45 lines
1.6 KiB
Terraform
45 lines
1.6 KiB
Terraform
# Policy bodies live in policies/*.hcl so they stay readable and diffable.
|
|
# Exported verbatim from the running instance, so importing produces no diff.
|
|
#
|
|
# OVERLAP WARNING: ../ansible (role openbao_bootstrap) also writes these — hence
|
|
# the "# Ansible managed" header still inside each file. Gate those Ansible tasks
|
|
# off before applying, or the two will overwrite each other on alternate runs.
|
|
resource "vault_policy" "admin" {
|
|
name = "admin"
|
|
policy = file("${path.module}/policies/admin.hcl")
|
|
}
|
|
|
|
resource "vault_policy" "ai_agent_ssh" {
|
|
name = "ai-agent-ssh"
|
|
policy = file("${path.module}/policies/ai-agent-ssh.hcl")
|
|
}
|
|
|
|
resource "vault_policy" "local_development" {
|
|
name = "local-development"
|
|
policy = file("${path.module}/policies/local-development.hcl")
|
|
}
|
|
|
|
resource "vault_policy" "spire_poc" {
|
|
name = "spire-poc"
|
|
policy = file("${path.module}/policies/spire-poc.hcl")
|
|
}
|
|
|
|
resource "vault_policy" "snapshot" {
|
|
name = "snapshot"
|
|
policy = file("${path.module}/policies/snapshot.hcl")
|
|
}
|
|
|
|
# Read-only kv/k8s/* for the External Secrets Operator. Unlike the three above
|
|
# this one is NOT also written by Ansible, so there is no overlap to gate off.
|
|
resource "vault_policy" "external_secrets" {
|
|
name = "external-secrets"
|
|
policy = file("${path.module}/policies/external-secrets.hcl")
|
|
}
|
|
|
|
# The sandbox cluster has its own Kubernetes auth backend and a deliberately
|
|
# narrower KV view than the homelab ESO instance.
|
|
resource "vault_policy" "sandbox_external_secrets" {
|
|
name = "sandbox-external-secrets"
|
|
policy = file("${path.module}/policies/sandbox-external-secrets.hcl")
|
|
}
|