unkin/terraform-vault
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: unkin/terraform-vault:master
Branches Tags
unkin/terraform-vault:master unkin/terraform-vault:feature/forgebot-vault-access
..
compare: unkin/terraform-vault:a809e1c97faffa310d2045ef9b8d462d932ecb40
Branches Tags
unkin/terraform-vault:master unkin/terraform-vault:feature/forgebot-vault-access

1 Commits
master .. a809e1c97f

Author SHA1 Message Date
unkinben a809e1c97f feat: add pre-commit check in ci
ci/woodpecker/pr/pre-commit Pipeline failed
Details 
- add a ci workflow to verify pre-commit passes
- fix pre-commit errors/warnings:
  - missing required_version
  - missing required_providers
  - fixed terraform_deprecated_interpolation
  - removed terraform_unused_declarations
 2026-02-28 20:57:16 +11:00
93 changed files with 23 additions and 493 deletions
Expand all files Collapse all files
.woodpecker/apply.yaml
-23
View File
@@ -1,23 +0,0 @@
when:
- event: push
branch: master
steps:
- name: apply
image: git.unkin.net/unkin/almalinux9-opentofu:20260606
environment:
VAULT_AUTH_METHOD: kubernetes
commands:
- dnf install vault -y
- make plan
- make apply
backend_options:
kubernetes:
serviceAccountName: terraform-vault
resources:
requests:
memory: 512Mi
cpu: 1
limits:
memory: 2Gi
cpu: 2
.woodpecker/plan.yaml
-21
View File
@@ -1,21 +0,0 @@
when:
- event: pull_request
steps:
- name: plan
image: git.unkin.net/unkin/almalinux9-opentofu:20260606
environment:
VAULT_AUTH_METHOD: kubernetes
commands:
- dnf install vault -y
- make plan
backend_options:
kubernetes:
serviceAccountName: terraform-vault
resources:
requests:
memory: 512Mi
cpu: 1
limits:
memory: 2Gi
cpu: 2
.woodpecker/pre-commit.yaml
+2 -11
View File
@@ -3,16 +3,7 @@ when:
steps: steps:
- name: pre-commit - name: pre-commit
image: git.unkin.net/unkin/almalinux9-opentofu:20260606 image: git.unkin.net/unkin/almalinux9-base:latest
commands: commands:
- dnf install uv opentofu terragrunt tflint -y
- uvx pre-commit run --all-files - uvx pre-commit run --all-files
backend_options:
kubernetes:
serviceAccountName: default
resources:
requests:
memory: 512Mi
cpu: 1
limits:
memory: 2Gi
cpu: 2
Makefile
+2 -11
View File
@@ -1,19 +1,10 @@
.PHONY: init plan apply format .PHONY: init plan apply format
VAULT_AUTH_METHOD ?= approle
VAULT_K8S_ROLE ?= woodpecker_terraform_vault
VAULT_K8S_MOUNT ?= auth/k8s/au/syd1
VAULT_K8S_JWT_PATH ?= /var/run/secrets/kubernetes.io/serviceaccount/token
# Define vault_env function to set up vault environment # Define vault_env function to set up vault environment
define vault_env define vault_env
@export VAULT_ADDR="https://vault.service.consul:8200" && \ @export VAULT_ADDR="https://vault.service.consul:8200" && \
if [ "$(VAULT_AUTH_METHOD)" = "kubernetes" ]; then \ export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID) && \
export VAULT_TOKEN=$$(vault write -field=token $(VAULT_K8S_MOUNT)/login role=$(VAULT_K8S_ROLE) jwt=$$(cat $(VAULT_K8S_JWT_PATH))); \ export CONSUL_HTTP_TOKEN=$$(vault read -format=json consul_root/au/syd1/creds/terraform-vault | jq '.data.token')
else \
export VAULT_TOKEN=$$(vault write -field=token auth/approle/login role_id=$$VAULT_ROLEID); \
fi && \
export CONSUL_HTTP_TOKEN=$$(vault read -field=token consul_root/au/syd1/creds/terraform-vault)
endef endef
init: init:
config/auth_approle_role/approle/terraform_artifactapi.yaml
-9
View File
@@ -1,9 +0,0 @@
token_ttl: 120
token_max_ttl: 120
bind_secret_id: false
token_bound_cidrs:
- "10.10.12.200/32"
- "198.18.25.102/32"
- "198.18.26.91/32"
- "198.18.27.40/32"
use_deterministic_role_id: true
