From fc22ac1711d209e2ebe2ccde7fa86a6f24d9173a Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 28 Dec 2024 17:14:14 +1100
Subject: [PATCH] feat: add terraform_nomad role

- add approle and policy for nomad terraform
---
 auth_approle_terraform_nomad.tf         | 15 +++++++++++++++
 policies.tf                             |  1 +
 policies/kv/service/terraform/nomad.hcl |  3 +++
 3 files changed, 19 insertions(+)
 create mode 100644 auth_approle_terraform_nomad.tf
 create mode 100644 policies/kv/service/terraform/nomad.hcl

diff --git a/auth_approle_terraform_nomad.tf b/auth_approle_terraform_nomad.tf
new file mode 100644
index 0000000..f6d8506
--- /dev/null
+++ b/auth_approle_terraform_nomad.tf
@@ -0,0 +1,15 @@
+resource "vault_approle_auth_backend_role" "terraform_nomad" {
+  role_name      = "terraform_nomad"
+  bind_secret_id = false
+  token_policies = [
+    "default_access",
+    "nomad",
+  ]
+  token_ttl     = 60
+  token_max_ttl = 120
+  token_bound_cidrs = [
+    "10.10.12.200/32",
+    "198.18.13.67/32",
+    "198.18.13.68/32",
+  ]
+}
diff --git a/policies.tf b/policies.tf
index a7fad86..1d05b0a 100644
--- a/policies.tf
+++ b/policies.tf
@@ -13,6 +13,7 @@ locals {
     "policies/sshca",
     "policies/kv/service/glauth/services",
     "policies/kv/service/puppetapi",
+    "policies/kv/service/terraform",
   ]
 }
 
diff --git a/policies/kv/service/terraform/nomad.hcl b/policies/kv/service/terraform/nomad.hcl
new file mode 100644
index 0000000..e9b4219
--- /dev/null
+++ b/policies/kv/service/terraform/nomad.hcl
@@ -0,0 +1,3 @@
+path "kv/data/service/terraform/nomad" {
+    capabilities = ["read"]
+}