Luke Granger-Brown
7592e76a31
tokend is responsible for issuing service-scoped tokens based on the token held and generated by the Vault Agent. It can also generate "server-user" scoped tokens, which exist for convenience's sake: they are not a strong attestation of the user on the machine, and have limited privileges compared to a Vault token issued using e.g. `vault login -method=oidc`.
32 lines
670 B
HCL
32 lines
670 B
HCL
# Allow everyone to manage things under kv/server/<user>
|
|
path "kv/data/server/{{identity.entity.name}}/*" {
|
|
capabilities = ["create", "update", "read", "delete"]
|
|
}
|
|
|
|
path "kv/metadata/server/{{identity.entity.name}}/*" {
|
|
capabilities = ["list"]
|
|
}
|
|
path "kv/metadata/server" {
|
|
capabilities = ["list"]
|
|
}
|
|
|
|
path "kv/metadata/+" {
|
|
capabilities = ["list"]
|
|
}
|
|
|
|
path "acme/certs/*" {
|
|
capabilities = ["create"]
|
|
}
|
|
|
|
# Servers can always get nix-daemon data
|
|
path "kv/data/apps/nix-daemon" {
|
|
capabilities = ["read"]
|
|
}
|
|
path "kv/metadata/apps/nix-daemon" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
# Servers can issue sub-tokens.
|
|
path "auth/token/create" {
|
|
capabilities = ["update"]
|
|
}
|