refactor(gitops): establish platform ownership boundaries

2026-07-26 01:34:29 +09:00
parent 293ee6fc97
commit a6f6c663e0
121 changed files with 2801 additions and 1204 deletions
@@ -0,0 +1,71 @@
+variable "ci_database_bound_claims" {
+  description = "Exact repository, protected-ref, and database-job claims for the database role."
+  type        = map(string)
+  default     = {}
+}
+
+variable "ci_jwt_bound_audiences" {
+  description = "Exact CI JWT audiences."
+  type        = set(string)
+  default     = []
+}
+
+variable "ci_jwt_bound_issuer" {
+  description = "Expected CI JWT issuer."
+  type        = string
+  default     = null
+  nullable    = true
+}
+
+variable "ci_jwt_oidc_discovery_url" {
+  description = "CI OIDC discovery URL. Null leaves external CI authentication disabled."
+  type        = string
+  default     = null
+  nullable    = true
+}
+
+variable "ci_jwt_user_claim" {
+  description = "JWT claim used as the Vault identity alias."
+  type        = string
+  default     = "sub"
+}
+
+variable "ci_token_ttl_seconds" {
+  description = "Maximum lifetime for delegated CI tokens."
+  type        = number
+  default     = 1800
+
+  validation {
+    condition = (
+      var.ci_token_ttl_seconds >= 60 &&
+      var.ci_token_ttl_seconds <= 3600 &&
+      floor(var.ci_token_ttl_seconds) == var.ci_token_ttl_seconds
+    )
+    error_message = "ci_token_ttl_seconds must be a whole number between 60 and 3600."
+  }
+}
+
+variable "ci_workloads_bound_claims" {
+  description = "Exact repository, protected-ref, and workloads-job claims for the workloads role."
+  type        = map(string)
+  default     = {}
+}
+
+variable "kubernetes_host" {
+  description = "Kubernetes TokenReview API address."
+  type        = string
+  default     = "https://kubernetes.default.svc.cluster.local:443"
+}
+
+variable "vault_addr" {
+  description = "Vault API address reachable by the foundation operator."
+  type        = string
+  default     = "http://127.0.0.1:8200"
+}
+
+variable "vault_token" {
+  description = "Short-lived bootstrap or security-administrator token."
+  type        = string
+  sensitive   = true
+  ephemeral   = true
+}