unkin/terraform-vault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin:4fe0e0de73f003d12afab19aadbc78d145af845d
Branches Tags
unkin:master
...
compare: unkin:3fb5a64a170d01517b12e5223b9fb2b8dc66929a
Branches Tags
unkin:master

2 Commits
4fe0e0de73 ... 3fb5a64a17

Author SHA1 Message Date
Ben Vincent
3fb5a64a17 Merge pull request 'feat: add kubernetes ldap groups' (#51) from benvin/kubernetes_ldap_groups into master 
Reviewed-on: #51
 2026-02-14 19:48:56 +11:00
Ben Vincent
33a746e545 feat: add kubernetes ldap groups 
vault's terraform approle doesnt need to access all of these kubernetes
roles, it was just added as a placeholder and access to the kubernetes
roles was via the `vault_admin` to-much-access account. this is an
effort to roll back that and make access more targeted.

- add kubernetes* ldap groups for specific cluster/role combinations
- remove tf_vault from kubernetes* roles
 2026-02-14 19:46:39 +11:00
6 changed files with 15 additions and 4 deletions
Show Stats Expand all files Collapse all files

3
config/auth_ldap_group/ldap/kubernetes_au_syd1_cluster_admin.yaml Normal file
View File

@ -0,0 +1,3 @@
---
# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
description: foo

3
config/auth_ldap_group/ldap/kubernetes_au_syd1_cluster_operator.yaml Normal file
View File

@ -0,0 +1,3 @@
---
# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
description: foo

3
config/auth_ldap_group/ldap/kubernetes_au_syd1_cluster_root.yaml Normal file
View File

@ -0,0 +1,3 @@
---
# this file doesnt need anything in it, so this data is just to make sure yamlencode reads some yaml data
description: foo

4
policies/kubernetes/au/syd1/creds/cluster-admin.yaml
View File

@ -6,5 +6,5 @@ rules:
- update
auth:
approle:
- tf_vault
ldap:
- kubernetes_au_syd1_cluster_admin

4
policies/kubernetes/au/syd1/creds/cluster-operator.yaml
View File

@ -6,5 +6,5 @@ rules:
- update
auth:
approle:
- tf_vault
ldap:
- kubernetes_au_syd1_cluster_operator

2
policies/kubernetes/au/syd1/creds/cluster-root.yaml
View File

@ -8,3 +8,5 @@ rules:
auth:
approle:
- terraform_k8s
ldap:
- kubernetes_au_syd1_cluster_root