If a server lose access to any policy, it would keep the last state.
Instead, we now submit a new policy "intentionally left blank"
to explicitly document that node doesn't have access to anything.
This is a follow-up for af9db00760be.
Ref T1425.
Details
Details
- Reviewers
DorianWinty dereckson - Maniphest Tasks
- T1425: Provision secrets through Salt
- Commits
- rOPS15526ba96582: Avoid a server to keep access to stale Vault policies
salt-call --local credentials.build_policies_by_node
Tested on Complector, we've a correct set of policies for every node.
Diff Detail
Diff Detail
- Repository
- rOPS Nasqueron Operations
- Lint
Lint Passed - Unit
No Test Coverage - Branch
- docker-vault-policies-blank
- Build Status
Buildable 4188 Build 4440: arc lint + arc unit