unkin-agent
a19256fdba
ci/woodpecker/push/apply Pipeline was successful
## Why The deployer identities cannot enable the `oidc` auth mount: `POST /v1/sys/auth/oidc` returns 403 because `sys/auth/<path>` (and its `/tune`) is sudo-protected, and `policies/sys/auth/admin.yaml` granted create/update/delete/read/list without `sudo`. ## How - Add exact-path rules for `sys/auth/oidc` and `sys/auth/oidc/tune` to `policies/sys/auth/admin.yaml` with the wildcard's capability set plus `sudo` (exact match wins over the glob, so the set is repeated in full); auth block unchanged. Merge order: apply this, then re-run the master apply so `module.auth_oidc_backend["oidc"]` can create the mount. Reviewed-on: #149 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
35 lines
703 B
YAML
35 lines
703 B
YAML
# Allow creating and management of authentication backends (AppRole, LDAP, etc.)
|
|
---
|
|
rules:
|
|
- path: "sys/auth/*"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- delete
|
|
- read
|
|
- list
|
|
# Enabling/tuning an auth mount is sudo-protected, and an exact path match
|
|
# wins over the wildcard above, so both rules repeat the full capability set.
|
|
- path: "sys/auth/oidc"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- delete
|
|
- read
|
|
- list
|
|
- sudo
|
|
- path: "sys/auth/oidc/tune"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- delete
|
|
- read
|
|
- list
|
|
- sudo
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|