unkinben
7da23d47fe
ci/woodpecker/push/apply Pipeline was successful
## Why Wiring the new Rancher token secrets engine into Vault. The deployer registers the plugin (sudo-protected `sys/plugins/catalog`) and configures the engine via the ranchervaultsecret provider, so it needs catalog + engine-path access. Mirrors #88 (gpg). ## Changes - Add `policies/rancher/admin.yaml` granting the `tf_vault` approle and `woodpecker_terraform_vault` k8s role: catalog sudo on `vault-plugin-secrets-rancher`, and manage on `rancher/{config,service-accounts,roles}`. ## Merge order Part 1 of 4. Merge before the plugin-import and backend PRs so apply doesn't 403. (Puppet install + this policy first, then import, then backend.) --------- Co-authored-by: Ben Vincent <neotheo@gmail.com> Reviewed-on: #91 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
20 lines
556 B
YAML
20 lines
556 B
YAML
# Allow the vault deployer to import (register/deregister) the rancher secrets
|
|
# plugin in the catalog. sys/plugins/catalog is sudo-protected, so this lives
|
|
# under policies/sys/ where only a sys code owner can grant it — keeping the
|
|
# rancher engine policy (policies/rancher/) scoped to rancher/* paths.
|
|
---
|
|
rules:
|
|
- path: "sys/plugins/catalog/secret/vault-plugin-secrets-rancher"
|
|
capabilities:
|
|
- create
|
|
- read
|
|
- update
|
|
- delete
|
|
- sudo
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|