config/auth_approle_role/approle/terraform_authentik.yaml
-9
View File
@@ -1,9 +0,0 @@
token_ttl: 120
token_max_ttl: 120
bind_secret_id: false
token_bound_cidrs:
- "10.10.12.200/32"
- "198.18.25.102/32"
- "198.18.26.91/32"
- "198.18.27.40/32"
use_deterministic_role_id: true
config/auth_approle_role/approle/terraform_git.yaml
-9
View File
@@ -1,9 +0,0 @@
token_ttl: 120
token_max_ttl: 120
bind_secret_id: false
token_bound_cidrs:
- "10.10.12.200/32"
- "198.18.25.102/32"
- "198.18.26.91/32"
- "198.18.27.40/32"
use_deterministic_role_id: true
config/auth_approle_role/approle/terraform_prowlarr.yaml
-9
View File
@@ -1,9 +0,0 @@
token_ttl: 120
token_max_ttl: 120
bind_secret_id: false
token_bound_cidrs:
- "10.10.12.200/32"
- "198.18.25.102/32"
- "198.18.26.91/32"
- "198.18.27.40/32"
use_deterministic_role_id: true
config/auth_approle_role/approle/terraform_radarr.yaml
-9
View File
@@ -1,9 +0,0 @@
token_ttl: 120
token_max_ttl: 120
bind_secret_id: false
token_bound_cidrs:
- "10.10.12.200/32"
- "198.18.25.102/32"
- "198.18.26.91/32"
- "198.18.27.40/32"
use_deterministic_role_id: true
config/auth_approle_role/approle/terraform_sonarr.yaml
-9
View File
@@ -1,9 +0,0 @@
token_ttl: 120
token_max_ttl: 120
bind_secret_id: false
token_bound_cidrs:
- "10.10.12.200/32"
- "198.18.25.102/32"
- "198.18.26.91/32"
- "198.18.27.40/32"
use_deterministic_role_id: true
config/auth_kubernetes_role/k8s/au/syd1/artifactapi.yaml
-7
View File
@@ -1,7 +0,0 @@
bound_service_account_names:
- default
bound_service_account_namespaces:
- artifactapi
token_ttl: 600
token_max_ttl: 600
audience: vault
config/auth_kubernetes_role/k8s/au/syd1/default.yaml
-6
View File
@@ -1,6 +0,0 @@
bound_service_account_names:
- default
bound_service_account_namespaces: ['*']
token_ttl: 600
token_max_ttl: 600
audience: vault
config/auth_kubernetes_role/k8s/au/syd1/rpmbuilder.yaml
-8
View File
@@ -1,8 +0,0 @@
# rpmbuilder is deployed in woodpeckerci
bound_service_account_names:
- default
bound_service_account_namespaces:
- woodpecker
token_ttl: 600
token_max_ttl: 600
audience: https://kubernetes.default.svc.cluster.local
config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_artifactapi.yaml
-7
View File
@@ -1,7 +0,0 @@
bound_service_account_names:
- terraform-artifactapi
bound_service_account_namespaces:
- woodpecker
token_ttl: 600
token_max_ttl: 600
audience: https://kubernetes.default.svc.cluster.local
config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_authentik.yaml
-7
View File
@@ -1,7 +0,0 @@
bound_service_account_names:
- terraform-authentik
bound_service_account_namespaces:
- woodpecker
token_ttl: 600
token_max_ttl: 600
audience: https://kubernetes.default.svc.cluster.local
config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_git.yaml
-7
View File
@@ -1,7 +0,0 @@
bound_service_account_names:
- terraform-git
bound_service_account_namespaces:
- woodpecker
token_ttl: 600
token_max_ttl: 600
audience: https://kubernetes.default.svc.cluster.local
config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_prowlarr.yaml
-7
View File
@@ -1,7 +0,0 @@
bound_service_account_names:
- terraform-prowlarr
bound_service_account_namespaces:
- woodpecker
token_ttl: 600
token_max_ttl: 600
audience: https://kubernetes.default.svc.cluster.local
config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_radarr.yaml
-7
View File
@@ -1,7 +0,0 @@
bound_service_account_names:
- terraform-radarr
bound_service_account_namespaces:
- woodpecker
token_ttl: 600
token_max_ttl: 600
audience: https://kubernetes.default.svc.cluster.local
config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_sonarr.yaml
