mirror of
https://github.com/hanzokms/terraform-provider.git
synced 2026-10-30 20:29:45 +00:00
62 lines
1.8 KiB
Terraform
62 lines
1.8 KiB
Terraform
terraform {
|
|
required_providers {
|
|
kms = {
|
|
# version = <latest version>
|
|
source = "hanzokms/kms"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "kms" {
|
|
host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
|
|
auth = {
|
|
universal = {
|
|
client_id = "<machine-identity-client-id>"
|
|
client_secret = "<machine-identity-client-secret>"
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
# Using normal API as token reviewer mode
|
|
resource "kms_identity" "machine-identity-demo-1" {
|
|
name = "machine-identity-demo-1"
|
|
role = "admin"
|
|
org_id = "<your-org-id>"
|
|
}
|
|
|
|
resource "kms_identity_kubernetes_auth" "kubernetes-auth-demo-1" {
|
|
identity_id = kms_identity.machine-identity-demo-1.id
|
|
kubernetes_host = "http://<your-kubernetes-host>"
|
|
token_reviewer_jwt = "ey<example>"
|
|
kubernetes_ca_certificate = "<your-kubernetes-ca-certificate>"
|
|
|
|
allowed_namespaces = ["kms-ns"]
|
|
allowed_service_account_names = ["kms-sa", "kms-sa-2"]
|
|
access_token_ttl = 2592000
|
|
access_token_max_ttl = 2592000
|
|
|
|
token_reviewer_mode = "api"
|
|
}
|
|
|
|
|
|
# Using gateway as token reviewer mode
|
|
resource "kms_identity" "machine-identity-demo-2" {
|
|
name = "machine-identity-demo-2"
|
|
role = "admin"
|
|
org_id = "<your-org-id>"
|
|
}
|
|
|
|
# When using gateway as reviewer, you do not need to specify the kubernetes host, token reviewer JWT, or CA certificate as they're all provided by the gateway.
|
|
resource "kms_identity_kubernetes_auth" "kubernetes-auth-demo-2" {
|
|
identity_id = kms_identity.machine-identity-demo-2.id
|
|
|
|
allowed_namespaces = ["kms-ns"]
|
|
allowed_service_account_names = ["kms-sa", "kms-sa-2"]
|
|
access_token_ttl = 2592000
|
|
access_token_max_ttl = 2592000
|
|
|
|
token_reviewer_mode = "gateway"
|
|
gateway_id = "<your-gateway-id>"
|
|
}
|