runr_secret_store_trust (Data Source)

What a secret store has to trust so a region reads from it without a credential: the region cluster's service account issuer and its keys, the service account RunR names in the project namespace, the token subject and audience. Use it to configure the store's side — a Vault / OpenBao Kubernetes or JWT auth role, an AWS IAM OIDC provider and role trust policy, a GCP workload identity pool provider, an Azure federated credential. Needs secret_stores.view.

Example Usage#

data "runr_region" "eu" {
  name = "eu-1"
}

# What the Vault store has to trust for region eu-1.
data "runr_secret_store_trust" "vault_eu" {
  store_id  = runr_secret_store.vault.id
  region_id = data.runr_region.eu.id
}

# Vault's JWT auth for the region (hashicorp/vault provider).
resource "vault_jwt_auth_backend" "runr_eu" {
  path                   = "runr-eu"
  jwt_validation_pubkeys = data.runr_secret_store_trust.vault_eu.pem_keys
}

resource "vault_jwt_auth_backend_role" "runr" {
  backend         = vault_jwt_auth_backend.runr_eu.path
  role_name       = "runr"
  role_type       = "jwt"
  bound_audiences = [data.runr_secret_store_trust.vault_eu.audience]
  bound_subject   = data.runr_secret_store_trust.vault_eu.subject
  user_claim      = "sub"
  token_policies  = ["runr-read"]
}

Schema#

Required#

• region_id (String) Region id (data.runr_region).
• store_id (String) Store id (runr_secret_store.<name>.id) or name.

Read-Only#

• audience (String) Audience of its tokens (null for Vault's Kubernetes auth).
• eso_status (String) External Secrets Operator in the region: ready, not_installed, installing, uninstalling or error.
• issuer (String) The cluster's service account issuer URL.
• jwks (String) The issuer's keys as a JWKS document (JSON).
• jwks_uri (String) URL of the issuer's keys (JWKS).
• namespace (String) The region's project namespace.
• pem_keys (List of String) The issuer's public keys as PEM (Vault's jwt_validation_pubkeys).
• publicly_reachable (Boolean) Whether a cloud provider could fetch the issuer's discovery document (a hint; the provider decides). When false, give the keys to the store instead of the issuer URL.
• region_name (String) Region name.
• service_account (String) The service account the store logs in with (the store's kubernetes_name).
• subject (String) Subject of its tokens: system:serviceaccount:<namespace>:<service account>.