准备 OpenBao 受鉴权监控与快照续期修复

2026-09-25 20:02:22 +00:00
parent 52322116f9
commit 005d8341ed
11 changed files with 202 additions and 10 deletions
@@ -0,0 +1,15 @@
+# 指标只读身份；vmagent 的 Bao Agent sidecar 使用 Pod SA 自动登录与续期。
+resource "vault_policy" "metrics" {
+  name   = "metrics"
+  policy = file("${path.module}/policies/metrics.hcl")
+}
+
+resource "vault_kubernetes_auth_backend_role" "metrics" {
+  backend                          = "kubernetes"
+  role_name                        = "metrics"
+  bound_service_account_names      = ["vmagent-main"]
+  bound_service_account_namespaces = ["monitoring"]
+  token_policies                   = [vault_policy.metrics.name]
+  token_ttl                        = 900
+  token_max_ttl                    = 3600
+}