Maidn/maidn-cli
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix: bind runtime secret roles to environments

Browse source
This commit is contained in:
eding 2026-09-13 12:18:12 +02:00
parent 217f03d4be
commit 9f1c05a4d4
3 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
docs/secret-grants.md
View file

@ -10,7 +10,7 @@ gets one reviewed grant.
| --- | --- | --- | --- | | --- | --- | --- | --- |
| `build` | declared `apps/<app>/<secret>` entries | `tekton-pipelines` | Read-only dependency credentials | | `build` | declared `apps/<app>/<secret>` entries | `tekton-pipelines` | Read-only dependency credentials |
| `publish` | declared `apps/<app>/<secret>` entries | `tekton-pipelines` | One app's artifact repository credential | | `publish` | declared `apps/<app>/<secret>` entries | `tekton-pipelines` | One app's artifact repository credential |
| `runtime` | declared `apps/<app>/<secret>` entries | `<app>-<environment>` | Service runtime credentials | | `runtime` | declared `apps/<app>/<secret>` entries | `staging` or `production` | Service runtime credentials |
| shared | `shared/<name>/*` | Granted consumer only | Deliberately shared broker, database, or API credentials | | shared | `shared/<name>/*` | Granted consumer only | Deliberately shared broker, database, or API credentials |
`build` code is repository-controlled. Anything granted to it is readable by a `build` code is repository-controlled. Anything granted to it is readable by a
@ -118,8 +118,8 @@ spec:
``` ```
The workload references only `orders-api-rabbitmq` in its own namespace. Each The workload references only `orders-api-rabbitmq` in its own namespace. Each
application/environment needs a separate namespace; do not put runtime application gets a dedicated ServiceAccount, SecretStore, and target Secret in
secrets in shared `staging` or `production` namespaces. the shared environment namespace; do not use another application's identity.
## Artifact repositories ## Artifact repositories

2
internal/openbao/bootstrap.go
View file

@ -400,7 +400,7 @@ func ConfigureSecretGrants(kubeconfig, identityPath, bundlePath string, grants [
namespace := "tekton-pipelines" namespace := "tekton-pipelines"
if grant.Consumer == "runtime" { if grant.Consumer == "runtime" {
name += "-" + grant.Environment name += "-" + grant.Environment
namespace = grant.Application + "-" + grant.Environment namespace = grant.Environment
} }
script.WriteString("cat >/tmp/" + name + ".hcl <<'EOF'\n") script.WriteString("cat >/tmp/" + name + ".hcl <<'EOF'\n")
for _, secret := range grant.Secrets { for _, secret := range grant.Secrets {

2
internal/openbao/bootstrap_test.go
View file

@ -153,7 +153,7 @@ func TestConfigureSecretGrantsScopesApplicationAndSharedPaths(t *testing.T) {
`secret/data/shared/artifact-cache/*`, `secret/data/shared/artifact-cache/*`,
`secret/data/shared/rabbitmq/*`, `secret/data/shared/rabbitmq/*`,
`bound_service_account_names=maidn-orders-api-publish`, `bound_service_account_names=maidn-orders-api-publish`,
`bound_service_account_namespaces=orders-api-production`, `bound_service_account_namespaces=production`,
} { } {
if !strings.Contains(script, want) { if !strings.Contains(script, want) {
t.Fatalf("secret grant script missing %q: %s", want, script) t.Fatalf("secret grant script missing %q: %s", want, script)