unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin/terraform-vault:625f691a142f6f58b484894f5943b6c5041eb702
Branches Tags
unkin/terraform-vault:master unkin/terraform-vault:feature/forgebot-vault-access
...
compare: unkin/terraform-vault:48a4fd0dd1c9e821229dbf24b0bcaf6da4eb4353
Branches Tags
unkin/terraform-vault:master unkin/terraform-vault:feature/forgebot-vault-access

3 Commits
625f691a14 ... 48a4fd0dd1

Author SHA1 Message Date
unkinben 48a4fd0dd1 feat: add templated policies for kubernetes
ci/woodpecker/pr/pre-commit Pipeline was successful
Details 
- add default kubernetes auth role
- add templated access kv/kubernetes/*
 2026-03-08 12:48:08 +11:00
unkinben 4dc09547ef Merge pull request 'fix: update audience for rpmbuilder' (#65) from benvin/default_aud into master 
Reviewed-on: #65
 2026-03-08 12:29:43 +11:00
unkinben 546a9efe44 fix: update audience for rpmbuilder
ci/woodpecker/pr/pre-commit Pipeline was successful
Details 
when using using the service account jwt directly, the default audience
is the api servers url
 2026-03-07 11:31:36 +11:00
3 changed files with 23 additions and 1 deletions
Expand all files Collapse all files
config/auth_kubernetes_role/k8s/au/syd1/default.yaml
+6
View File
@@ -0,0 +1,6 @@
bound_service_account_names:
- default
bound_service_account_namespaces: ['*']
token_ttl: 600
token_max_ttl: 600
audience: vault
config/auth_kubernetes_role/k8s/au/syd1/rpmbuilder.yaml
+1 -1
View File
@@ -5,4 +5,4 @@ bound_service_account_namespaces:
- woodpecker
token_ttl: 600
token_max_ttl: 600
audience: vault
audience: https://kubernetes.default.svc.cluster.local
policies/kv/kubernetes/default.yaml
+16
View File
@@ -0,0 +1,16 @@
# Templated access to kv secrets for kubernetes
#
# kv/kubernetes/namespace/<namespace>/<service_account>
# kv/kubernetes/cluster/<cluster>/<namespace>/<service_account>
---
rules:
- path: "kv/data/kubernetes/namespace/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_namespace}}/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_name}}/*"
capabilities:
- read
- path: "kv/data/kubernetes/cluster/au/syd1/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_namespace}}/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_name}}/*"
capabilities:
- read
auth:
k8s/au/syd1:
- default