From 65034b9189aba0414cfd29744df8b2bfe393ef01 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 28 Sep 2026 22:37:22 +1000 Subject: [PATCH 1/2] Scope shared oauth-credentials policy per service account --- .../+/{default => +}/oauth-credentials/read.yaml | 5 +++-- .../default/vlogs-oauth-credentials/read.yaml | 14 -------------- 2 files changed, 3 insertions(+), 16 deletions(-) rename policies/kv/kubernetes/namespace/+/{default => +}/oauth-credentials/read.yaml (63%) delete mode 100644 policies/kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials/read.yaml diff --git a/policies/kv/kubernetes/namespace/+/default/oauth-credentials/read.yaml b/policies/kv/kubernetes/namespace/+/+/oauth-credentials/read.yaml similarity index 63% rename from policies/kv/kubernetes/namespace/+/default/oauth-credentials/read.yaml rename to policies/kv/kubernetes/namespace/+/+/oauth-credentials/read.yaml index e6c7451..b7afae2 100644 --- a/policies/kv/kubernetes/namespace/+/default/oauth-credentials/read.yaml +++ b/policies/kv/kubernetes/namespace/+/+/oauth-credentials/read.yaml @@ -1,10 +1,11 @@ # Allow the Terraform Authentik runner to read the OAuth2/OIDC client secret that # backs an authentik provider, in whichever namespace the target service lives # (the module's data.vault_kv_secret_v2). The literal + is a Vault single-segment -# wildcard: one oauth-credentials secret per onboarded namespace. +# wildcard: one oauth-credentials secret per service account, so a namespace can +# host several OIDC apps as long as each runs under its own service account. --- rules: - - path: "kv/data/kubernetes/namespace/+/default/oauth-credentials" + - path: "kv/data/kubernetes/namespace/+/+/oauth-credentials" capabilities: - read diff --git a/policies/kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials/read.yaml b/policies/kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials/read.yaml deleted file mode 100644 index 02aba75..0000000 --- a/policies/kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials/read.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Allow the Terraform Authentik runner to read the vlogs OIDC client secret. It is -# a second OIDC client in an already-onboarded namespace, so it cannot use the -# one-per-namespace oauth-credentials path. ---- -rules: - - path: "kv/data/kubernetes/namespace/logging/default/vlogs-oauth-credentials" - capabilities: - - read - -auth: - approle: - - terraform_authentik - k8s/au/syd1: - - woodpecker_terraform_authentik -- 2.47.3 From 141dd2579817911db831b6acde8d0545e52c84f4 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 28 Sep 2026 22:44:39 +1000 Subject: [PATCH 2/2] Restore shared oauth-credentials rule to its default-SA scope --- .../namespace/+/{+ => default}/oauth-credentials/read.yaml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) rename policies/kv/kubernetes/namespace/+/{+ => default}/oauth-credentials/read.yaml (63%) diff --git a/policies/kv/kubernetes/namespace/+/+/oauth-credentials/read.yaml b/policies/kv/kubernetes/namespace/+/default/oauth-credentials/read.yaml similarity index 63% rename from policies/kv/kubernetes/namespace/+/+/oauth-credentials/read.yaml rename to policies/kv/kubernetes/namespace/+/default/oauth-credentials/read.yaml index b7afae2..e6c7451 100644 --- a/policies/kv/kubernetes/namespace/+/+/oauth-credentials/read.yaml +++ b/policies/kv/kubernetes/namespace/+/default/oauth-credentials/read.yaml @@ -1,11 +1,10 @@ # Allow the Terraform Authentik runner to read the OAuth2/OIDC client secret that # backs an authentik provider, in whichever namespace the target service lives # (the module's data.vault_kv_secret_v2). The literal + is a Vault single-segment -# wildcard: one oauth-credentials secret per service account, so a namespace can -# host several OIDC apps as long as each runs under its own service account. +# wildcard: one oauth-credentials secret per onboarded namespace. --- rules: - - path: "kv/data/kubernetes/namespace/+/+/oauth-credentials" + - path: "kv/data/kubernetes/namespace/+/default/oauth-credentials" capabilities: - read -- 2.47.3