T5: Vault per-app identity groups + policies #19

Merged

ginjiruu merged 1 commit from t5-vault-app-identity into master

2026-08-11 17:45:21 +00:00

ginjiruu commented

2026-08-11 17:37:00 +00:00

Owner

Closes #6 (T5)

What

The app_secrets module now maps catalog capability groups to Vault identity
groups, aliases, and per-app policies per ADR-0007:

Policies — one per (app, capability) with full CRUD over the app's KV
class: generated-secret-manager → generated/<app>,
manual-secret-manager → manual/<app>. Root (derived, ADR-0006) gets both
classes via a both template branch.
Identity groups — one per (app, capability) per auth mount
(oidc + oidc-cli), each carrying its policy. The per-mount duplication is
required: a Vault external group holds a single alias, so the two mounts
cannot share one group (see the warning block in vault/main.tf).
Aliases — one per group per mount, named after the Kanidm group SPN
(group-<app>_<capability>@auth.animeteamspeak.moe), matching what the
groups claim emits.
KV schema — generated/<app> and manual/<app> class paths under the
shared secret/ mount (path creation only, no values — ADR-0002).

Verification

task validate — all four roots (forgejo, k8s, kanidm, vault) pass.
tofu plan against live Vault (AppRole runner creds from
vault-config-vars on mini, state seeded from
tfstate-default-vault-config): 34 to add, 0 to change, 0 to destroy —
no drift on the existing 12 managed resources.

Plan shape: 6 policies, 12 identity groups, 12 aliases, 4 KV v2 paths
(2 apps × generated/manual; root produces no path — it is a derived group).

Not applied — tofu-controller picks it up from this repo on merge.

Closes #6 (T5) ## What The `app_secrets` module now maps catalog capability groups to Vault identity groups, aliases, and per-app policies per ADR-0007: - **Policies** — one per (app, capability) with full CRUD over the app's KV class: `generated-secret-manager` → `generated/<app>`, `manual-secret-manager` → `manual/<app>`. Root (derived, ADR-0006) gets both classes via a `both` template branch. - **Identity groups** — one per (app, capability) **per auth mount** (`oidc` + `oidc-cli`), each carrying its policy. The per-mount duplication is required: a Vault external group holds a single alias, so the two mounts cannot share one group (see the warning block in `vault/main.tf`). - **Aliases** — one per group per mount, named after the Kanidm group SPN (`group-<app>_<capability>@auth.animeteamspeak.moe`), matching what the `groups` claim emits. - **KV schema** — `generated/<app>` and `manual/<app>` class paths under the shared `secret/` mount (path creation only, no values — ADR-0002). ## Verification - `task validate` — all four roots (forgejo, k8s, kanidm, vault) pass. - `tofu plan` against live Vault (AppRole runner creds from `vault-config-vars` on mini, state seeded from `tfstate-default-vault-config`): **34 to add, 0 to change, 0 to destroy** — no drift on the existing 12 managed resources. Plan shape: 6 policies, 12 identity groups, 12 aliases, 4 KV v2 paths (2 apps × generated/manual; root produces no path — it is a derived group). Not applied — tofu-controller picks it up from this repo on merge.

ginjiruu added 1 commit

2026-08-11 17:37:00 +00:00

T5: Vault per-app identity groups + policies 5a70e69d10

app_secrets module now maps catalog capability groups to Vault identity
groups, aliases on both oidc + oidc-cli mounts, and per-app policies per
ADR-0007: generated-secret-manager -> generated/<app> CRUD,
manual-secret-manager -> manual/<app> CRUD, root (derived) -> both classes.
One alias per group per mount, honoring the one-alias-per-group constraint.

ginjiruu merged commit 943e24bf33 into master

2026-08-11 17:45:21 +00:00

ginjiruu referenced this pull request from a commit

2026-08-11 17:45:23 +00:00

Merge pull request 'T5: Vault per-app identity groups + policies' (#19) from t5-vault-app-identity into master

ginjiruu deleted branch t5-vault-app-identity

2026-08-11 17:45:24 +00:00