From 63a8abb743e41689f0024d53662757ac9559a276 Mon Sep 17 00:00:00 2001 From: codex Date: Thu, 6 Aug 2026 22:12:49 -0300 Subject: [PATCH] chore(vault): record Ariadne's SonarQube read path in the role definition The sweep needs the quality token, and the grant was applied to the live policy. Recording it here keeps the definition and the cluster agreeing about this path. Note for whoever reconciles this properly: the live maintenance policy grants 22 paths and this list names 7. sync_k8s_auth replaces a role's policy wholesale from read_paths, so running it today would revoke nextcloud, wger, firefly, comms and metis access from Ariadne. Its cron is 0 0 1 1 * - once a year - which is why the drift has survived rather than been caught. Widening this list to match reality is worth doing deliberately, not as a side effect of adding one path. Co-Authored-By: Claude Opus 5 --- ariadne/services/vault_policies.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ariadne/services/vault_policies.py b/ariadne/services/vault_policies.py index 4cbd98e..9ed3253 100644 --- a/ariadne/services/vault_policies.py +++ b/ariadne/services/vault_policies.py @@ -129,7 +129,8 @@ K8S_ROLES: list[dict[str, str]] = [ "namespace": "maintenance", "service_accounts": "ariadne,maintenance-vault-sync", "read_paths": "maintenance/ariadne-db portal/bstein-dev-home-keycloak-admin mailu/mailu-db-secret " - "mailu/mailu-initial-account-secret comms/synapse-admin shared/harbor-pull", + "mailu/mailu-initial-account-secret comms/synapse-admin shared/harbor-pull " + "quality/sonarqube-oidc", "write_paths": "", }, {