unkin-agent
a3a8854a16
ci/woodpecker/push/apply Pipeline was successful
## Why AppRole capabilities are fixed at login, so the deployer needs `auth/oidc/*` and identity-group grants in an apply that precedes the one creating those resources. ## How - Add `policies/auth/oidc/admin.yaml`: full `auth/oidc/*` administration (mount config and login roles), mirroring `policies/auth/ldap/admin.yaml`. - Add `policies/identity/group/admin.yaml`: manage external identity groups, group aliases and `identity/lookup/group`, on both the collection and per-id endpoints. - Grant both policies to the `tf_vault` approle and the `woodpecker_terraform_vault` k8s role. Apply before #147. Reviewed-on: #148 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
20 lines
449 B
YAML
20 lines
449 B
YAML
# Allow full administration of the OIDC auth backend (mount config and login
|
|
# roles), mirroring policies/auth/ldap/admin.yaml. sys/auth/* already covers
|
|
# enabling the mount itself; this covers writing auth/oidc/config and
|
|
# auth/oidc/role/*.
|
|
---
|
|
rules:
|
|
- path: "auth/oidc/*"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- read
|
|
- delete
|
|
- list
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|