unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Grant vault deployer access to import + manage the rancher engine #91

Merged
benvin merged 2 commits from benvin/rancher-deployer-policy into master 2026-07-18 14:34:54 +10:00
Conversation 2 Commits 2 Files Changed 2
+64
unkinben commented 2026-07-17 23:37:53 +10:00
Owner
Copy Link
Copy Source

Why

Wiring the new Rancher token secrets engine into Vault. The deployer registers the plugin (sudo-protected sys/plugins/catalog) and configures the engine via the ranchervaultsecret provider, so it needs catalog + engine-path access. Mirrors #88 (gpg).

Changes

  • Add policies/rancher/admin.yaml granting the tf_vault approle and woodpecker_terraform_vault k8s role: catalog sudo on vault-plugin-secrets-rancher, and manage on rancher/{config,service-accounts,roles}.

Merge order

Part 1 of 4. Merge before the plugin-import and backend PRs so apply doesn't 403. (Puppet install + this policy first, then import, then backend.)

## Why Wiring the new Rancher token secrets engine into Vault. The deployer registers the plugin (sudo-protected `sys/plugins/catalog`) and configures the engine via the ranchervaultsecret provider, so it needs catalog + engine-path access. Mirrors #88 (gpg). ## Changes - Add `policies/rancher/admin.yaml` granting the `tf_vault` approle and `woodpecker_terraform_vault` k8s role: catalog sudo on `vault-plugin-secrets-rancher`, and manage on `rancher/{config,service-accounts,roles}`. ## Merge order Part 1 of 4. Merge before the plugin-import and backend PRs so apply doesn't 403. (Puppet install + this policy first, then import, then backend.)
unkinben added 1 commit 2026-07-17 23:37:53 +10:00
Grant vault deployer access to import + manage the rancher engine
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
6f27546207 
The rancher token secrets engine is registered ('imported') into the catalog by
terraform-vault (sys/plugins/catalog, sudo-protected) and configured via the
ranchervaultsecret provider, so the deployer needs catalog access plus write on
the engine's config/service-accounts/roles paths. Without this, apply 403s on
plugin registration and on rancher/* writes.

- Add policies/rancher/admin.yaml granting the tf_vault approle and the
  woodpecker_terraform_vault k8s role: catalog sudo on the plugin, and manage on
  rancher/{config,service-accounts,roles}.
benvin commented 2026-07-18 11:12:47 +10:00
Owner
Copy Link
Copy Source

The path a policy lives should be the base of the paths inside the policy file. This is so when I enable code owners, a code owner of one file in their policy path like policy/foo/bar.yaml cannot grant themselves access to another path, like sys or approles

The path a policy lives should be the base of the paths inside the policy file. This is so when I enable code owners, a code owner of one file in their policy path like policy/foo/bar.yaml cannot grant themselves access to another path, like sys or approles
unkinben added 1 commit 2026-07-18 14:24:04 +10:00
Scope rancher policy to rancher/*; move catalog grant under sys/plugins
ci/woodpecker/pr/plan Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
78a205259d 
Addresses review: a policy's directory should be the base of the paths it
grants, so a code owner of one policy path cannot grant themselves access
elsewhere (e.g. sys or approle).

- policies/rancher/admin.yaml now grants only rancher/{config,service-accounts,
  roles}.
- Move the sudo-protected plugin-catalog grant to
  policies/sys/plugins/catalog/rancher.yaml (base path sys/plugins/catalog/),
  owned by a sys code owner.
unkinben commented 2026-07-18 14:24:15 +10:00
Author
Owner
Copy Link
Copy Source

Fixed in 78a2052. policies/rancher/admin.yaml now grants only rancher/{config,service-accounts,roles}. The sudo-protected plugin-catalog grant moved to policies/sys/plugins/catalog/rancher.yaml (base path sys/plugins/catalog/), so it is owned by a sys code owner and a policies/rancher/ owner cannot escalate outside the rancher mount.

Note: policies/gpg/admin.yaml still carries its sys/plugins/catalog/secret/vault-plugin-secrets-gpg grant inline — happy to move that to policies/sys/plugins/catalog/gpg.yaml in a follow-up if you want the same treatment there.

Fixed in 78a2052. `policies/rancher/admin.yaml` now grants only `rancher/{config,service-accounts,roles}`. The sudo-protected plugin-catalog grant moved to `policies/sys/plugins/catalog/rancher.yaml` (base path `sys/plugins/catalog/`), so it is owned by a `sys` code owner and a `policies/rancher/` owner cannot escalate outside the rancher mount. Note: `policies/gpg/admin.yaml` still carries its `sys/plugins/catalog/secret/vault-plugin-secrets-gpg` grant inline — happy to move that to `policies/sys/plugins/catalog/gpg.yaml` in a follow-up if you want the same treatment there.
benvin merged commit 7da23d47fe into master 2026-07-18 14:34:54 +10:00
benvin deleted branch benvin/rancher-deployer-policy 2026-07-18 14:34:54 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#91
Delete Branch "benvin/rancher-deployer-policy"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?