From ea380b9417ec9291a33675a239cc6f028966fc88 Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 2 Aug 2026 17:04:32 +1000 Subject: [PATCH] Add cert-manager clouddns KV read access for VSO cert-manager needs a Google Cloud DNS service-account key to solve Let's Encrypt DNS-01 challenges for publicly-trusted certs. VSO syncs it from Vault KV, so the cert-manager namespace needs its own k8s auth role and a policy granting read on the KV path. - Add k8s auth role cert_manager_clouddns bound to SA cert-manager-clouddns in the cert-manager namespace. - Add policy granting read on kv/service/kubernetes/au/syd1/cert-manager/clouddns, bound to that role. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --- .../k8s/au/syd1/cert_manager_clouddns.yaml | 7 +++++++ .../kubernetes/au/syd1/cert-manager/clouddns/read.yaml | 10 ++++++++++ 2 files changed, 17 insertions(+) create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/cert_manager_clouddns.yaml create mode 100644 policies/kv/service/kubernetes/au/syd1/cert-manager/clouddns/read.yaml diff --git a/config/auth_kubernetes_role/k8s/au/syd1/cert_manager_clouddns.yaml b/config/auth_kubernetes_role/k8s/au/syd1/cert_manager_clouddns.yaml new file mode 100644 index 0000000..ea2a294 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/cert_manager_clouddns.yaml @@ -0,0 +1,7 @@ +bound_service_account_names: + - cert-manager-clouddns +bound_service_account_namespaces: + - cert-manager +token_ttl: 600 +token_max_ttl: 600 +audience: vault diff --git a/policies/kv/service/kubernetes/au/syd1/cert-manager/clouddns/read.yaml b/policies/kv/service/kubernetes/au/syd1/cert-manager/clouddns/read.yaml new file mode 100644 index 0000000..a8e11a0 --- /dev/null +++ b/policies/kv/service/kubernetes/au/syd1/cert-manager/clouddns/read.yaml @@ -0,0 +1,10 @@ +# Allow reading the cert-manager Google Cloud DNS solver service-account key +--- +rules: + - path: "kv/data/service/kubernetes/au/syd1/cert-manager/clouddns" + capabilities: + - read + +auth: + k8s/au/syd1: + - cert_manager_clouddns -- 2.47.3