-7
View File
@@ -1,7 +0,0 @@
bound_service_account_names:
- terraform-sonarr
bound_service_account_namespaces:
- woodpecker
token_ttl: 600
token_max_ttl: 600
audience: https://kubernetes.default.svc.cluster.local
config/auth_kubernetes_role/k8s/au/syd1/woodpecker_terraform_vault.yaml
-7
View File
@@ -1,7 +0,0 @@
bound_service_account_names:
- terraform-vault
bound_service_account_namespaces:
- woodpecker
token_ttl: 600
token_max_ttl: 600
audience: https://kubernetes.default.svc.cluster.local
config/consul_secret_backend_role/consul_root/au/syd1/terraform-artifactapi.yaml
-5
View File
@@ -1,5 +0,0 @@
consul_roles:
- terraform-artifactapi
ttl: 120
max_ttl: 300
datacenters: []
config/consul_secret_backend_role/consul_root/au/syd1/terraform-authentik.yaml
-5
View File
@@ -1,5 +0,0 @@
consul_roles:
- terraform-authentik
ttl: 120
max_ttl: 300
datacenters: []
config/consul_secret_backend_role/consul_root/au/syd1/terraform-git.yaml
-5
View File
@@ -1,5 +0,0 @@
consul_roles:
- terraform-git
ttl: 120
max_ttl: 300
datacenters: []
config/consul_secret_backend_role/consul_root/au/syd1/terraform-prowlarr.yaml
-5
View File
@@ -1,5 +0,0 @@
consul_roles:
- terraform-prowlarr
ttl: 120
max_ttl: 300
datacenters: []
config/consul_secret_backend_role/consul_root/au/syd1/terraform-radarr.yaml
-5
View File
@@ -1,5 +0,0 @@
consul_roles:
- terraform-radarr
ttl: 120
max_ttl: 300
datacenters: []
config/consul_secret_backend_role/consul_root/au/syd1/terraform-sonarr.yaml
-5
View File
@@ -1,5 +0,0 @@
consul_roles:
- terraform-sonarr
ttl: 120
max_ttl: 300
datacenters: []
modules/vault_cluster/main.tf
+7 -5
View File
@@ -263,11 +263,12 @@ module "consul_secret_backend_role" {
for_each = var.consul_secret_backend_role for_each = var.consul_secret_backend_role
name = each.value.name name = each.value.name
backend = each.value.backend backend = each.value.backend
ttl = each.value.ttl consul_roles = each.value.consul_roles
max_ttl = each.value.max_ttl ttl = each.value.ttl
local = each.value.local max_ttl = each.value.max_ttl
local = each.value.local
depends_on = [module.consul_secret_backend, module.consul_acl_management] depends_on = [module.consul_secret_backend, module.consul_acl_management]
} }
@@ -320,6 +321,7 @@ module "pki_mount_only" {
path = each.key path = each.key
description = each.value.description description = each.value.description
max_lease_ttl_seconds = each.value.max_lease_ttl_seconds max_lease_ttl_seconds = each.value.max_lease_ttl_seconds
issuer_ref = each.value.issuer_ref
issuing_certificates = each.value.issuing_certificates issuing_certificates = each.value.issuing_certificates
crl_distribution_points = each.value.crl_distribution_points crl_distribution_points = each.value.crl_distribution_points
ocsp_servers = each.value.ocsp_servers ocsp_servers = each.value.ocsp_servers
modules/vault_cluster/modules/consul_secret_backend_role/variables.tf
+6
View File
@@ -9,6 +9,12 @@ variable "name" {
} }
variable "consul_roles" {
description = "List of Consul roles to attach to tokens"
type = list(string)
default = []
}
variable "ttl" { variable "ttl" {
description = "TTL for generated tokens" description = "TTL for generated tokens"
modules/vault_cluster/modules/pki_mount_only/variables.tf
+5
View File
@@ -13,6 +13,11 @@ variable "max_lease_ttl_seconds" {
type = number type = number
} }
variable "issuer_ref" {
description = "Reference to the PKI issuer (default, or issuer ID/name)"
type = string
default = "default"
}
variable "issuing_certificates" { variable "issuing_certificates" {
