[Terraform] Fix ServiceAccount naming in Kubernetes auth roles

[colek42]

Problem

The vault-config Terraform module's Kubernetes auth roles are bound to hardcoded ServiceAccount names without the Helm release prefix, but Helm charts may use prefixed names.

Current State

# Lines 192, 202, 212 in modules/vault-config/main.tf
resource "vault_kubernetes_auth_backend_role" "judge_api" {
  backend                          = vault_auth_backend.kubernetes.path
  role_name                        = "judge-api"
  bound_service_account_names      = ["judge-api"]  # Hardcoded without prefix
  bound_service_account_namespaces = [var.judge_namespace]
  token_policies                   = [vault_policy.judge_api.name]
  token_ttl                        = 86400
}

Problem

• Helm charts may create ServiceAccounts with release prefix: judge-platform-judge-api
• Current Terraform binds to judge-api only
• ESO cannot authenticate if names don't match

Desired State

Make ServiceAccount names configurable:

variable "judge_api_service_account" {
  default = "judge-api"
  description = "ServiceAccount name for judge-api (may include release prefix)"
}

resource "vault_kubernetes_auth_backend_role" "judge_api" {
  ...
  bound_service_account_names = [var.judge_api_service_account]
  ...
}

OR require consistent naming in Helm charts.

Files to Update

• modules/vault-config/main.tf
• modules/vault-config/variables.tf

Related Issues

• Issue Implement Fulcio and TSA with Google Tink + HashiCorp Vault KMS #2: Service account naming clarification in Helm charts

Impact

• High Priority: ESO authentication fails if names don't match
• Blocks multi-release deployments

Labels

• bug
• terraform
• vault
• critical

[colek42]

✅ Fixed in commit: testifysec/cust-anaconda-terraform-aws@8b1ebd7

ServiceAccount names are now configurable with proper defaults that include Helm release prefixes.

Changes:

• Added variables: judge_api_service_account, archivista_service_account, kratos_service_account
• Updated Kubernetes auth role bindings to use variables instead of hardcoded names
• Added external-secrets Kubernetes auth role for ESO namespace
• Defaults: judge-platform-judge-api, judge-platform-judge-archivista, judge-platform-judge-kratos

Related PR: testifysec/cust-anaconda-terraform-aws (commit 8b1ebd7)
Related PR: testifysec/judge-platform-values (commit ddb91e7 - RDS endpoint fix)

Evidence: Loop log at /tmp/judge-debug-20251016-165510/logs/loop-1.md