unkin-agent
31a7abec99
ci/woodpecker/push/apply Pipeline was successful
## Why Grants the Vault access the arrstack engine needs, before any engine resources exist. **PR 2 of 3 (policy)**, stacked on #125 (register). Keeping policy separate from resources honours the never-bundle / sequential-apply rule. ## Change - Adds `policies/arrstack/admin.yaml`: the terraform-vault deployer (`tf_vault` approle + `woodpecker_terraform_vault` k8s role) may create/read/update/delete `arrstack/config` and manage `arrstack/roles/*`. - Adds `policies/kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token/read.yaml`: the deployer may read the KV-seeded arrproxy admin token (both `kv/data/...` and `kv/metadata/...`) that the engine config sources. The existing `secret_backends_read` policy does not cover this `kubernetes/namespace` KV path. - Adds `policies/arrstack/creds/{sonarr,radarr,prowlarr}.yaml`: each `terraform-<app>` run may read its own `arrstack/creds/<app>` to mint a scoped key. - Policy YAMLs are auto-discovered by `policies/policies.hcl`, so no wiring changes are needed. ## Apply order Apply **after PR #125 (register)**. Safe to apply before the engine exists — these only grant capabilities on paths. ## Stack 1. register -> #125 2. **policy (this PR)** -> `benvin/arrstack-policy` off `benvin/arrstack-register` 3. resources -> `benvin/arrstack-resources` Supersedes #124. Reviewed-on: #126 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
23 lines
920 B
YAML
23 lines
920 B
YAML
# Allow the terraform-vault deployer to read the seeded arrproxy admin token so
|
|
# the arrstack engine config module can source it. The token is seeded by
|
|
# argocd-apps #384 at kv/kubernetes/namespace/arrstack/default/arrproxy-admin-token.
|
|
# The deployer's existing secret_backends_read policy only covers
|
|
# kv/data/service/vault/+/+/secret_backend/*, which does not match this
|
|
# kubernetes/namespace path, so this adds the minimal read grant rather than
|
|
# duplicating the secret into the litellm-style path. vault_kv_secret_v2 also
|
|
# reads the kv-v2 metadata path on every plan/apply, so grant that too.
|
|
---
|
|
rules:
|
|
- path: "kv/data/kubernetes/namespace/arrstack/default/arrproxy-admin-token"
|
|
capabilities:
|
|
- read
|
|
- path: "kv/metadata/kubernetes/namespace/arrstack/default/arrproxy-admin-token"
|
|
capabilities:
|
|
- read
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|