From 1dace21b372834e959fb2a4b2d8bc175cde78f57 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Thu, 13 Aug 2026 19:31:46 +1000 Subject: [PATCH] vault: add ghp k8s auth role + kv read policy ghp (a GitHub proxy) reads its GitHub App credentials and encryption key from kv/kubernetes/ghp/*; it uses the postgres storage backend so it only needs read access to those kv secrets. - add k8s/au/syd1 auth role ghp bound to ServiceAccount ghp in namespace ghp (ttl 600s, audience vault) - add read-only kv policy granting read on kv/data/kubernetes/ghp/* and read+list on kv/metadata/kubernetes/ghp/* - mirrors the artifactapi / logging_logarchiver per-app pattern (app-SA-bound k8s role + single kv read policy consumed by VSO) --- .../auth_kubernetes_role/k8s/au/syd1/ghp.yaml | 7 +++++++ policies/kv/kubernetes/ghp/read.yaml | 17 +++++++++++++++++ 2 files changed, 24 insertions(+) create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/ghp.yaml create mode 100644 policies/kv/kubernetes/ghp/read.yaml diff --git a/config/auth_kubernetes_role/k8s/au/syd1/ghp.yaml b/config/auth_kubernetes_role/k8s/au/syd1/ghp.yaml new file mode 100644 index 0000000..ff5d493 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/ghp.yaml @@ -0,0 +1,7 @@ +bound_service_account_names: + - ghp +bound_service_account_namespaces: + - ghp +token_ttl: 600 +token_max_ttl: 600 +audience: vault diff --git a/policies/kv/kubernetes/ghp/read.yaml b/policies/kv/kubernetes/ghp/read.yaml new file mode 100644 index 0000000..4430c84 --- /dev/null +++ b/policies/kv/kubernetes/ghp/read.yaml @@ -0,0 +1,17 @@ +# Allow ghp to read its GitHub App credentials and encryption key +# +# kv/kubernetes/ghp/github-app (app_id/client_id/client_secret/private_key) +# kv/kubernetes/ghp/app (encryption_key) +--- +rules: + - path: "kv/data/kubernetes/ghp/*" + capabilities: + - read + - path: "kv/metadata/kubernetes/ghp/*" + capabilities: + - read + - list + +auth: + k8s/au/syd1: + - ghp -- 2.47.3