description = "List of URLs for issuing certificates" description = "List of URLs for issuing certificates"
modules/vault_cluster/variables.tf
+1
View File
@@ -203,6 +203,7 @@ variable "pki_mount_only" {
type = map(object({ type = map(object({
description = optional(string) description = optional(string)
max_lease_ttl_seconds = optional(number, 315360000) max_lease_ttl_seconds = optional(number, 315360000)
issuer_ref = optional(string, "default")
issuing_certificates = optional(list(string), []) issuing_certificates = optional(list(string), [])
crl_distribution_points = optional(list(string), []) crl_distribution_points = optional(list(string), [])
ocsp_servers = optional(list(string), []) ocsp_servers = optional(list(string), [])
policies/auth/approle/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/approle/login.yaml
-2
View File
@@ -8,5 +8,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/k8s/au/syd1/admin.yaml
-2
View File
@@ -21,5 +21,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/ldap/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/token/create.yaml
-2
View File
@@ -15,5 +15,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/token/lookup.yaml
-2
View File
@@ -9,5 +9,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/token/renew.yaml
-2
View File
@@ -8,5 +8,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/token/roles/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/auth/token/self.yaml
-2
View File
@@ -14,5 +14,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/consul_root/au/syd1/config/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/consul_root/au/syd1/creds/terraform-artifactapi.yaml
-11
View File
@@ -1,11 +0,0 @@
---
rules:
- path: "consul_root/au/syd1/creds/terraform-artifactapi"
capabilities:
- read
auth:
approle:
- terraform_artifactapi
k8s/au/syd1:
- woodpecker_terraform_artifactapi
policies/consul_root/au/syd1/creds/terraform-authentik.yaml
-11
View File
@@ -1,11 +0,0 @@
---
rules:
- path: "consul_root/au/syd1/creds/terraform-authentik"
capabilities:
- read
auth:
approle:
- terraform_authentik
k8s/au/syd1:
- woodpecker_terraform_authentik
policies/consul_root/au/syd1/creds/terraform-git.yaml
-11
View File
@@ -1,11 +0,0 @@
---
rules:
- path: "consul_root/au/syd1/creds/terraform-git"
capabilities:
- read
auth:
approle:
- terraform_git
k8s/au/syd1:
- woodpecker_terraform_git
policies/consul_root/au/syd1/creds/terraform-prowlarr.yaml
-11
View File
@@ -1,11 +0,0 @@
---
rules:
- path: "consul_root/au/syd1/creds/terraform-prowlarr"
capabilities:
- read
auth:
approle:
- terraform_prowlarr
k8s/au/syd1:
- woodpecker_terraform_prowlarr
policies/consul_root/au/syd1/creds/terraform-radarr.yaml
-11
View File
@@ -1,11 +0,0 @@
---
rules:
- path: "consul_root/au/syd1/creds/terraform-radarr"
capabilities:
- read
auth:
approle:
- terraform_radarr
k8s/au/syd1:
- woodpecker_terraform_radarr
policies/consul_root/au/syd1/creds/terraform-sonarr.yaml
-11
View File
@@ -1,11 +0,0 @@
---
rules:
- path: "consul_root/au/syd1/creds/terraform-sonarr"
capabilities:
- read
auth:
approle:
- terraform_sonarr
k8s/au/syd1:
- woodpecker_terraform_sonarr
policies/consul_root/au/syd1/creds/terraform-vault.yaml
-2
View File
@@ -8,5 +8,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/consul_root/au/syd1/roles/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kubernetes/au/config_admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kubernetes/au/roles_admin.yaml
-2
View File
@@ -15,5 +15,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kubernetes/au/syd1/creds/media-apps-operator.yaml
-2
View File
