To allow a self-service token generation in Complector, allows the
Salt primary policy to issue tokens for the admin role.
Ref T1975.
Details
Details
- Reviewers
DorianWinty - Maniphest Tasks
- T1975: Allow ops to login to Vault
- Commits
- rOPS4fdae60b2437: Allow Salt policy to create admin-level tokens
Issue an admin token with salt-primary policy
Diff Detail
Diff Detail
- Repository
- rOPS Nasqueron Operations
- Lint
Lint Passed - Unit
No Test Coverage - Branch
- vault-self-service-token-policy
- Build Status
Buildable 5333 Build 5614: arc lint + arc unit
Event Timeline
Comment Actions
This is not the correct paths -> Salt returns a 403 when using this policy.
It works with an overkill path "auth/*".
Comment Actions
By the way, the token used by Salt has the following properties:
metadata: {'role_name': 'salt_primary'}
policies: ['default', 'salt', 'salt-node-complector']It means the policies read are salt (stable) and salt-node-complector (depends of the server name).
Comment Actions
To be able to use auth/token/create/admin, it needs a role admin, let's add it to the DRP bootstrap script:
vault write auth/token/roles/admin allowed_policies=admin period=30d