From 2a3ef51f7d5a8f182ebd5124398e13ea03c65125 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 19 Sep 2026 15:31:13 +1000 Subject: [PATCH] Name the SSH host sign policy after its sshca role The only role on the sshca mount is signhost, so a policy granting the literal path sshca/sign/host matches no role and every host signing request is denied after a successful login. - Rename the policy to sshca/sign/signhost and grant that path - Move the policy's state to the new name so the rename is tracked --- modules/vault_cluster/state_migrations.tf | 6 ++++++ policies/sshca/sign/{host.yaml => signhost.yaml} | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) rename policies/sshca/sign/{host.yaml => signhost.yaml} (84%) diff --git a/modules/vault_cluster/state_migrations.tf b/modules/vault_cluster/state_migrations.tf index e9a2020..03a852a 100644 --- a/modules/vault_cluster/state_migrations.tf +++ b/modules/vault_cluster/state_migrations.tf @@ -338,6 +338,12 @@ moved { to = module.vault_policy["sshca/sign/host"].vault_policy.this } +# The SSH host signing policy is named after the sshca role it grants (signhost) +moved { + from = module.vault_policy["sshca/sign/host"].vault_policy.this + to = module.vault_policy["sshca/sign/signhost"].vault_policy.this +} + moved { from = vault_policy.policies["sys/sys_audit_read"] to = module.vault_policy["sys/audit/read"].vault_policy.this diff --git a/policies/sshca/sign/host.yaml b/policies/sshca/sign/signhost.yaml similarity index 84% rename from policies/sshca/sign/host.yaml rename to policies/sshca/sign/signhost.yaml index 5f99869..4a5b474 100644 --- a/policies/sshca/sign/host.yaml +++ b/policies/sshca/sign/signhost.yaml @@ -1,7 +1,7 @@ # Allow signing SSH host certificates --- rules: - - path: "sshca/sign/host" + - path: "sshca/sign/signhost" capabilities: - create - update