unkinben
d289775e38
ci/woodpecker/push/apply Pipeline was successful
## Why The forthcoming `gitea_secret_backend` + role configuration (separate PR, `benvin/gitea-secret-engine`) is applied by terraform-vault under the deployment identity (`tf_vault` approle / `woodpecker_terraform_vault` k8s role). That identity has no access to the `gitea/` mount yet, so writing the engine's config and roles would 403. This mirrors `policies/rancher/admin.yaml`. ## Change - Add `policies/gitea/admin.yaml` granting the deployer: - create/read/update/delete on `gitea/config` - create/update on `gitea/config/rotate-root` (write-only rotation trigger) - full manage + list on `gitea/roles/*` (and list on `gitea/roles`) - Deliberately excludes `gitea/creds/*` — minting tokens is for consumers, not the deployer. - No new catalog or mount grant: plugin registration is already covered by the shared, sudo-protected wildcard in `policies/sys/plugins/catalog/admin.yaml`, and mounting uses the deployer's existing `sys/mounts/*` access — same as the rancher engine. ## Order Merge and apply this **before** the `benvin/gitea-secret-engine` PR, so the deployer can write the engine config/roles on that apply. https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv Reviewed-on: #100 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
# Allow the vault deployer to manage the gitea token secrets engine: its
|
|
# connection config (seeded admin credentials), in-place root rotation, and
|
|
# token-minting roles.
|
|
#
|
|
# Scoped to gitea/* only, and deliberately excludes gitea/creds/* — minting
|
|
# tokens is for consumers, not the deployer. The plugin-catalog grant needed to
|
|
# import the plugin is the shared, sudo-protected wildcard in
|
|
# policies/sys/plugins/catalog/admin.yaml (already covers this plugin), and
|
|
# mounting the engine uses the deployer's existing sys/mounts/* access, so no
|
|
# new catalog/mount grant is added here (mirrors the rancher engine).
|
|
---
|
|
rules:
|
|
# Engine connection config (Gitea URL, TLS, seeded admin username/password).
|
|
- path: "gitea/config"
|
|
capabilities:
|
|
- create
|
|
- read
|
|
- update
|
|
- delete
|
|
# In-place rotation of the seeded admin password (write-only trigger).
|
|
- path: "gitea/config/rotate-root"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
# Token-minting roles.
|
|
- path: "gitea/roles/*"
|
|
capabilities:
|
|
- create
|
|
- read
|
|
- update
|
|
- delete
|
|
- list
|
|
- path: "gitea/roles"
|
|
capabilities:
|
|
- read
|
|
- list
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|