72 lines
1.9 KiB
Terraform
72 lines
1.9 KiB
Terraform
variable "ci_database_bound_claims" {
|
|
description = "Exact repository, protected-ref, and database-job claims for the database role."
|
|
type = map(string)
|
|
default = {}
|
|
}
|
|
|
|
variable "ci_jwt_bound_audiences" {
|
|
description = "Exact CI JWT audiences."
|
|
type = set(string)
|
|
default = []
|
|
}
|
|
|
|
variable "ci_jwt_bound_issuer" {
|
|
description = "Expected CI JWT issuer."
|
|
type = string
|
|
default = null
|
|
nullable = true
|
|
}
|
|
|
|
variable "ci_jwt_oidc_discovery_url" {
|
|
description = "CI OIDC discovery URL. Null leaves external CI authentication disabled."
|
|
type = string
|
|
default = null
|
|
nullable = true
|
|
}
|
|
|
|
variable "ci_jwt_user_claim" {
|
|
description = "JWT claim used as the Vault identity alias."
|
|
type = string
|
|
default = "sub"
|
|
}
|
|
|
|
variable "ci_token_ttl_seconds" {
|
|
description = "Maximum lifetime for delegated CI tokens."
|
|
type = number
|
|
default = 1800
|
|
|
|
validation {
|
|
condition = (
|
|
var.ci_token_ttl_seconds >= 60 &&
|
|
var.ci_token_ttl_seconds <= 3600 &&
|
|
floor(var.ci_token_ttl_seconds) == var.ci_token_ttl_seconds
|
|
)
|
|
error_message = "ci_token_ttl_seconds must be a whole number between 60 and 3600."
|
|
}
|
|
}
|
|
|
|
variable "ci_workloads_bound_claims" {
|
|
description = "Exact repository, protected-ref, and workloads-job claims for the workloads role."
|
|
type = map(string)
|
|
default = {}
|
|
}
|
|
|
|
variable "kubernetes_host" {
|
|
description = "Kubernetes TokenReview API address."
|
|
type = string
|
|
default = "https://kubernetes.default.svc.cluster.local:443"
|
|
}
|
|
|
|
variable "vault_addr" {
|
|
description = "Vault API address reachable by the foundation operator."
|
|
type = string
|
|
default = "http://127.0.0.1:8200"
|
|
}
|
|
|
|
variable "vault_token" {
|
|
description = "Short-lived bootstrap or security-administrator token."
|
|
type = string
|
|
sensitive = true
|
|
ephemeral = true
|
|
}
|