unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Allow CSI auth to read ceph-mediafs-secret KV (#132)
ci/woodpecker/push/apply Pipeline failed
Details

Browse Source 
A new VaultStaticSecret `ceph-mediafs-secret` in ns `csi-cephfs` (for the legacy mediafs CephFS static PV) gets 403 on `kv/data/service/kubernetes/au/syd1/csi/ceph-mediafs-secret` — the `ceph-csi` role can already read the sibling `ceph-cephfs-secret` path via the same `ceph-csi-cephfs` VaultAuth, but no policy covers the new path.

- Adds `policies/kv/service/kubernetes/au/syd1/csi/ceph-mediafs-secret/read.yaml` granting read on `kv/data/service/kubernetes/au/syd1/csi/ceph-mediafs-secret`, bound to role `ceph-csi` on mount `k8s/au/syd1` (mirrors the existing ceph-cephfs-secret/ceph-rbd-secret policies)

Reviewed-on: #132
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>
This commit was merged in pull request #132.
This commit is contained in:
Unkin Agent
2026-08-22 23:17:18 +10:00
committed by BenVincent
parent 0e82cda02d
commit a33fc2b42f
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
policies/kv/service/kubernetes/au/syd1/csi/ceph-mediafs-secret/read.yaml
+10
View File
@@ -0,0 +1,10 @@
# Allow reading Ceph mediafs CSI secrets
---
rules:
- path: "kv/data/service/kubernetes/au/syd1/csi/ceph-mediafs-secret"
capabilities:
- read
auth:
k8s/au/syd1:
- ceph-csi