unkin/terraform-vault
3
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Add cephrgw-operator k8s auth role + dashboard-credentials policy #95

Closed
unkinben wants to merge 1 commits from benvin/add-cephrgw-operator-role into master
pull from: benvin/add-cephrgw-operator-role
merge into: unkin:master
Conversation 0 Commits 1 Files Changed 2
+17
unkinben commented 2026-07-18 16:12:56 +10:00
Owner
Copy Link
Copy Source

Why

The cephrgw-operator (namespace cephrgw-system, ServiceAccount cephrgw-operator) reads its Ceph dashboard credentials from Vault via VSO. It needs a Kubernetes auth role bound to its ServiceAccount and a policy granting read on the KV path. An argocd-apps PR adds the matching VaultAuth/VaultStaticSecret.

Changes

  • Add config/auth_kubernetes_role/k8s/au/syd1/cephrgw-operator.yaml: binds SA cephrgw-operator in cephrgw-system (audience vault, 600s TTL).
  • Add policies/kv/service/cephrgw/dashboard-credentials/read.yaml: grants read on kv/data/service/cephrgw/dashboard-credentials to that role via the k8s/au/syd1 auth mount.

Secret values are seeded out-of-band (as with other apps), e.g.:

vault kv put kv/service/cephrgw/dashboard-credentials \
  CEPH_DASHBOARD_URL=https://dashboard.ceph.unkin.net \
  CEPH_DASHBOARD_USERNAME=k8s-cephrgw-operator \
  CEPH_DASHBOARD_PASSWORD=... \
  CEPH_RGW_ENDPOINT=https://s3.ceph.unkin.net
## Why The `cephrgw-operator` (namespace `cephrgw-system`, ServiceAccount `cephrgw-operator`) reads its Ceph dashboard credentials from Vault via VSO. It needs a Kubernetes auth role bound to its ServiceAccount and a policy granting read on the KV path. An argocd-apps PR adds the matching `VaultAuth`/`VaultStaticSecret`. ## Changes - Add `config/auth_kubernetes_role/k8s/au/syd1/cephrgw-operator.yaml`: binds SA `cephrgw-operator` in `cephrgw-system` (audience `vault`, 600s TTL). - Add `policies/kv/service/cephrgw/dashboard-credentials/read.yaml`: grants `read` on `kv/data/service/cephrgw/dashboard-credentials` to that role via the `k8s/au/syd1` auth mount. Secret **values** are seeded out-of-band (as with other apps), e.g.: ``` vault kv put kv/service/cephrgw/dashboard-credentials \ CEPH_DASHBOARD_URL=https://dashboard.ceph.unkin.net \ CEPH_DASHBOARD_USERNAME=k8s-cephrgw-operator \ CEPH_DASHBOARD_PASSWORD=... \ CEPH_RGW_ENDPOINT=https://s3.ceph.unkin.net ```
unkinben added 1 commit 2026-07-18 16:12:56 +10:00
Add cephrgw-operator k8s auth role + dashboard-credentials read policy
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/plan Pipeline was successful
Details
3624450baa 
The cephrgw-operator reads its Ceph dashboard credentials from Vault via VSO
and needs a Kubernetes auth role bound to its ServiceAccount plus a policy
granting read on the KV path.

- Add config/auth_kubernetes_role/k8s/au/syd1/cephrgw-operator.yaml binding
  ServiceAccount cephrgw-operator in namespace cephrgw-system (audience vault).
- Add policies/kv/service/cephrgw/dashboard-credentials/read.yaml granting
  read on kv/data/service/cephrgw/dashboard-credentials to that role via the
  k8s/au/syd1 auth mount.
unkinben closed this pull request 2026-07-18 16:24:24 +10:00
All checks were successful
ci/woodpecker/pr/pre-commit Pipeline was successful
Required
Details
ci/woodpecker/pr/plan Pipeline was successful
Required
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/terraform-vault#95
Delete Branch "benvin/add-cephrgw-operator-role"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?