Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 unkinben
|
b0d1938ecf |
@@ -1,23 +0,0 @@
|
||||
when:
|
||||
- event: push
|
||||
branch: master
|
||||
|
||||
steps:
|
||||
- name: apply
|
||||
image: git.unkin.net/unkin/almalinux9-opentofu:20260606
|
||||
environment:
|
||||
VAULT_AUTH_METHOD: kubernetes
|
||||
commands:
|
||||
- dnf install vault -y
|
||||
- make plan
|
||||
- make apply
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: terraform-vault
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 1
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 2
|
||||
@@ -1,21 +0,0 @@
|
||||
when:
|
||||
- event: pull_request
|
||||
|
||||
steps:
|
||||
- name: plan
|
||||
image: git.unkin.net/unkin/almalinux9-opentofu:20260606
|
||||
environment:
|
||||
VAULT_AUTH_METHOD: kubernetes
|
||||
commands:
|
||||
- dnf install vault -y
|
||||
- make plan
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: terraform-vault
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 1
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 2
|
||||
@@ -3,16 +3,7 @@ when:
|
||||
|
||||
steps:
|
||||
- name: pre-commit
|
||||
image: git.unkin.net/unkin/almalinux9-opentofu:20260606
|
||||
image: git.unkin.net/unkin/almalinux9-base:latest
|
||||
commands:
|
||||
- dnf install uv opentofu terragrunt tflint -y
|
||||
- uvx pre-commit run --all-files
|
||||
backend_options:
|
||||
kubernetes:
|
||||
serviceAccountName: default
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 1
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 2
|
||||
|
||||
@@ -1,19 +1,10 @@
|
||||
.PHONY: init plan apply format
|
||||
|
||||
VAULT_AUTH_METHOD ?= approle
|
||||
VAULT_K8S_ROLE ?= woodpecker_terraform_vault
|
||||
VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
|
||||
VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
|
||||
# Define vault_env function to set up vault environment
|
||||
define vault_env
|
||||
@export VAULT_ADDR="https://vault.service.consul:8200" && \
|
||||
if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \
|
||||
export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \
|
||||
else \
|
||||
export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
|
||||
fi && \
|
||||
export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-vault)
|
||||
export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID) && \
|
||||
export CONSUL_HTTP_TOKEN=$$(vault read -format=json consul_root/au/syd1/creds/terraform-vault | jq '.data.token')
|
||||
endef
|
||||
|
||||
init:
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
token_ttl: 120
|
||||
token_max_ttl: 120
|
||||
bind_secret_id: false
|
||||
token_bound_cidrs:
|
||||
- "10.10.12.200/32"
|
||||
- "198.18.25.102/32"
|
||||
- "198.18.26.91/32"
|
||||
- "198.18.27.40/32"
|
||||
use_deterministic_role_id: true
|
||||
@@ -1,6 +0,0 @@
|
||||
bound_service_account_names:
|
||||
- default
|
||||
bound_service_account_namespaces: ['*']
|
||||
token_ttl: 600
|
||||
token_max_ttl: 600
|
||||
audience: vault
|
||||
@@ -1,8 +0,0 @@
|
||||
bound_service_account_names:
|
||||
- default
|
||||
- forgebot-operator
|
||||
bound_service_account_namespaces:
|
||||
- forgebot
|
||||
token_ttl: 600
|
||||
token_max_ttl: 600
|
||||
audience: vault
|
||||
@@ -1,8 +0,0 @@
|
||||
# rpmbuilder is deployed in woodpeckerci
|
||||
bound_service_account_names:
|
||||
- default
|
||||
bound_service_account_namespaces:
|
||||
- woodpecker
|
||||
token_ttl: 600
|
||||
token_max_ttl: 600
|
||||
audience: https://kubernetes.default.svc.cluster.local
|
||||
@@ -1,7 +0,0 @@
|
||||
bound_service_account_names:
|
||||
- terraform-git
|
||||
bound_service_account_namespaces:
|
||||
- woodpecker
|
||||
token_ttl: 600
|
||||
token_max_ttl: 600
|
||||
audience: https://kubernetes.default.svc.cluster.local
|
||||
@@ -1,7 +0,0 @@
|
||||
bound_service_account_names:
|
||||
- terraform-vault
|
||||
bound_service_account_namespaces:
|
||||
- woodpecker
|
||||
token_ttl: 600
|
||||
token_max_ttl: 600
|
||||
audience: https://kubernetes.default.svc.cluster.local
|
||||
@@ -1,5 +0,0 @@
|
||||
consul_roles:
|
||||
- terraform-git
|
||||
ttl: 120
|
||||
max_ttl: 300
|
||||
datacenters: []
