Ben Vincent
6624f7aed1
- Add Kubernetes secrets engine at kubernetes/au/syd1 path
- Create four RBAC roles with external YAML configuration:
* media-apps-operator: namespaced role for media-apps with selective permissions
* cluster-operator: cluster-wide read-only access to specific API groups
* cluster-admin: cluster-wide full access to specific API groups
* cluster-root: cluster-wide superuser access to all resources
- Add Vault policies for credential generation for each role
- Add admin policies for kubernetes auth backend configuration and role management
- Refactor kubernetes auth backend to use shared locals for CA certificate
- Update terraform-vault approle with required kubernetes policies
7 lines
158 B
HCL
7 lines
158 B
HCL
path "kubernetes/au/+/roles" {
|
|
capabilities = ["list"]
|
|
}
|
|
path "kubernetes/au/+/roles/*" {
|
|
capabilities = ["create", "update", "read", "delete", "list"]
|
|
}
|