refactor: reorganize GitOps control plane

iac/terraform/modules/vault-kubernetes-roles/main.tf

@@ -0,0 +1,11 @@
+resource "vault_kubernetes_auth_backend_role" "this" {
+  for_each = var.roles
+
+  audience                         = one(each.value.audiences)
+  backend                          = var.backend
+  bound_service_account_names      = each.value.service_account_names
+  bound_service_account_namespaces = each.value.service_account_namespaces
+  role_name                        = each.key
+  token_policies                   = each.value.token_policies
+  token_ttl                        = each.value.token_ttl
+}

iac/terraform/modules/vault-kubernetes-roles/variables.tf

@@ -0,0 +1,15 @@
+variable "backend" {
+  description = "Kubernetes auth backend path."
+  type        = string
+}
+
+variable "roles" {
+  description = "Kubernetes auth roles keyed by Vault role name."
+  type = map(object({
+    audiences                  = set(string)
+    service_account_names      = set(string)
+    service_account_namespaces = set(string)
+    token_policies             = set(string)
+    token_ttl                  = number
+  }))
+}

iac/terraform/modules/vault-kubernetes-roles/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.11.0"
+
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 5.7.0"
+    }
+  }
+}

iac/terraform/modules/vault-policy-set/main.tf

@@ -0,0 +1,11 @@
+resource "vault_policy" "this" {
+  for_each = var.policies
+
+  name   = each.key
+  policy = each.value
+}
+
+output "names" {
+  description = "Policy names keyed by their requested names."
+  value       = { for name, policy in vault_policy.this : name => policy.name }
+}

iac/terraform/modules/vault-policy-set/variables.tf

@@ -0,0 +1,4 @@
+variable "policies" {
+  description = "Map of Vault policy names to HCL policy documents."
+  type        = map(string)
+}

iac/terraform/modules/vault-policy-set/versions.tf

@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.11.0"
+
+  required_providers {
+    vault = {
+      source  = "hashicorp/vault"
+      version = "~> 5.7.0"
+    }
+  }
+}