unkin/terraform-vault
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin:605aa204a96898c335d41ec4967b91f71dacb494
Branches Tags
unkin:master
..
compare: unkin:f217dbaeca1b5d74fb76e5295099dc40ca8412a7
Branches Tags
unkin:master

No commits in common. "605aa204a96898c335d41ec4967b91f71dacb494" and "f217dbaeca1b5d74fb76e5295099dc40ca8412a7" have entirely different histories.
605aa204a9 ... f217dbaeca

2 changed files with 5 additions and 15 deletions
Show Stats Expand all files Collapse all files

17
auth_kubernetes_roles.tf
View File

@ -61,20 +61,13 @@ resource "vault_kubernetes_auth_backend_role" "cert_manager_issuer" {
}
resource "vault_kubernetes_auth_backend_role" "ceph-csi" {
backend = vault_auth_backend.kubernetes.path
role_name = "ceph-csi"
bound_service_account_names = [
"ceph-csi-rbd-csi-rbd-provisioner",
"ceph-csi-cephfs-csi-cephfs-provisioner",
]
bound_service_account_namespaces = [
"csi-cephrbd",
"csi-cephfs",
]
token_ttl = 60
backend = vault_auth_backend.kubernetes.path
role_name = "ceph-csi"
bound_service_account_names = ["ceph-csi-rbd-csi-rbdplugin-provisioner"]
bound_service_account_namespaces = ["ceph-csi"]
token_ttl = 60
token_policies = [
"kv/service/kubernetes/au/syd1/csi/ceph-rbd-secret/read",
"kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read",
]
audience = "vault"
}

3
policies/kv/service/kubernetes/au/syd1/csi/ceph-cephfs-secret/read.hcl
View File

@ -1,3 +0,0 @@
path "kv/data/service/kubernetes/au/syd1/csi/ceph-cephfs-secret" {
capabilities = ["read"]
}