senkensha/infra-plugins
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(openbao-session): creator policy needs auth/token/create/* for role-based minting

Browse Source 
Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Adnan Zahir
2026-09-01 11:35:31 +07:00
parent 773d7d50bd
commit ddbdf468e3
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
plugins/openbao-session/README.md
View File

@@ -27,11 +27,15 @@ export BAO_ADDR=https://10.104.0.12:8200
export BAO_CACERT=/opt/openbao/tls/tls.crt export BAO_CACERT=/opt/openbao/tls/tls.crt
export BAO_TOKEN=<token admin Anda> # jangan di-paste ke chat export BAO_TOKEN=<token admin Anda> # jangan di-paste ke chat
# 1. Policy bootstrap: bisa membuat token, TIDAK bisa membaca secret # 1. Policy bootstrap: bisa membuat token, TIDAK bisa membaca secret.
# Wajib menyertakan auth/token/create/* agar pembuatan token via -role (entity-alias) diizinkan.
cat > /tmp/openbao-session-creator.hcl <<'EOF' cat > /tmp/openbao-session-creator.hcl <<'EOF'
path "auth/token/create" { path "auth/token/create" {
capabilities = ["create", "update", "sudo"] capabilities = ["create", "update", "sudo"]
} }
path "auth/token/create/*" {
capabilities = ["create", "update", "sudo"]
}
path "auth/token/renew-self" { capabilities = ["update"] } path "auth/token/renew-self" { capabilities = ["update"] }
path "auth/token/revoke-self" { capabilities = ["update"] } path "auth/token/revoke-self" { capabilities = ["update"] }
path "auth/token/lookup-self" { capabilities = ["read"] } path "auth/token/lookup-self" { capabilities = ["read"] }