@@ -8,5 +8,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/config/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/kubernetes/default.yaml
-16
View File
@@ -1,16 +0,0 @@
# Templated access to kv secrets for kubernetes
#
# kv/kubernetes/namespace/<namespace>/<service_account>
# kv/kubernetes/cluster/<cluster>/<namespace>/<service_account>
---
rules:
- path: "kv/data/kubernetes/namespace/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_namespace}}/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_name}}/*"
capabilities:
- read
- path: "kv/data/kubernetes/cluster/au/syd1/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_namespace}}/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_name}}/*"
capabilities:
- read
auth:
k8s/au/syd1:
- default
policies/kv/service/artifactapi/environment/read.yaml
-10
View File
@@ -1,10 +0,0 @@
# Allow reading environment variables for artifactapi
---
rules:
- path: "kv/data/service/artifactapi/environment"
capabilities:
- read
auth:
k8s/au/syd1:
- artifactapi
policies/kv/service/artifactapi/postgres-password/read.yaml
-10
View File
@@ -1,10 +0,0 @@
# Allow reading environment vars for postgres/artifactapi
---
rules:
- path: "kv/data/service/artifactapi/postgres-password"
capabilities:
- read
auth:
k8s/au/syd1:
- artifactapi
policies/kv/service/gitea/gitadmin/tokens/terraform-git/read.yaml
-12
View File
@@ -1,12 +0,0 @@
# Allow reading Gitea admin token
---
rules:
- path: "kv/data/service/gitea/gitadmin/tokens/terraform-git"
capabilities:
- read
auth:
approle:
- terraform_git
k8s/au/syd1:
- woodpecker_terraform_git
policies/kv/service/gitea/unkinben/tokens/read-only-packages/read.yaml
-2
View File
@@ -8,5 +8,3 @@ rules:
auth: auth:
approle: approle:
- rpmbuilder - rpmbuilder
k8s/au/syd1:
- rpmbuilder
policies/kv/service/github/neoloc/tokens/read-only-token/read.yaml
-2
View File
@@ -8,5 +8,3 @@ rules:
auth: auth:
approle: approle:
- rpmbuilder - rpmbuilder
k8s/au/syd1:
- rpmbuilder
policies/kv/service/glauth/services/svc_vault/read.yaml
-2
View File
@@ -9,5 +9,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/kubernetes/au/syd1/service_account_jwt/read.yaml
-2
View File
@@ -8,5 +8,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/kubernetes/au/syd1/token_reviewer_jwt/read.yaml
-2
View File
@@ -8,5 +8,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/media-apps/prowlarr/read.yaml
-3
View File
@@ -6,8 +6,5 @@ rules:
- read - read
auth: auth:
approle:
- terraform_prowlarr
k8s/au/syd1: k8s/au/syd1:
- media-apps - media-apps
- woodpecker_terraform_prowlarr
policies/kv/service/media-apps/radarr/read.yaml
-3
View File
@@ -6,8 +6,5 @@ rules:
- read - read
auth: auth:
approle:
- terraform_radarr
k8s/au/syd1: k8s/au/syd1:
- media-apps - media-apps
- woodpecker_terraform_radarr
policies/kv/service/media-apps/sonarr/read.yaml
-3
View File
@@ -6,8 +6,5 @@ rules:
- read - read
auth: auth:
approle:
- terraform_sonarr
k8s/au/syd1: k8s/au/syd1:
- media-apps - media-apps
- woodpecker_terraform_sonarr
policies/kv/service/vault/auth_approle_roles_read.yaml
-2
View File
@@ -9,5 +9,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/vault/auth_backends_read.yaml
-2
View File
@@ -9,5 +9,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/vault/secret_backends_read.yaml
-2
View File
@@ -9,5 +9,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/kv/service/woodpecker/tokens/gitadmin.yaml
-11
View File
@@ -1,11 +0,0 @@
---
rules:
- path: "kv/data/service/woodpecker/tokens/gitadmin"
capabilities:
- read
auth:
approle:
- terraform_git
k8s/au/syd1:
- woodpecker_terraform_git
