terraform-provider/docs/resources/identity_kubernetes_auth.md

page_title, subcategory, description

page_title	subcategory	description
kms_identity_kubernetes_auth Resource - terraform-provider	Identities	Create and manage identity kubernetes auth in Hanzo KMS.

kms_identity_kubernetes_auth (Resource)

Create and manage identity kubernetes auth in Hanzo KMS.

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}


# Using normal API as token reviewer mode
resource "kms_identity" "machine-identity-demo-1" {
  name   = "machine-identity-demo-1"
  role   = "admin"
  org_id = "<your-org-id>"
}

resource "kms_identity_kubernetes_auth" "kubernetes-auth-demo-1" {
  identity_id               = kms_identity.machine-identity-demo-1.id
  kubernetes_host           = "http://<your-kubernetes-host>"
  token_reviewer_jwt        = "ey<example>"
  kubernetes_ca_certificate = "<your-kubernetes-ca-certificate>"

  allowed_namespaces            = ["kms-ns"]
  allowed_service_account_names = ["kms-sa", "kms-sa-2"]
  access_token_ttl              = 2592000
  access_token_max_ttl          = 2592000

  token_reviewer_mode = "api"
}


# Using gateway as token reviewer mode
resource "kms_identity" "machine-identity-demo-2" {
  name   = "machine-identity-demo-2"
  role   = "admin"
  org_id = "<your-org-id>"
}

# When using gateway as reviewer, you do not need to specify the kubernetes host, token reviewer JWT, or CA certificate as they're all provided by the gateway.
resource "kms_identity_kubernetes_auth" "kubernetes-auth-demo-2" {
  identity_id = kms_identity.machine-identity-demo-2.id

  allowed_namespaces            = ["kms-ns"]
  allowed_service_account_names = ["kms-sa", "kms-sa-2"]
  access_token_ttl              = 2592000
  access_token_max_ttl          = 2592000

  token_reviewer_mode = "gateway"
  gateway_id          = "<your-gateway-id>"
}

Schema

Required

• identity_id (String) The ID of the identity to attach the configuration onto.

Optional

• access_token_max_ttl (Number) The maximum lifetime for an access token in seconds. This value will be referenced at renewal time. Default: 2592000
• access_token_num_uses_limit (Number) The maximum number of times that an access token can be used; a value of 0 implies infinite number of uses. Default:0
• access_token_trusted_ips (Attributes List) A list of IPs or CIDR ranges that access tokens can be used from. You can use 0.0.0.0/0, to allow usage from any network address.. (see below for nested schema)
• access_token_ttl (Number) The lifetime for an access token in seconds. This value will be referenced at renewal time. Default: 2592000
• allowed_audience (String) An optional audience claim that the service account JWT token must have to authenticate with Hanzo KMS.
• allowed_namespaces (List of String) List of trusted namespaces that service accounts must belong to authenticate with Hanzo KMS.
• allowed_service_account_names (List of String) List of trusted service account names that are allowed to authenticate with Hanzo KMS.
• gateway_id (String) Select a gateway for private cluster access. If not specified, the Internet Gateway will be used.
• kubernetes_ca_certificate (String) The PEM-encoded CA cert for the Kubernetes API server. This is used by the TLS client for secure communication with the Kubernetes API server.
• kubernetes_host (String) The host string, host:port pair, or URL to the base of the Kubernetes API server. This can usually be obtained by running kubectl cluster-info.
• token_reviewer_jwt (String) A long-lived service account JWT token for Hanzo KMS to access the TokenReview API to validate other service account JWT tokens submitted by applications/pods. This is the JWT token obtained from step 1.5.
• token_reviewer_mode (String) Choose between Token ('api') or 'gateway' authentication. If using Gateway, the Gateway must be deployed in your Kubernetes cluster.

Read-Only

• id (String) The ID of the kubernetes auth

Nested Schema for access_token_trusted_ips

Optional:

• ip_address (String)

Import

Import is supported using the following syntax:

# This will import the resource by its identity ID
terraform import kms_identity_kubernetes_auth.example <identity_id>