JankySolutions/infra
2
0
Fork 0
Code Issues Pull requests 5 Projects Releases Packages 12 Wiki Activity Actions

vault mounts: drop test, create a more prod kv store

Browse source
This commit is contained in:
Finn 2024-09-10 12:11:33 -07:00
parent f497e9ba55
commit 2e16e58e6c
4 changed files with 10 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
tf/bao-auth-backends.tf
View file

@ -14,6 +14,6 @@ resource "vault_kubernetes_auth_backend_role" "k8s-default" {
bound_service_account_namespaces = ["*"] bound_service_account_namespaces = ["*"]
token_ttl = 3600 token_ttl = 3600
token_policies = [ token_policies = [
vault_policy.k8s_default_sa.name vault_policy.k8s_default.name
] ]
} }

6
tf/bao-mounts.tf
View file

@ -1,6 +1,6 @@
resource "vault_mount" "test-kv" { resource "vault_mount" "static_secrets" {
path = "test-kv" path = "static-secrets"
type = "kv" type = "kv"
options = { version = "2" } options = { version = "2" }
description = "Testing KV for evaluating how OpenBao works" description = "Static secrets, organized by <k8s-namespace>/<service-account>/*"
} }

7
tf/bao-policies.tf
View file

@ -1,5 +1,8 @@
resource "vault_policy" "k8s_default" { resource "vault_policy" "k8s_default" {
name = "k8s-default-sa" name = "k8s-default"
policy = templatefile("bao-policies/k8s-default.hcl", { k8s_auth_backend = vault_auth_backend.kubernetes.accessor }) policy = templatefile("bao-policies/k8s-default.hcl", {
k8s_auth_backend_accessor = vault_auth_backend.kubernetes.accessor,
k8s_secrets_path = vault_mount.static_secrets.path,
})
} }

2
tf/bao-policies/k8s-default.hcl
View file

@ -1,3 +1,3 @@
path "test-kv/data/{{identity.entity.aliases.${k8s_auth_backend}.metadata.service_account_namespace}}/*" { path "${k8s_secrets_path}/data/{{identity.entity.aliases.${k8s_auth_backend_accessor}.metadata.service_account_namespace}}/{{identity.entity.aliases.${k8s_auth_backend_accessor}.metadata.service_account_name}}/*" {
capabilities = ["read"] capabilities = ["read"]
} }