allow several k8s SA to take an app policy

hashicorp-vault/iac/modules/app_roles/main.tf

@@ -6,11 +6,19 @@ locals {
   name     = lower(var.name)
   database = var.database == null ? local.name : var.database
 
+  bound_service_account_names      = concat([var.name], var.service_account_names)
+  bound_service_account_namespaces = concat([var.name], var.service_account_namespaces)
+
   vault_mount_postgres = { path = "postgres" }
   vault_mount_kvv2     = { path = "kvv2" }
 }
 
+moved {
+  from = vault_database_secret_backend_role.role
+  to   = vault_database_secret_backend_role.role[0]
+}
 resource "vault_database_secret_backend_role" "role" {
+  count   = var.disable_database ? 0 : 1
   backend = local.vault_mount_postgres.path
   name    = local.name
   db_name = "postgres"
@@ -29,8 +37,8 @@ resource "vault_database_secret_backend_role" "role" {
 resource "vault_kubernetes_auth_backend_role" "role" {
   backend                          = data.vault_auth_backend.kubernetes.path
   role_name                        = local.name
-  bound_service_account_names      = [local.name]
-  bound_service_account_namespaces = [local.name]
+  bound_service_account_names      = local.bound_service_account_names
+  bound_service_account_namespaces = local.bound_service_account_namespaces
   token_ttl                        = 3600
   token_policies                   = ["default", local.name]
   audience                         = "vault"

hashicorp-vault/iac/modules/app_roles/variables.tf

@@ -5,4 +5,18 @@ variable "database" {
   type     = string
   nullable = true
   default  = null
+}
+variable "disable_database" {
+  type    = bool
+  default = false
+}
+variable "service_account_names" {
+  type        = list(string)
+  default     = []
+  description = "var.name will always be included by default - whitelist service account that can take this policy"
+}
+variable "service_account_namespaces" {
+  type        = list(string)
+  default     = []
+  description = "var.name will always be included by default - whitelist service account namespaces that can take this policy"
 }