From a19256fdba87ac55fb0d0c1c34708ded0e472697 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 31 Aug 2026 22:21:01 +1000 Subject: [PATCH] Grant the vault deployer sudo to enable the oidc auth mount (#149) ## Why The deployer identities cannot enable the `oidc` auth mount: `POST /v1/sys/auth/oidc` returns 403 because `sys/auth/` (and its `/tune`) is sudo-protected, and `policies/sys/auth/admin.yaml` granted create/update/delete/read/list without `sudo`. ## How - Add exact-path rules for `sys/auth/oidc` and `sys/auth/oidc/tune` to `policies/sys/auth/admin.yaml` with the wildcard's capability set plus `sudo` (exact match wins over the glob, so the set is repeated in full); auth block unchanged. Merge order: apply this, then re-run the master apply so `module.auth_oidc_backend["oidc"]` can create the mount. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/149 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- policies/sys/auth/admin.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/policies/sys/auth/admin.yaml b/policies/sys/auth/admin.yaml index 026a0d7..9af620e 100644 --- a/policies/sys/auth/admin.yaml +++ b/policies/sys/auth/admin.yaml @@ -8,6 +8,24 @@ rules: - delete - read - list + # Enabling/tuning an auth mount is sudo-protected, and an exact path match + # wins over the wildcard above, so both rules repeat the full capability set. + - path: "sys/auth/oidc" + capabilities: + - create + - update + - delete + - read + - list + - sudo + - path: "sys/auth/oidc/tune" + capabilities: + - create + - update + - delete + - read + - list + - sudo auth: approle: