From 03dc436a89f042907b2b8f4e28c2b0f47024da5a Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sun, 9 Aug 2026 12:02:13 +1000
Subject: [PATCH] Add netbox engine admin policy (#116)

## Why
- The netbox secrets engine mount + roles land in a follow-up PR (#115); its manage policy must exist first so the deployer can create the engine config and roles the moment that PR applies (policy-first split).

## How
- Add `policies/netbox/admin.yaml` granting the deployer `netbox/config`, `netbox/config/rotate` and `netbox/roles/*` (deliberately excludes `netbox/creds/*`), bound to the `tf_vault` AppRole and `woodpecker_terraform_vault` k8s role, mirroring the gpg/gitea admin policies.

Land this before #115 (the engine mount + roles).

Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/116
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
---
 policies/netbox/admin.yaml | 42 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 policies/netbox/admin.yaml

diff --git a/policies/netbox/admin.yaml b/policies/netbox/admin.yaml
new file mode 100644
index 0000000..9a0cc6c
--- /dev/null
+++ b/policies/netbox/admin.yaml
@@ -0,0 +1,42 @@
+# Allow the vault deployer to manage the netbox token secrets engine: its
+# connection config (seeded admin token), in-place token rotation, and
+# token-minting roles.
+#
+# Scoped to netbox/* only, and deliberately excludes netbox/creds/* - minting
+# tokens is for consumers, not the deployer. The plugin-catalog grant needed to
+# import the plugin is the shared, sudo-protected wildcard in
+# policies/sys/plugins/catalog/admin.yaml (already covers this plugin), and
+# mounting the engine uses the deployer's existing sys/mounts/* access, so no
+# new catalog/mount grant is added here (mirrors the gitea/rancher engines).
+---
+rules:
+  # Engine connection config (NetBox URL, TLS, token_version, seeded admin token).
+  - path: "netbox/config"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  # In-place rotation of the seeded admin token (write-only trigger).
+  - path: "netbox/config/rotate"
+    capabilities:
+      - create
+      - update
+  # Token-minting roles.
+  - path: "netbox/roles/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+      - list
+  - path: "netbox/roles"
+    capabilities:
+      - read
+      - list
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault