From 3624450baa1e49d39ff70b6032b24345cf4816ce Mon Sep 17 00:00:00 2001 From: benvin Date: Sat, 18 Jul 2026 16:12:42 +1000 Subject: [PATCH] Add cephrgw-operator k8s auth role + dashboard-credentials read policy The cephrgw-operator reads its Ceph dashboard credentials from Vault via VSO and needs a Kubernetes auth role bound to its ServiceAccount plus a policy granting read on the KV path. - Add config/auth_kubernetes_role/k8s/au/syd1/cephrgw-operator.yaml binding ServiceAccount cephrgw-operator in namespace cephrgw-system (audience vault). - Add policies/kv/service/cephrgw/dashboard-credentials/read.yaml granting read on kv/data/service/cephrgw/dashboard-credentials to that role via the k8s/au/syd1 auth mount. --- .../k8s/au/syd1/cephrgw-operator.yaml | 7 +++++++ .../kv/service/cephrgw/dashboard-credentials/read.yaml | 10 ++++++++++ 2 files changed, 17 insertions(+) create mode 100644 config/auth_kubernetes_role/k8s/au/syd1/cephrgw-operator.yaml create mode 100644 policies/kv/service/cephrgw/dashboard-credentials/read.yaml diff --git a/config/auth_kubernetes_role/k8s/au/syd1/cephrgw-operator.yaml b/config/auth_kubernetes_role/k8s/au/syd1/cephrgw-operator.yaml new file mode 100644 index 0000000..4a5d822 --- /dev/null +++ b/config/auth_kubernetes_role/k8s/au/syd1/cephrgw-operator.yaml @@ -0,0 +1,7 @@ +bound_service_account_names: + - cephrgw-operator +bound_service_account_namespaces: + - cephrgw-system +token_ttl: 600 +token_max_ttl: 600 +audience: vault diff --git a/policies/kv/service/cephrgw/dashboard-credentials/read.yaml b/policies/kv/service/cephrgw/dashboard-credentials/read.yaml new file mode 100644 index 0000000..bac0710 --- /dev/null +++ b/policies/kv/service/cephrgw/dashboard-credentials/read.yaml @@ -0,0 +1,10 @@ +# Allow the cephrgw-operator to read its Ceph dashboard credentials +--- +rules: + - path: "kv/data/service/cephrgw/dashboard-credentials" + capabilities: + - read + +auth: + k8s/au/syd1: + - cephrgw-operator -- 2.47.3