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -8,5 +8,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -21,5 +21,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -15,5 +15,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -9,5 +9,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -8,5 +8,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -14,5 +14,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
rules:
|
||||
- path: "consul_root/au/syd1/creds/terraform-git"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- terraform_git
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_git
|
||||
@@ -8,5 +8,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -15,5 +15,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -8,5 +8,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -1,16 +0,0 @@
|
||||
# Templated access to kv secrets for kubernetes
|
||||
#
|
||||
# kv/kubernetes/namespace/<namespace>/<service_account>
|
||||
# kv/kubernetes/cluster/<cluster>/<namespace>/<service_account>
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/kubernetes/namespace/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_namespace}}/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_name}}/*"
|
||||
capabilities:
|
||||
- read
|
||||
- path: "kv/data/kubernetes/cluster/au/syd1/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_namespace}}/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_name}}/*"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- default
|
||||
@@ -1,10 +0,0 @@
|
||||
# Allow reading environment vars for postgres/artifactapi
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/artifactapi/postgres-password"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- artifactapi
|
||||
@@ -1,9 +0,0 @@
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/kubernetes/namespace/forgebot/*"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
k8s/au/syd1:
|
||||
- forgebot
|
||||
@@ -1,12 +0,0 @@
|
||||
# Allow reading Gitea admin token
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/gitea/gitadmin/tokens/terraform-git"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- terraform_git
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_git
|
||||
@@ -8,5 +8,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- rpmbuilder
|
||||
k8s/au/syd1:
|
||||
- rpmbuilder
|
||||
|
||||
@@ -8,5 +8,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- rpmbuilder
|
||||
k8s/au/syd1:
|
||||
- rpmbuilder
|
||||
|
||||
@@ -9,5 +9,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -8,5 +8,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -8,5 +8,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -9,5 +9,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -9,5 +9,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -9,5 +9,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
---
|
||||
rules:
|
||||
- path: "kv/data/service/woodpecker/tokens/gitadmin"
|
||||
capabilities:
|
||||
- read
|
||||
|
||||
auth:
|
||||
approle:
|
||||
- terraform_git
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_git
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -9,5 +9,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -9,5 +9,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -9,5 +9,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -12,5 +12,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -20,5 +20,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -16,5 +16,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -16,5 +16,3 @@ rules:
|
||||
auth:
|
||||
approle:
|
||||
- tf_vault
|
||||
k8s/au/syd1:
|
||||
- woodpecker_terraform_vault
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
key_prefix "infra/terraform/git/" {
|
||||
policy = "write"
|
||||
}
|
||||
|
||||
session_prefix "" {
|
||||
policy = "write"
|
||||
}
|
||||
@@ -21,7 +21,6 @@ rules:
|
||||
- "logstash.k8s.elastic.co"
|
||||
- "elasticsearch.k8s.elastic.co"
|
||||
- "kibana.k8s.elastic.co"
|
||||
- "gateway.networking.k8s.io"
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
|
||||
@@ -21,7 +21,6 @@ rules:
|
||||
- "logstash.k8s.elastic.co"
|
||||
- "elasticsearch.k8s.elastic.co"
|
||||
- "kibana.k8s.elastic.co"
|
||||
- "gateway.networking.k8s.io"
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
|
||||
Reference in New Issue
Block a user