allow several k8s SA to take an app policy

hashicorp-vault/iac/modules/app_policy/main.tf

@@ -6,7 +6,9 @@
 # - postgres role
 
 locals {
-  name = lower(var.name)
+  name                             = lower(var.name)
+  bound_service_account_names      = concat([var.name], var.service_account_names)
+  bound_service_account_namespaces = concat([var.name], var.service_account_namespaces)
 }
 
 data "vault_policy_document" "ops" {
@@ -58,11 +60,11 @@ data "vault_policy_document" "ops" {
     }
     allowed_parameter {
       key   = "bound_service_account_names"
-      value = [jsonencode([local.name])]
+      value = [jsonencode(local.bound_service_account_names)]
     }
     allowed_parameter {
       key   = "bound_service_account_namespaces"
-      value = [jsonencode([local.name])]
+      value = [jsonencode(local.bound_service_account_namespaces)]
     }
     allowed_parameter {
       key = "token_policies"

hashicorp-vault/iac/modules/app_policy/variables.tf

@@ -7,4 +7,14 @@ variable "gitea_app_id" {
 variable "policies" {
   type    = list(string)
   default = []
+}
+variable "service_account_names" {
+  type        = list(string)
+  default     = []
+  description = "var.name will always be included by default - whitelist service account that can take this policy"
+}
+variable "service_account_namespaces" {
+  type        = list(string)
+  default     = []
+  description = "var.name will always be included by default - whitelist service account namespaces that can take this policy"
 }