47 lines
1.3 KiB
Terraform
47 lines
1.3 KiB
Terraform
resource "kubernetes_role" "gitea_ssh_access" {
|
|
metadata {
|
|
name = "gitea-ssh-access"
|
|
namespace = kubernetes_namespace.gitea.metadata[0].name
|
|
}
|
|
rule {
|
|
api_groups = [""]
|
|
resources = ["pods", "pods/log"]
|
|
verbs = ["get", "list"]
|
|
}
|
|
rule {
|
|
api_groups = [""]
|
|
resources = ["pods/exec"]
|
|
verbs = ["create"]
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_role_binding" "gitea_ssh_access" {
|
|
metadata {
|
|
name = "gitea-ssh-access"
|
|
namespace = kubernetes_namespace.gitea.metadata[0].name
|
|
}
|
|
role_ref {
|
|
api_group = "rbac.authorization.k8s.io"
|
|
kind = "Role"
|
|
name = kubernetes_role.gitea_ssh_access.metadata[0].name
|
|
}
|
|
subject {
|
|
kind = "ServiceAccount"
|
|
name = kubernetes_service_account.gitea_service_account.metadata[0].name
|
|
namespace = kubernetes_namespace.gitea.metadata[0].name
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_secret" "gitea_access_token" {
|
|
metadata {
|
|
annotations = {
|
|
"kubernetes.io/service-account.name" = kubernetes_service_account.gitea_service_account.metadata[0].name
|
|
}
|
|
name = "git-token"
|
|
namespace = kubernetes_namespace.gitea.metadata[0].name
|
|
}
|
|
|
|
type = "kubernetes.io/service-account-token"
|
|
wait_for_service_account_token = true
|
|
}
|