coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: add auth-capability lanes and pilot closeout

Browse source 
Add the warden-sign auth-capability lane, AppRole handoff, verification guards, docs, and tests.

Point the whynot-design pilot at the canonical decision and add the real publish closeout preflight/runbook.
This commit is contained in:
tegwick 2026-06-29 16:58:16 +02:00
parent a621fbaffd
commit 6382139890
27 changed files with 1455 additions and 107 deletions
Download patch file Download diff file Expand all files Collapse all files

16
policies/secrets-engine-prod.hcl
View file

@ -26,6 +26,11 @@ path "sys/policies/acl/se-prod-*" {
capabilities = ["create", "read", "update", "delete"]
}
# Exact exception for SECRETS-WP-0004 auth-capability lane.
path "sys/policies/acl/warden-sign" {
capabilities = ["create", "read", "update", "delete"]
}
# Manage prod approle roles only.
path "auth/approle/role/se-prod-*" {
capabilities = ["create", "read", "update", "delete"]
@ -37,6 +42,17 @@ path "auth/approle/role/se-prod-*/secret-id" {
capabilities = ["create", "update"]
}
# Exact exception for SECRETS-WP-0004 auth-capability lane.
path "auth/approle/role/warden-sign" {
capabilities = ["create", "read", "update", "delete"]
}
path "auth/approle/role/warden-sign/role-id" {
capabilities = ["read"]
}
path "auth/approle/role/warden-sign/secret-id" {
capabilities = ["create", "update"]
}
# Hard denials — production appliers must not become broad admins.
path "secret/data/build/*" { capabilities = ["deny"] }
path "secret/data/test/*" { capabilities = ["deny"] }