From 41fef29badd7809daffb89ae58c97f0f7c1218dc Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 2 Aug 2026 21:29:18 +1000 Subject: [PATCH] Add Vault-scoped agent kubernetes roles + agents AppRole Give agentic workloads domain-scoped kubernetes credentials so they stop needing cluster-admin/root. Adds four least-privilege kubernetes secret engine roles, an `agents` AppRole (role_id-only, CIDR-bound to the agent workstation) that can mint them, and a write-capable KV grant for the kubernetes secrets subtree. - Add kubernetes_secret_backend_role configs agent-dhcp/dns/certs/storage with generated_role_rules scoping each to its operator CRDs + pod/log reads. - Add creds policies for each role, bound to Ben's cluster-operator ldap group (human kubectl use) and the agents AppRole (programmatic use). - Add the `agents` AppRole: bind_secret_id false, token_bound_cidrs 10.10.12.200/32, deterministic role_id, 1h/4h TTLs. - Add kv/kubernetes/agents policy granting the AppRole create/read/update/list on the kubernetes KV subtree (no delete). Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --- config/auth_approle_role/approle/agents.yaml | 6 ++++ .../kubernetes/au/syd1/agent-certs.yaml | 4 +++ .../kubernetes/au/syd1/agent-dhcp.yaml | 4 +++ .../kubernetes/au/syd1/agent-dns.yaml | 4 +++ .../kubernetes/au/syd1/agent-storage.yaml | 4 +++ .../kubernetes/au/syd1/creds/agent-certs.yaml | 12 +++++++ .../kubernetes/au/syd1/creds/agent-dhcp.yaml | 12 +++++++ .../kubernetes/au/syd1/creds/agent-dns.yaml | 12 +++++++ .../au/syd1/creds/agent-storage.yaml | 12 +++++++ policies/kv/kubernetes/agents.yaml | 17 ++++++++++ .../kubernetes/au/syd1/roles/agent-certs.yaml | 33 +++++++++++++++++++ .../kubernetes/au/syd1/roles/agent-dhcp.yaml | 26 +++++++++++++++ .../kubernetes/au/syd1/roles/agent-dns.yaml | 26 +++++++++++++++ .../au/syd1/roles/agent-storage.yaml | 23 +++++++++++++ 14 files changed, 195 insertions(+) create mode 100644 config/auth_approle_role/approle/agents.yaml create mode 100644 config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-certs.yaml create mode 100644 config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dhcp.yaml create mode 100644 config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dns.yaml create mode 100644 config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-storage.yaml create mode 100644 policies/kubernetes/au/syd1/creds/agent-certs.yaml create mode 100644 policies/kubernetes/au/syd1/creds/agent-dhcp.yaml create mode 100644 policies/kubernetes/au/syd1/creds/agent-dns.yaml create mode 100644 policies/kubernetes/au/syd1/creds/agent-storage.yaml create mode 100644 policies/kv/kubernetes/agents.yaml create mode 100644 resources/secret_backend/kubernetes/au/syd1/roles/agent-certs.yaml create mode 100644 resources/secret_backend/kubernetes/au/syd1/roles/agent-dhcp.yaml create mode 100644 resources/secret_backend/kubernetes/au/syd1/roles/agent-dns.yaml create mode 100644 resources/secret_backend/kubernetes/au/syd1/roles/agent-storage.yaml diff --git a/config/auth_approle_role/approle/agents.yaml b/config/auth_approle_role/approle/agents.yaml new file mode 100644 index 0000000..8a23894 --- /dev/null +++ b/config/auth_approle_role/approle/agents.yaml @@ -0,0 +1,6 @@ +token_ttl: 3600 +token_max_ttl: 14400 +bind_secret_id: false +token_bound_cidrs: + - "10.10.12.200/32" +use_deterministic_role_id: true diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-certs.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-certs.yaml new file mode 100644 index 0000000..10fd4ed --- /dev/null +++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-certs.yaml @@ -0,0 +1,4 @@ +allowed_kubernetes_namespaces: + - "cert-manager" +kubernetes_role_type: "Role" +extra_labels: {} diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dhcp.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dhcp.yaml new file mode 100644 index 0000000..c5ed8f5 --- /dev/null +++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dhcp.yaml @@ -0,0 +1,4 @@ +allowed_kubernetes_namespaces: + - "dhcp-system" +kubernetes_role_type: "Role" +extra_labels: {} diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dns.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dns.yaml new file mode 100644 index 0000000..b758647 --- /dev/null +++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dns.yaml @@ -0,0 +1,4 @@ +allowed_kubernetes_namespaces: + - "*" +kubernetes_role_type: "ClusterRole" +extra_labels: {} diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-storage.