Ben Vincent
6f27546207
The rancher token secrets engine is registered ('imported') into the catalog by
terraform-vault (sys/plugins/catalog, sudo-protected) and configured via the
ranchervaultsecret provider, so the deployer needs catalog access plus write on
the engine's config/service-accounts/roles paths. Without this, apply 403s on
plugin registration and on rancher/* writes.
- Add policies/rancher/admin.yaml granting the tf_vault approle and the
woodpecker_terraform_vault k8s role: catalog sudo on the plugin, and manage on
rancher/{config,service-accounts,roles}.
56 lines
1.4 KiB
YAML
56 lines
1.4 KiB
YAML
# Allow the vault deployer to import the rancher plugin and manage its engine
|
|
# (config, seeded service accounts, and roles).
|
|
#
|
|
# terraform-vault registers the plugin itself (vault_plugin -> sys/plugins/catalog,
|
|
# a sudo-protected path) and manages the engine via the ranchervaultsecret
|
|
# provider, so the deployer needs catalog access on top of the mount access it
|
|
# already has (sys/mounts/*). Without this, apply 403s on the plugin
|
|
# registration and on rancher/{config,service-accounts,roles} writes.
|
|
---
|
|
rules:
|
|
# Import / register (and deregister) the rancher plugin in the catalog.
|
|
- path: "sys/plugins/catalog/secret/vault-plugin-secrets-rancher"
|
|
capabilities:
|
|
- create
|
|
- read
|
|
- update
|
|
- delete
|
|
- sudo
|
|
# Engine connection config.
|
|
- path: "rancher/config"
|
|
capabilities:
|
|
- create
|
|
- read
|
|
- update
|
|
- delete
|
|
# Seeded, auto-rotated service-account tokens (+ manual rotate).
|
|
- path: "rancher/service-accounts/*"
|
|
capabilities:
|
|
- create
|
|
- read
|
|
- update
|
|
- delete
|
|
- list
|
|
- path: "rancher/service-accounts"
|
|
capabilities:
|
|
- read
|
|
- list
|
|
# Token-minting roles.
|
|
- path: "rancher/roles/*"
|
|
capabilities:
|
|
- create
|
|
- read
|
|
- update
|
|
- delete
|
|
- list
|
|
- path: "rancher/roles"
|
|
capabilities:
|
|
- read
|
|
- list
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|