接入 OpenBao 受鉴权监控并修复快照续期 (#162)

Co-authored-by: panxiao81 <[email protected]>

infrastructure/openbao/terraform/imports.tf

@@ -68,3 +68,14 @@ import {
   to = vault_pki_secret_backend_config_urls.this
   id = "pki/config/urls"
 }
+
+# 本次维护预检先通过同名 API 配置验证，后续 Terraform 纳入既有主 state。
+import {
+  to = vault_policy.metrics
+  id = "metrics"
+}
+
+import {
+  to = vault_kubernetes_auth_backend_role.metrics
+  id = "auth/kubernetes/role/metrics"
+}

infrastructure/openbao/terraform/monitoring.tf

@@ -0,0 +1,15 @@
+# 指标只读身份；vmagent 的 Bao Agent sidecar 使用 Pod SA 自动登录与续期。
+resource "vault_policy" "metrics" {
+  name   = "metrics"
+  policy = file("${path.module}/policies/metrics.hcl")
+}
+
+resource "vault_kubernetes_auth_backend_role" "metrics" {
+  backend                          = "kubernetes"
+  role_name                        = "metrics"
+  bound_service_account_names      = ["vmagent-main"]
+  bound_service_account_namespaces = ["monitoring"]
+  token_policies                   = [vault_policy.metrics.name]
+  token_ttl                        = 900
+  token_max_ttl                    = 3600
+}

infrastructure/openbao/terraform/policies/metrics.hcl

@@ -0,0 +1,4 @@
+# 不含秘密读取或管理权限；默认 policy 只用于自身 token 续期等通用能力。
+path "sys/metrics" {
+  capabilities = ["read"]
+}