bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vault: allow maintenance auth sync

Browse Source
This commit is contained in:
Brad Stein 2026-02-07 03:13:53 -03:00
parent 411ad0e4ba
commit 0bab0deedf
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
services/vault/scripts/vault_k8s_auth_configure.sh
View File

@ -137,6 +137,28 @@ path \"kv/metadata/atlas/${path}\" {
} }
" "
done done
if [ "${role}" = "maintenance" ]; then
policy_body="${policy_body}
path \"sys/auth\" {
capabilities = [\"read\"]
}
path \"sys/auth/*\" {
capabilities = [\"create\", \"update\", \"read\", \"sudo\"]
}
path \"auth/kubernetes/*\" {
capabilities = [\"create\", \"update\", \"read\"]
}
path \"auth/oidc/*\" {
capabilities = [\"create\", \"update\", \"read\"]
}
path \"sys/policies/acl\" {
capabilities = [\"list\"]
}
path \"sys/policies/acl/*\" {
capabilities = [\"create\", \"update\", \"read\"]
}
"
fi
log "writing policy ${role}" log "writing policy ${role}"
printf '%s\n' "${policy_body}" | vault_cmd policy write "${role}" - printf '%s\n' "${policy_body}" | vault_cmd policy write "${role}" -