
@@ -9,3 +9,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/vault/secret_backends_read.yaml
+2
View File
@@ -9,3 +9,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki/au/syd1/config/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki/au/syd1/issuer/admin.yaml
+2
View File
@@ -9,3 +9,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki/au/syd1/roles/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_int/config/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_int/issuer/admin.yaml
+2
View File
@@ -9,3 +9,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_int/roles/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_root/config/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_root/issuer/admin.yaml
+2
View File
@@ -9,3 +9,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_root/roles/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/rundeck/config/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/sshca/config/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/sshca/roles/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/sys/auth/admin.yaml
+2
View File
@@ -12,3 +12,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/sys/mounts/admin.yaml
+2
View File
@@ -20,3 +20,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/sys/policy/admin.yaml
+2
View File
@@ -16,3 +16,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/transit/keys/admin.yaml
+2
View File
@@ -16,3 +16,5 @@ rules:
auth:
approle:
- tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault