unkin-agent
7d13c0442b
The auth/oidc modules in benvin/auth-oidc write auth/oidc/config, auth/oidc/role/* and external identity groups/aliases. AppRole capabilities are fixed at login, so the deployer must already hold these grants when that apply runs. Add policies/auth/oidc/admin.yaml and policies/identity/group/admin.yaml, split out of #147 per the never-bundle rule.
39 lines
896 B
YAML
39 lines
896 B
YAML
# Allow the deployer to manage external identity groups and their aliases, which
|
|
# is how OIDC group membership (the ak_groups claim) maps onto Vault policies.
|
|
# Both the collection endpoints and the per-id endpoints are needed: create posts
|
|
# to identity/group, subsequent reads and updates address identity/group/id/<id>.
|
|
---
|
|
rules:
|
|
- path: "identity/group"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- path: "identity/group/*"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- read
|
|
- delete
|
|
- list
|
|
- path: "identity/group-alias"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- path: "identity/group-alias/*"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- read
|
|
- delete
|
|
- list
|
|
- path: "identity/lookup/group"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|