b14ff2796c
Some checks were skipped
public bin cache / build + push to preem:grid (push) Has been skipped
The bao UI at bao-ui.<swarm> took a raw store token and nothing else. It now offers an OIDC tab: authelia's `admins` group logs in and lands on `swarm-operator-viewer`, which is list+read on `secret/metadata/*` and nothing under `secret/data/` or `sys/`. - authelia registers an interactive client `swarm-bao-ui` (glue-bao-ui-oidc-client.nix) with redirect `https://bao-ui.<swarm>/ui/vault/auth/oidc/oidc/callback`; the secret publisher carries its secret to `secret/swarm/services/swarm-bao-ui/oidc/client`. - `swarm-bao-granter-role` (bootstrap token) enables the `oidc` auth mount with listing visibility `unauth`, asked before attempted like cert/approle; `bao-bootstrap-policy.hcl` gains `sys/auth/oidc`. - The granter's policy gains `auth/oidc/config`, `auth/oidc/role/swarm-*` and read on that one secret leaf. It still holds no `sys/auth`. - New granting unit `swarm-bao-operator-viewer-policy` writes the viewer policy, and once the granter may configure `auth/oidc/config` (checked through `sys/capabilities-self`), writes the mount's config from the published secret and the role binding `groups=admins` to the viewer. Before the bootstrap step re-runs it writes the policy, logs the step and exits 0. Route (a) per mara on #4775: enabling the auth method stays a bootstrap-token step, re-run once on the live store. module-eval pins the viewer policy's single metadata stanza, that the granter's policy has no sys/auth path, the oidc enable in the bootstrap unit, the exit-0 path, the config/role contents, and the client registration + publish.
41 lines
1.3 KiB
HCL
41 lines
1.3 KiB
HCL
# The `bao-bootstrap` policy: what the 24h bootstrap token may do, and nothing
|
|
# else. ../../docs/getting-started/setup.md has the operator write it with the
|
|
# root token, from the copy ./swarm-bao.nix ships at
|
|
# /etc/hyperhive/bao-bootstrap-policy.hcl; `swarm-bao-granter-role` then acts
|
|
# with it. Every other grant is written by the `bao-granter` principal this
|
|
# creates.
|
|
#
|
|
# Named outside `swarm-*`, so the granter cannot rewrite the policy the next
|
|
# bootstrap token carries.
|
|
#
|
|
# Each stanza was derived with `bao <cmd> -output-policy`, which prints what a
|
|
# command requires without sending it. ../module-eval/bao-grants.nix reads
|
|
# this file and fails when the unit that uses the token calls a path it does
|
|
# not grant.
|
|
|
|
# The auth mounts. Reading `sys/auth` is how the unit checks, and `sudo` is
|
|
# what enabling one costs.
|
|
path "sys/auth" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "sys/auth/cert" {
|
|
capabilities = ["create", "update", "sudo"]
|
|
}
|
|
|
|
path "sys/auth/approle" {
|
|
capabilities = ["create", "update", "sudo"]
|
|
}
|
|
|
|
path "sys/auth/oidc" {
|
|
capabilities = ["create", "update", "sudo"]
|
|
}
|
|
|
|
# The granter's own policy and role, and nothing it may write.
|
|
path "sys/policies/acl/bao-granter" {
|
|
capabilities = ["create", "update"]
|
|
}
|
|
|
|
path "auth/cert/certs/bao-granter" {
|
|
capabilities = ["create", "update"]
|
|
}
|