From b11a55edd9da551b13c2ab2a16bf8a2f1e06e502 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sun, 9 Aug 2026 11:29:43 +1000
Subject: [PATCH] Add netbox engine admin policy

Why:
- The netbox secrets engine mount + roles land in a follow-up PR; its manage
  policy must exist first so the deployer can create the config and roles the
  moment the engine PR applies (policy-first split).

How:
- Add policies/netbox/admin.yaml granting the deployer netbox/config,
  netbox/config/rotate and netbox/roles/* (excludes netbox/creds/*), bound to
  the tf_vault AppRole and woodpecker_terraform_vault k8s role, mirroring the
  gpg/gitea admin policies.
---
 policies/netbox/admin.yaml | 42 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 policies/netbox/admin.yaml

diff --git a/policies/netbox/admin.yaml b/policies/netbox/admin.yaml
new file mode 100644
index 0000000..9a0cc6c
--- /dev/null
+++ b/policies/netbox/admin.yaml
@@ -0,0 +1,42 @@
+# Allow the vault deployer to manage the netbox token secrets engine: its
+# connection config (seeded admin token), in-place token rotation, and
+# token-minting roles.
+#
+# Scoped to netbox/* only, and deliberately excludes netbox/creds/* - minting
+# tokens is for consumers, not the deployer. The plugin-catalog grant needed to
+# import the plugin is the shared, sudo-protected wildcard in
+# policies/sys/plugins/catalog/admin.yaml (already covers this plugin), and
+# mounting the engine uses the deployer's existing sys/mounts/* access, so no
+# new catalog/mount grant is added here (mirrors the gitea/rancher engines).
+---
+rules:
+  # Engine connection config (NetBox URL, TLS, token_version, seeded admin token).
+  - path: "netbox/config"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  # In-place rotation of the seeded admin token (write-only trigger).
+  - path: "netbox/config/rotate"
+    capabilities:
+      - create
+      - update
+  # Token-minting roles.
+  - path: "netbox/roles/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+      - list
+  - path: "netbox/roles"
+    capabilities:
+      - read
+      - list
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
-- 
2.47.3