From a33fc2b42f673573c0f251810effba9b4a32fa6e Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 22 Aug 2026 23:17:18 +1000 Subject: [PATCH] Allow CSI auth to read ceph-mediafs-secret KV (#132) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A new VaultStaticSecret `ceph-mediafs-secret` in ns `csi-cephfs` (for the legacy mediafs CephFS static PV) gets 403 on `kv/data/service/kubernetes/au/syd1/csi/ceph-mediafs-secret` — the `ceph-csi` role can already read the sibling `ceph-cephfs-secret` path via the same `ceph-csi-cephfs` VaultAuth, but no policy covers the new path. - Adds `policies/kv/service/kubernetes/au/syd1/csi/ceph-mediafs-secret/read.yaml` granting read on `kv/data/service/kubernetes/au/syd1/csi/ceph-mediafs-secret`, bound to role `ceph-csi` on mount `k8s/au/syd1` (mirrors the existing ceph-cephfs-secret/ceph-rbd-secret policies) Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/132 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- .../au/syd1/csi/ceph-mediafs-secret/read.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 policies/kv/service/kubernetes/au/syd1/csi/ceph-mediafs-secret/read.yaml diff --git a/policies/kv/service/kubernetes/au/syd1/csi/ceph-mediafs-secret/read.yaml b/policies/kv/service/kubernetes/au/syd1/csi/ceph-mediafs-secret/read.yaml new file mode 100644 index 0000000..d31f6a2 --- /dev/null +++ b/policies/kv/service/kubernetes/au/syd1/csi/ceph-mediafs-secret/read.yaml @@ -0,0 +1,10 @@ +# Allow reading Ceph mediafs CSI secrets +--- +rules: + - path: "kv/data/service/kubernetes/au/syd1/csi/ceph-mediafs-secret" + capabilities: + - read + +auth: + k8s/au/syd1: + - ceph-csi