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-storage.yaml new file mode 100644 index 0000000..b1f1301 --- /dev/null +++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-storage.yaml @@ -0,0 +1,4 @@ +allowed_kubernetes_namespaces: + - "cephrgw-system" +kubernetes_role_type: "Role" +extra_labels: {} diff --git a/policies/kubernetes/au/syd1/creds/agent-certs.yaml b/policies/kubernetes/au/syd1/creds/agent-certs.yaml new file mode 100644 index 0000000..fcc78b7 --- /dev/null +++ b/policies/kubernetes/au/syd1/creds/agent-certs.yaml @@ -0,0 +1,12 @@ +# Allow access to agent-certs Kubernetes credentials +--- +rules: + - path: "kubernetes/au/syd1/creds/agent-certs" + capabilities: + - update + +auth: + ldap: + - kubernetes_au_syd1_cluster_operator + approle: + - agents diff --git a/policies/kubernetes/au/syd1/creds/agent-dhcp.yaml b/policies/kubernetes/au/syd1/creds/agent-dhcp.yaml new file mode 100644 index 0000000..76e007d --- /dev/null +++ b/policies/kubernetes/au/syd1/creds/agent-dhcp.yaml @@ -0,0 +1,12 @@ +# Allow access to agent-dhcp Kubernetes credentials +--- +rules: + - path: "kubernetes/au/syd1/creds/agent-dhcp" + capabilities: + - update + +auth: + ldap: + - kubernetes_au_syd1_cluster_operator + approle: + - agents diff --git a/policies/kubernetes/au/syd1/creds/agent-dns.yaml b/policies/kubernetes/au/syd1/creds/agent-dns.yaml new file mode 100644 index 0000000..e61a423 --- /dev/null +++ b/policies/kubernetes/au/syd1/creds/agent-dns.yaml @@ -0,0 +1,12 @@ +# Allow access to agent-dns Kubernetes credentials +--- +rules: + - path: "kubernetes/au/syd1/creds/agent-dns" + capabilities: + - update + +auth: + ldap: + - kubernetes_au_syd1_cluster_operator + approle: + - agents diff --git a/policies/kubernetes/au/syd1/creds/agent-storage.yaml b/policies/kubernetes/au/syd1/creds/agent-storage.yaml new file mode 100644 index 0000000..0463013 --- /dev/null +++ b/policies/kubernetes/au/syd1/creds/agent-storage.yaml @@ -0,0 +1,12 @@ +# Allow access to agent-storage Kubernetes credentials +--- +rules: + - path: "kubernetes/au/syd1/creds/agent-storage" + capabilities: + - update + +auth: + ldap: + - kubernetes_au_syd1_cluster_operator + approle: + - agents diff --git a/policies/kv/kubernetes/agents.yaml b/policies/kv/kubernetes/agents.yaml new file mode 100644 index 0000000..ea89078 --- /dev/null +++ b/policies/kv/kubernetes/agents.yaml @@ -0,0 +1,17 @@ +# Allow the agents AppRole to manage the kubernetes KV subtree (no delete) +--- +rules: + - path: "kv/data/kubernetes/*" + capabilities: + - create + - read + - update + - list + - path: "kv/metadata/kubernetes/*" + capabilities: + - read + - list + +auth: + approle: + - agents diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/agent-certs.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/agent-certs.yaml new file mode 100644 index 0000000..995710d --- /dev/null +++ b/resources/secret_backend/kubernetes/au/syd1/roles/agent-certs.yaml @@ -0,0 +1,33 @@ +--- +rules: + - apiGroups: + - "cert-manager.io" + - "acme.cert-manager.io" + resources: + - "*" + verbs: + - "*" + - apiGroups: + - "" + resources: + - "secrets" + verbs: + - "get" + - "list" + - "watch" + - "delete" + - apiGroups: + - "" + resources: + - "pods" + verbs: + - "get" + - "list" + - "watch" + - apiGroups: + - "" + resources: + - "pods/log" + verbs: + - "get" + - "list" diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/agent-dhcp.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/agent-dhcp.yaml new file mode 100644 index 0000000..a425a34 --- /dev/null +++ b/resources/secret_backend/kubernetes/au/syd1/roles/agent-dhcp.yaml @@ -0,0 +1,26 @@ +--- +rules: + - apiGroups: + - "kea.unkin.net" + resources: + - "*" + verbs: + - "*" + - apiGroups: + - "" + resources: + - "pods" + - "services" + - "configmaps" + - "events" + verbs: + - "get" + - "list" + - "watch" + - apiGroups: + - "" + resources: + - "pods/log" + verbs: + - "get" + - "list" diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/agent-dns.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/agent-dns.yaml new file mode 100644 index 0000000..ba92724 --- /dev/null +++ b/resources/secret_backend/kubernetes/au/syd1/roles/agent-dns.yaml @@ -0,0 +1,26 @@ +--- +rules: + - apiGroups: + - "bind.unkin.net" + resources: + - "*" + verbs: + - "*" + - apiGroups: + - "" + resources: + - "pods" + - "services" + - "configmaps" + - "events" + verbs: + - "get" + - "list" + - "watch" + - apiGroups: + - "" + resources: + - "pods/log" + verbs: + - "get" + - "list" diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/agent-storage.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/agent-storage.yaml new file mode 100644 index 0000000..6c5b6d3 --- /dev/null +++ b/resources/secret_backend/kubernetes/au/syd1/roles/agent-storage.yaml @@ -0,0 +1,23 @@ +--- +rules: + - apiGroups: + - "ceph.unkin.net" + resources: + - "*" + verbs: + - "*" + - apiGroups: + - "" + resources: + - "pods" + verbs: + - "get" + - "list" + - "watch" + - apiGroups: + - "" + resources: + - "pods/log" + verbs: + - "get" + - "list"