6739bb903d
Every docs directory moves under 1-getting-started, 2-handbook, 4-implementation or 5-project; the options reference (section 3) comes from the website and has no directory here. trust-boundary stays whole under the handbook for now. web-ui, swarm and tools split between handbook and implementation, and the command-line references move to 2-handbook/reference. Links, path references in code and nix, and the docs index follow the moves; no page content changes.
44 lines
1.5 KiB
HCL
44 lines
1.5 KiB
HCL
# The `bao-bootstrap` policy: what the 24h bootstrap token may do, and nothing
|
|
# else. ../../docs/1-getting-started/setup.md has the operator write it with the
|
|
# root token, from the copy ./swarm-bao.nix ships at
|
|
# /etc/hyperhive/bao-bootstrap-policy.hcl; `swarm-bao-granter-role` then acts
|
|
# with it. Every other grant is written by the `bao-granter` principal this
|
|
# creates.
|
|
#
|
|
# Named outside `swarm-*`, so the granter cannot rewrite the policy the next
|
|
# bootstrap token carries.
|
|
#
|
|
# Each stanza was derived with `bao <cmd> -output-policy`, which prints what a
|
|
# command requires without sending it. ../module-eval/bao-grants.nix reads
|
|
# this file and fails when the unit that uses the token calls a path it does
|
|
# not grant.
|
|
|
|
# The auth mounts. Reading `sys/auth` is how the unit checks, and `sudo` is
|
|
# what enabling or disabling one costs.
|
|
path "sys/auth" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "sys/auth/cert" {
|
|
capabilities = ["create", "update", "sudo"]
|
|
}
|
|
|
|
# Nothing mints an approle secret_id; the bootstrap step disables the mount
|
|
# rather than enabling it. `delete` is what `bao auth disable` costs, not
|
|
# `create`/`update` (verified with `bao auth disable -output-policy`).
|
|
path "sys/auth/approle" {
|
|
capabilities = ["delete", "sudo"]
|
|
}
|
|
|
|
path "sys/auth/oidc" {
|
|
capabilities = ["create", "update", "sudo"]
|
|
}
|
|
|
|
# The granter's own policy and role, and nothing it may write.
|
|
path "sys/policies/acl/bao-granter" {
|
|
capabilities = ["create", "update"]
|
|
}
|
|
|
|
path "auth/cert/certs/bao-granter" {
|
|
capabilities = ["create", "update"]
|
|
}
|