bstein/ariadne
1
0
Fork 0
Code Issues 3 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore(vault): record Ariadne's SonarQube read path in the role definition

Browse Source 
The sweep needs the quality token, and the grant was applied to the live
policy. Recording it here keeps the definition and the cluster agreeing about
this path.

Note for whoever reconciles this properly: the live maintenance policy grants
22 paths and this list names 7. sync_k8s_auth replaces a role's policy
wholesale from read_paths, so running it today would revoke nextcloud, wger,
firefly, comms and metis access from Ariadne. Its cron is 0 0 1 1 * - once a
year - which is why the drift has survived rather than been caught. Widening
this list to match reality is worth doing deliberately, not as a side effect
of adding one path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
codex 2026-08-06 22:12:49 -03:00
parent f8a529e196
commit 63a8abb743
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ariadne/services/vault_policies.py
View File

@ -129,7 +129,8 @@ K8S_ROLES: list[dict[str, str]] = [
"namespace": "maintenance",
"service_accounts": "ariadne,maintenance-vault-sync",
"read_paths": "maintenance/ariadne-db portal/bstein-dev-home-keycloak-admin mailu/mailu-db-secret "
"mailu/mailu-initial-account-secret comms/synapse-admin shared/harbor-pull",
"mailu/mailu-initial-account-secret comms/synapse-admin shared/harbor-pull "
"quality/sonarqube-oidc",
"write_paths": "",
},
{