unkinben
03dc436a89
ci/woodpecker/push/apply Pipeline was successful
## Why - The netbox secrets engine mount + roles land in a follow-up PR (#115); its manage policy must exist first so the deployer can create the engine config and roles the moment that PR applies (policy-first split). ## How - Add `policies/netbox/admin.yaml` granting the deployer `netbox/config`, `netbox/config/rotate` and `netbox/roles/*` (deliberately excludes `netbox/creds/*`), bound to the `tf_vault` AppRole and `woodpecker_terraform_vault` k8s role, mirroring the gpg/gitea admin policies. Land this before #115 (the engine mount + roles). Reviewed-on: #116 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
# Allow the vault deployer to manage the netbox token secrets engine: its
|
|
# connection config (seeded admin token), in-place token rotation, and
|
|
# token-minting roles.
|
|
#
|
|
# Scoped to netbox/* only, and deliberately excludes netbox/creds/* - minting
|
|
# tokens is for consumers, not the deployer. The plugin-catalog grant needed to
|
|
# import the plugin is the shared, sudo-protected wildcard in
|
|
# policies/sys/plugins/catalog/admin.yaml (already covers this plugin), and
|
|
# mounting the engine uses the deployer's existing sys/mounts/* access, so no
|
|
# new catalog/mount grant is added here (mirrors the gitea/rancher engines).
|
|
---
|
|
rules:
|
|
# Engine connection config (NetBox URL, TLS, token_version, seeded admin token).
|
|
- path: "netbox/config"
|
|
capabilities:
|
|
- create
|
|
- read
|
|
- update
|
|
- delete
|
|
# In-place rotation of the seeded admin token (write-only trigger).
|
|
- path: "netbox/config/rotate"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
# Token-minting roles.
|
|
- path: "netbox/roles/*"
|
|
capabilities:
|
|
- create
|
|
- read
|
|
- update
|
|
- delete
|
|
- list
|
|
- path: "netbox/roles"
|
|
capabilities:
|
|
- read
|
|
- list
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|