policies/kv/service/woodpecker/woodpecker-agent-secret/read.yaml
-10
View File
@@ -1,10 +0,0 @@
# Allow reading woodpecker agent secret for auto joining more agents
---
rules:
- path: "kv/data/service/woodpecker/woodpecker-agent-secret"
capabilities:
- read
auth:
k8s/au/syd1:
- woodpecker
policies/pki/au/syd1/config/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki/au/syd1/issuer/admin.yaml
-2
View File
@@ -9,5 +9,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki/au/syd1/roles/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_int/config/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_int/issuer/admin.yaml
-2
View File
@@ -9,5 +9,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_int/roles/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_root/config/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_root/issuer/admin.yaml
-2
View File
@@ -9,5 +9,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/pki_root/roles/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/rundeck/config/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/sshca/config/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/sshca/roles/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/sys/auth/admin.yaml
-2
View File
@@ -12,5 +12,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/sys/mounts/admin.yaml
-2
View File
@@ -20,5 +20,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/sys/policy/admin.yaml
-2
View File
@@ -16,5 +16,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
policies/transit/keys/admin.yaml
-2
View File
@@ -16,5 +16,3 @@ rules:
auth: auth:
approle: approle:
- tf_vault - tf_vault
k8s/au/syd1:
- woodpecker_terraform_vault
resources/secret_backend/consul_root/au/syd1/terraform-artifactapi.hcl
-7
View File
@@ -1,7 +0,0 @@
key_prefix "infra/terraform/artifactapi/" {
policy = "write"
}
session_prefix "" {
policy = "write"
}
resources/secret_backend/consul_root/au/syd1/terraform-authentik.hcl
-7
View File
@@ -1,7 +0,0 @@
key_prefix "infra/terraform/authentik/" {
policy = "write"
}
session_prefix "" {
policy = "write"
}
resources/secret_backend/consul_root/au/syd1/terraform-git.hcl
-7
View File
@@ -1,7 +0,0 @@
key_prefix "infra/terraform/git/" {
policy = "write"
}
session_prefix "" {
policy = "write"
}
resources/secret_backend/consul_root/au/syd1/terraform-prowlarr.hcl
-7
View File
@@ -1,7 +0,0 @@
key_prefix "infra/terraform/prowlarr/" {
policy = "write"
}
session_prefix "" {
policy = "write"
}
resources/secret_backend/consul_root/au/syd1/terraform-radarr.hcl
-7
View File
@@ -1,7 +0,0 @@
key_prefix "infra/terraform/radarr/" {
policy = "write"
}
session_prefix "" {
policy = "write"
}
resources/secret_backend/consul_root/au/syd1/terraform-sonarr.hcl
-7
View File
@@ -1,7 +0,0 @@
key_prefix "infra/terraform/sonarr/" {
policy = "write"
}
session_prefix "" {
policy = "write"
}
resources/secret_backend/kubernetes/au/syd1/roles/cluster-admin.yaml
-1
View File
@@ -21,7 +21,6 @@ rules:
- "logstash.k8s.elastic.co" - "logstash.k8s.elastic.co"
- "elasticsearch.k8s.elastic.co" - "elasticsearch.k8s.elastic.co"
- "kibana.k8s.elastic.co" - "kibana.k8s.elastic.co"
- "gateway.networking.k8s.io"
resources: resources:
- "*" - "*"
verbs: verbs:
resources/secret_backend/kubernetes/au/syd1/roles/cluster-operator.yaml
-1
View File
@@ -21,7 +21,6 @@ rules:
- "logstash.k8s.elastic.co" - "logstash.k8s.elastic.co"
- "elasticsearch.k8s.elastic.co" - "elasticsearch.k8s.elastic.co"
- "kibana.k8s.elastic.co" - "kibana.k8s.elastic.co"
- "gateway.networking.k8s.io"
resources: resources:
- "*" - "*"
verbs: verbs: