unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add cert-manager clouddns KV read access for VSO #108

Closed
unkinben wants to merge 1 commits from benvin/certmanager-clouddns-kv into master
pull from: benvin/certmanager-clouddns-kv
merge into: unkin:master
Conversation 1 Commits 1 Files Changed 2
+17
unkinben commented 2026-08-02 17:04:43 +10:00
Owner
Copy Link
Copy Source

cert-manager needs a Google Cloud DNS service-account key to solve Let's Encrypt DNS-01 challenges for publicly-trusted wildcard certs (unkin.net public DNS is on Google Cloud DNS). VSO syncs that key from Vault KV into the cert-manager namespace.

  • Add k8s auth role cert_manager_clouddns bound to SA cert-manager-clouddns in the cert-manager namespace (audience vault, ttl 600).
  • Add policy granting read on kv/service/kubernetes/au/syd1/cert-manager/clouddns, bound to that role.

The KV value (GCP SA JSON key) is seeded out-of-band, not by terraform.

cert-manager needs a Google Cloud DNS service-account key to solve Let's Encrypt DNS-01 challenges for publicly-trusted wildcard certs (unkin.net public DNS is on Google Cloud DNS). VSO syncs that key from Vault KV into the cert-manager namespace. - Add k8s auth role `cert_manager_clouddns` bound to SA `cert-manager-clouddns` in the `cert-manager` namespace (audience vault, ttl 600). - Add policy granting read on `kv/service/kubernetes/au/syd1/cert-manager/clouddns`, bound to that role. The KV value (GCP SA JSON key) is seeded out-of-band, not by terraform.
unkinben added 1 commit 2026-08-02 17:04:44 +10:00
Add cert-manager clouddns KV read access for VSO
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ea380b9417 
cert-manager needs a Google Cloud DNS service-account key to solve
Let's Encrypt DNS-01 challenges for publicly-trusted certs. VSO syncs it
from Vault KV, so the cert-manager namespace needs its own k8s auth role
and a policy granting read on the KV path.

- Add k8s auth role cert_manager_clouddns bound to SA
  cert-manager-clouddns in the cert-manager namespace.
- Add policy granting read on
  kv/service/kubernetes/au/syd1/cert-manager/clouddns, bound to that role.

Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT
unkinben commented 2026-08-02 17:22:18 +10:00
Author
Owner
Copy Link
Copy Source

Superseded by the RFC2136/TSIG approach: cert-manager will solve DNS-01 against a new bind-external zone (acme.unkin.net) via a delegated CNAME, so no clouddns KV secret and no Vault auth role/policy are needed. Closing.

Superseded by the RFC2136/TSIG approach: cert-manager will solve DNS-01 against a new bind-external zone (acme.unkin.net) via a delegated CNAME, so no clouddns KV secret and no Vault auth role/policy are needed. Closing.
unkinben closed this pull request 2026-08-02 17:22:18 +10:00
All checks were successful
ci/woodpecker/pr/plan Pipeline was successful
Required
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#108
Delete Branch "benvin/certmanager-clouddns-kv"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?