unkin/terraform-vault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin:4b176846f28e9d82b55e98da68738808e9a0999f
Branches Tags
unkin:master
...
compare: unkin:d3989111089f8d98a71badba7d9aaea5e29bd7fc
Branches Tags
unkin:master

2 Commits
4b176846f2 ... d398911108

Author SHA1 Message Date
Ben Vincent
d398911108 Merge pull request 'fix: kubernetes auth fixes' (#53) from benvin/kubernetes_fixes into master 
Reviewed-on: #53
 2026-02-15 13:08:43 +11:00
Ben Vincent
c093d5830d fix: kubernetes auth fixes 
- annotations as alias metadata does not work with openbao (idempotency issue)
- set token_ttl to be 600 for all auth roles for kubernetes (min)
 2026-02-15 13:06:08 +11:00
10 changed files with 10 additions and 10 deletions
Show Stats Expand all files Collapse all files

2
config/auth_kubernetes_backend/k8s/au/syd1.yaml
View File

@ -1,5 +1,5 @@
kubernetes_host: https://api-k8s.service.consul:6443
disable_iss_validation: true
use_annotations_as_alias_metadata: true
use_annotations_as_alias_metadata: false # doesnt work with openbao yet
default_lease_ttl: 1h
max_lease_ttl: 24h

2
config/auth_kubernetes_role/k8s/au/syd1/ceph-csi.yaml
View File

@ -4,5 +4,5 @@ bound_service_account_names:
bound_service_account_namespaces:
- csi-cephrbd
- csi-cephfs
token_ttl: 60
token_ttl: 600
audience: vault

2
config/auth_kubernetes_role/k8s/au/syd1/cert_manager_issuer.yaml
View File

@ -2,5 +2,5 @@ bound_service_account_names:
- cert-manager-vault-issuer
bound_service_account_namespaces:
- cert-manager
token_ttl: 60
token_ttl: 600
audience: vault

2
config/auth_kubernetes_role/k8s/au/syd1/externaldns.yaml
View File

@ -2,5 +2,5 @@ bound_service_account_names:
- externaldns
bound_service_account_namespaces:
- externaldns
token_ttl: 60
token_ttl: 600
audience: vault

2
config/auth_kubernetes_role/k8s/au/syd1/huntarr-default.yaml
View File

@ -2,5 +2,5 @@ bound_service_account_names:
- default
bound_service_account_namespaces:
- huntarr
token_ttl: 60
token_ttl: 600
audience: vault

2
config/auth_kubernetes_role/k8s/au/syd1/identity.yaml
View File

@ -2,5 +2,5 @@ bound_service_account_names:
- default
bound_service_account_namespaces:
- identity
token_ttl: 60
token_ttl: 600
audience: vault

2
config/auth_kubernetes_role/k8s/au/syd1/media-apps.yaml
View File

@ -2,5 +2,5 @@ bound_service_account_names:
- media-apps-vault-reader
bound_service_account_namespaces:
- media-apps
token_ttl: 60
token_ttl: 600
audience: vault

2
config/auth_kubernetes_role/k8s/au/syd1/puppet.yaml
View File

@ -2,5 +2,5 @@ bound_service_account_names:
- default
bound_service_account_namespaces:
- puppet
token_ttl: 60
token_ttl: 600
audience: vault

2
config/auth_kubernetes_role/k8s/au/syd1/rancher.yaml
View File

@ -2,5 +2,5 @@ bound_service_account_names:
- rancher
bound_service_account_namespaces:
- cattle-system
token_ttl: 60
token_ttl: 600
audience: vault

2
config/auth_kubernetes_role/k8s/au/syd1/repoflow.yaml
View File

@ -2,5 +2,5 @@ bound_service_account_names:
- default
bound_service_account_namespaces:
- repoflow
token_ttl: 60
token_ttl: 600
audience: vault