unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Grant the vault deployer sudo to enable the oidc auth mount #149

Merged
benvin merged 1 commits from benvin/sys-auth-oidc-grant into master 2026-08-31 22:21:02 +10:00
Conversation 0 Commits 1 Files Changed 1
+18
unkin-agent commented 2026-08-31 22:14:27 +10:00
Member
Copy Link
Copy Source

Why

The deployer identities cannot enable the oidc auth mount: POST /v1/sys/auth/oidc returns 403 because sys/auth/<path> (and its /tune) is sudo-protected, and policies/sys/auth/admin.yaml granted create/update/delete/read/list without sudo.

How

  • Add exact-path rules for sys/auth/oidc and sys/auth/oidc/tune to policies/sys/auth/admin.yaml with the wildcard's capability set plus sudo (exact match wins over the glob, so the set is repeated in full); auth block unchanged.

Merge order: apply this, then re-run the master apply so module.auth_oidc_backend["oidc"] can create the mount.

## Why The deployer identities cannot enable the `oidc` auth mount: `POST /v1/sys/auth/oidc` returns 403 because `sys/auth/<path>` (and its `/tune`) is sudo-protected, and `policies/sys/auth/admin.yaml` granted create/update/delete/read/list without `sudo`. ## How - Add exact-path rules for `sys/auth/oidc` and `sys/auth/oidc/tune` to `policies/sys/auth/admin.yaml` with the wildcard's capability set plus `sudo` (exact match wins over the glob, so the set is repeated in full); auth block unchanged. Merge order: apply this, then re-run the master apply so `module.auth_oidc_backend["oidc"]` can create the mount.
unkin-agent added 1 commit 2026-08-31 22:14:27 +10:00
Grant the vault deployer sudo to enable the oidc auth mount
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
a83ddf2442 
Enabling and tuning an auth mount at sys/auth/<path> is sudo-protected, so
the deployer identities got 403 on POST /v1/sys/auth/oidc despite already
holding create/update/delete on sys/auth/*.
benvin merged commit a19256fdba into master 2026-08-31 22:21:02 +10:00
benvin deleted branch benvin/sys-auth-oidc-grant 2026-08-31 22:21:03 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#149
Delete Branch "benvin/sys-auth-oidc-grant"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?