Configuring venafi-connection

# 1. Create the Kubernetes Secret that contains the Venafi Bearer Token

apiVersion: v1
kind: Secret
metadata:
  name: application-team-1-tpp-access-token
  namespace: jetstack-secure
data:
  access-token: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

# 2. Give the 'venafi-connection' ServiceAccount the permission to read this secret

# create role that allows reading secrets for 'application-team-1'
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: get-application-team-1-tpp-access-token
  namespace: jetstack-secure
rules:
- apiGroups: [ "" ]
  resources: [ "secrets" ]
  verbs: [ "get" ]
  resourceNames: [ "application-team-1-tpp-access-token" ]
---
# link the connection service account to the 'get-application-team-1-tpp-access-token' role
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: application-team-1-secret-rolebinding
  namespace: jetstack-secure
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: get-application-team-1-tpp-access-token
subjects:
- kind: ServiceAccount
  name: venafi-connection
  namespace: jetstack-secure

# 3. Create the VenafiConnection CR that has a reference to the Venafi Control Plane server and to the Venafi Bearer Token

apiVersion: jetstack.io/v1alpha1
kind: VenafiConnection
metadata:
  name: application-team-1-connection
  namespace: jetstack-secure
spec:
  tpp:
    url: https://tpp1.example.com

    accessToken:
      - secret:
          name: application-team-1-tpp-access-token
          fields: [ "access-token" ] # the field name in the Kubernetes Secret