unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Allow CSI auth to read ceph-mediafs-secret KV #132

Merged
benvin merged 1 commits from benvin/mediafs-csi-kv into master 2026-08-22 23:17:18 +10:00
Conversation 0 Commits 1 Files Changed 1
+10
unkin-agent commented 2026-08-22 23:09:00 +10:00
Member
Copy Link
Copy Source

A new VaultStaticSecret ceph-mediafs-secret in ns csi-cephfs (for the legacy mediafs CephFS static PV) gets 403 on kv/data/service/kubernetes/au/syd1/csi/ceph-mediafs-secret — the ceph-csi role can already read the sibling ceph-cephfs-secret path via the same ceph-csi-cephfs VaultAuth, but no policy covers the new path.

  • Adds policies/kv/service/kubernetes/au/syd1/csi/ceph-mediafs-secret/read.yaml granting read on kv/data/service/kubernetes/au/syd1/csi/ceph-mediafs-secret, bound to role ceph-csi on mount k8s/au/syd1 (mirrors the existing ceph-cephfs-secret/ceph-rbd-secret policies)
A new VaultStaticSecret `ceph-mediafs-secret` in ns `csi-cephfs` (for the legacy mediafs CephFS static PV) gets 403 on `kv/data/service/kubernetes/au/syd1/csi/ceph-mediafs-secret` — the `ceph-csi` role can already read the sibling `ceph-cephfs-secret` path via the same `ceph-csi-cephfs` VaultAuth, but no policy covers the new path. - Adds `policies/kv/service/kubernetes/au/syd1/csi/ceph-mediafs-secret/read.yaml` granting read on `kv/data/service/kubernetes/au/syd1/csi/ceph-mediafs-secret`, bound to role `ceph-csi` on mount `k8s/au/syd1` (mirrors the existing ceph-cephfs-secret/ceph-rbd-secret policies)
unkin-agent added 1 commit 2026-08-22 23:09:01 +10:00
Allow CSI auth to read ceph-mediafs-secret KV
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ff85941461
benvin merged commit a33fc2b42f into master 2026-08-22 23:17:18 +10:00
benvin deleted branch benvin/mediafs-csi-kv 2026-08-22 23:17:18 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#132
Delete Branch "benvin/mediafs-csi-kv"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?