Ben Vincent
6624f7aed1
- Add Kubernetes secrets engine at kubernetes/au/syd1 path
- Create four RBAC roles with external YAML configuration:
* media-apps-operator: namespaced role for media-apps with selective permissions
* cluster-operator: cluster-wide read-only access to specific API groups
* cluster-admin: cluster-wide full access to specific API groups
* cluster-root: cluster-wide superuser access to all resources
- Add Vault policies for credential generation for each role
- Add admin policies for kubernetes auth backend configuration and role management
- Refactor kubernetes auth backend to use shared locals for CA certificate
- Update terraform-vault approle with required kubernetes policies
24 lines
464 B
YAML
24 lines
464 B
YAML
---
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
- "postgresql.cnpg.io"
|
|
- "cert-manager.io"
|
|
- "rbac.authorization.k8s.io"
|
|
- "batch"
|
|
- "secrets.hashicorp.com"
|
|
- "storage.k8s.io"
|
|
- "apps"
|
|
- "apiextensions.k8s.io"
|
|
- "externaldns.k8s.io"
|
|
- "autoscaling"
|
|
- "networking.k8s.io"
|
|
- "purelb.io"
|
|
- "nfd.k8s-sigs.io"
|
|
- "policy"
|
|
- "metrics.k8s.io"
|
|
resources:
|
|
- "*"
|
|
verbs:
|
|
- "*"
|