unkin-agent
890d666a53
ci/woodpecker/push/apply Pipeline was successful
Nothing stopped a policy under policies/x/y/ from granting a rule path outside its own directory, so an over-broad grant read as ordinary review noise and only surfaced once applied to Vault. - add tests/test_policies.py: a pydantic model rejecting unknown keys, empty rules and non-Vault capabilities - check every rule path segment-wise against the policy's own directory, stripping the kv-v2 data/metadata segment - relocate the rules that reached outside their directory, carrying capabilities and auth bindings verbatim - run the suite from a local pre-commit hook and from make test Reviewed-on: #158 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
21 lines
338 B
YAML
21 lines
338 B
YAML
# Allow access to manage secret engines (mount, unmount, update)
|
|
---
|
|
rules:
|
|
- path: "sys/mounts/*"
|
|
capabilities:
|
|
- create
|
|
- update
|
|
- delete
|
|
- read
|
|
- list
|
|
- path: "sys/mounts"
|
|
capabilities:
|
|
- read
|
|
- list
|
|
|
|
auth:
|
|
approle:
|
|
- tf_vault
|
|
k8s/au/syd1:
|
|
- woodpecker_terraform_vault
|