Page MenuHomeDevCentral
Files F3928417

D3355.diff
No OneTemporary
Actions

D3355.diff
View Options

diff --git a/roles/vault/bootstrap/files/vault-initialize.sh b/roles/vault/bootstrap/files/vault-initialize.sh
--- a/roles/vault/bootstrap/files/vault-initialize.sh
+++ b/roles/vault/bootstrap/files/vault-initialize.sh
@@ -34,6 +34,12 @@
VAULT_CERTS_PATH=/usr/local/etc/certificates/vault
+# -------------------------------------------------------------
+# Authentication :: token roles
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+vault write auth/token/roles/admin allowed_policies=admin period=30d
+
# -------------------------------------------------------------
# PKI :: root CA
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
diff --git a/roles/vault/policies/files/salt-primary.hcl b/roles/vault/policies/files/salt-primary.hcl
--- a/roles/vault/policies/files/salt-primary.hcl
+++ b/roles/vault/policies/files/salt-primary.hcl
@@ -37,6 +37,7 @@
# Tokens management
#
# :: Create, check, revoke tokens to be used by nodes through Salt
+# :: Create admin token as self-service for ops members
# :: Manage and renew own token
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
@@ -48,6 +49,14 @@
capabilities = ["read"]
}
+path "auth/token/create/admin" {
+ capabilities = ["create", "update"]
+}
+
+path "auth/token/roles/admin" {
+ capabilities = ["read"]
+}
+
path "auth/token/lookup-self" {
capabilities = ["read"]
}
diff --git a/utils/vault/issue-admin-token.py b/utils/vault/issue-admin-token.py
--- a/utils/vault/issue-admin-token.py
+++ b/utils/vault/issue-admin-token.py
@@ -48,7 +48,7 @@
def run(verify):
client = connect_to_vault(verify)
- token = client.auth.token.create(policies=["admin"], ttl="30d")
+ token = client.auth.token.create(role_name="admin", policies=["admin"], ttl="30d")
print(token["auth"]["client_token"])

File Metadata

Mime Type
text/plain
Expires
Mon, Dec 23, 05:05 (14 h, 33 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
2311449
Default Alt Text
D3355.diff (1 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator