feat: 纳管共享 etcd 与 k3s 外 PostgreSQL 高可用及备份

2026-09-25 19:34:48 +00:00
parent acd4b55722
commit 3a2fe5fa0c
92 changed files with 4211 additions and 0 deletions
@@ -0,0 +1,35 @@
+# 复用现有 JWT-SVID 验证挂载，独立身份仅授权此服务所需路径。
+resource "vault_policy" "postgresql" {
+  name   = "homelab-postgresql-provisioner"
+  policy = <<-EOT
+    path "pki/sign/homelab-pg-prod" { capabilities = ["update"] }
+    path "pki/sign/homelab-pg-dev" { capabilities = ["update"] }
+    path "pki/sign/homelab-etcd-client" { capabilities = ["update"] }
+    path "kv/data/infra/postgresql/prod" { capabilities = ["create", "read", "update"] }
+    path "kv/data/infra/postgresql/dev" { capabilities = ["create", "read", "update"] }
+    path "kv/metadata/infra/postgresql/prod" { capabilities = ["read"] }
+    path "kv/metadata/infra/postgresql/dev" { capabilities = ["read"] }
+    path "kv/data/infra/etcd/consumers/patroni-pg-prod" { capabilities = ["read"] }
+    path "kv/data/infra/postgresql/ayatori/prod" { capabilities = ["create", "read", "update"] }
+    path "kv/data/infra/postgresql/ayatori/dev" { capabilities = ["create", "read", "update"] }
+    path "kv/metadata/infra/postgresql/ayatori/prod" { capabilities = ["read"] }
+    path "kv/metadata/infra/postgresql/ayatori/dev" { capabilities = ["read"] }
+    path "auth/token/lookup-self" { capabilities = ["read"] }
+    path "auth/token/revoke-self" { capabilities = ["update"] }
+  EOT
+}
+
+resource "vault_jwt_auth_backend_role" "postgresql" {
+  backend         = "jwt-spire"
+  role_name       = "homelab-postgresql"
+  role_type       = "jwt"
+  user_claim      = "sub"
+  bound_audiences = ["openbao"]
+  bound_claims = {
+    sub = "spiffe://ddupan.top/dev/panxiao81"
+  }
+  token_policies          = [vault_policy.postgresql.name]
+  token_no_default_policy = true
+  token_ttl               = 900
+  token_max_ttl           = 900
+}