T5: Vault per-app identity groups + policies #6

New issue

Closed

opened 2026-08-11 15:20:37 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-08-11 15:20:37 +00:00

Owner

Parent

Spec: catalog-driven app bootstrapping and capability groups (#2)

What to build

Per-app Vault identity groups + aliases on both mounts (oidc, oidc-cli) mapping capability groups to Vault policies — generated/manual CRUD per class, root both — so developers get Vault secret access at the right class, without k8s-auth-for-humans.

Acceptance criteria

app_secrets module maps capability groups to Vault identity groups + policies per ADR-0007 (generated-secret-manager CRUD generated/<app>; manual-secret-manager CRUD manual/<app>; root both)
one alias per group per mount (oidc + oidc-cli), respecting the one-alias-per-group constraint
drop the placeholder k8s-auth variables (kubernetes_host/token_reviewer_jwt/trusted_ca_cert) — contradicts ADR-0004 VSO read path
tofu validate + tofu plan pass

Blocked by

T1: Fix provider resolution + catalog schema (prefactor) (#3)

## Parent Spec: catalog-driven app bootstrapping and capability groups (#2) ## What to build Per-app Vault identity groups + aliases on both mounts (oidc, oidc-cli) mapping capability groups to Vault policies — generated/manual CRUD per class, root both — so developers get Vault secret access at the right class, without k8s-auth-for-humans. ## Acceptance criteria - [ ] app_secrets module maps capability groups to Vault identity groups + policies per ADR-0007 (generated-secret-manager CRUD `generated/<app>`; manual-secret-manager CRUD `manual/<app>`; root both) - [ ] one alias per group per mount (oidc + oidc-cli), respecting the one-alias-per-group constraint - [ ] drop the placeholder k8s-auth variables (kubernetes_host/token_reviewer_jwt/trusted_ca_cert) — contradicts ADR-0004 VSO read path - [ ] `tofu validate` + `tofu plan` pass ## Blocked by - T1: Fix provider resolution + catalog schema (prefactor) (#3)

ginjiruu referenced this issue

2026-08-11 15:20:44 +00:00

T7: Root wiring + pilot apps (integration) #9

ginjiruu added the

ready-for-agent

label

2026-08-11 15:20:57 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-08-11 17:37:00 +00:00

T5: Vault per-app identity groups + policies #19

ginjiruu closed this issue

2026-08-11 17:45:22 +00:00