Merge pull request '授权本机 SPIFFE 身份访问开发服务' (#76) from feat/spire-host-development into main

Reviewed-on: #76

apps/zot/values.yaml

@@ -71,6 +71,19 @@ configFiles:
         "accessControl": {
           "repositories": {
             "**": {
+              "policies": [
+                {
+                  "users": [
+                    "spiffe://ddupan.top/dev/panxiao81"
+                  ],
+                  "actions": [
+                    "read",
+                    "create",
+                    "update",
+                    "delete"
+                  ]
+                }
+              ],
               "defaultPolicy": [
                 "read"
               ]

infrastructure/openbao/terraform/auth-spire.tf

@@ -25,3 +25,28 @@ resource "vault_jwt_auth_backend_role" "spire_poc" {
   token_ttl               = 300
   token_max_ttl           = 900
 }
+
+# Local development on the laptop. Keep the subject exact: possession of any
+# other identity in the trust domain must not grant interactive host access.
+resource "vault_jwt_auth_backend_role" "local_development" {
+  backend   = vault_jwt_auth_backend.spire.path
+  role_name = "local-development"
+  role_type = "jwt"
+
+  user_claim      = "sub"
+  bound_audiences = ["openbao"]
+  bound_claims = {
+    sub = "spiffe://ddupan.top/dev/panxiao81"
+  }
+
+  # local-development grants normal KV v2 read/write plus short-lived SSH
+  # certificate signing; spire-poc only permits lookup and revocation of the
+  # caller's own short-lived Bao token.
+  token_policies = [
+    vault_policy.local_development.name,
+    vault_policy.spire_poc.name,
+  ]
+  token_no_default_policy = true
+  token_ttl               = 300
+  token_max_ttl           = 900
+}

infrastructure/openbao/terraform/policies.tf

@@ -14,6 +14,11 @@ resource "vault_policy" "ai_agent_ssh" {
   policy = file("${path.module}/policies/ai-agent-ssh.hcl")
 }
 
+resource "vault_policy" "local_development" {
+  name   = "local-development"
+  policy = file("${path.module}/policies/local-development.hcl")
+}
+
 resource "vault_policy" "spire_poc" {
   name   = "spire-poc"
   policy = file("${path.module}/policies/spire-poc.hcl")

infrastructure/openbao/terraform/policies/local-development.hcl

@@ -0,0 +1,19 @@
+# Local development identity. This policy deliberately permits normal KV v2
+# reads and writes but excludes soft-delete, metadata deletion, permanent
+# version destruction, auth administration, and privileged operations.
+path "kv/data/*" {
+  capabilities = ["create", "read", "update"]
+}
+
+path "kv/metadata" {
+  capabilities = ["read", "list"]
+}
+
+path "kv/metadata/*" {
+  capabilities = ["read", "list"]
+}
+
+# Sign disposable SSH public keys for short-lived development access.
+path "ssh-client-signer/sign/ai-agent" {
+  capabilities = ["create", "update"]
+}

platform/spire/README.md

@@ -66,6 +66,17 @@ export SPIFFE_ENDPOINT_SOCKET=unix:///run/spire/agent-sockets/spire-agent.sock
 进程。`ClusterStaticEntry.spec.parentID` 绑定当前 `laptop` Kubernetes node UID；若
 节点被删除后重建，需从 `spire-server agent list` 取得新 Agent ID 并同步更新该字段。
 
+下游授权仅绑定这个精确 SPIFFE ID：
+
+- OpenBao `auth/jwt-spire/role/local-development` 接受 `aud=openbao`，签发 5 分钟
+  token；允许读取和写入整个 KV v2 engine、列出 metadata、签发 `ai-agent` SSH
+  短证书，以及查询、撤销自身 token；不允许删除/永久销毁 KV 数据或管理 auth；
+- zot 接受 `aud=zot`，允许本机开发身份对所有 repository 执行
+  `read/create/update/delete`；其他 SPIFFE 身份仍保持全仓库只读。
+
+当前没有其他服务直接消费 SPIFFE 身份；Gitea runner 与 dynamic runner 是独立身份
+使用方，NATS、SeaweedFS 等服务尚未通过 SPIFFE 做认证或授权。
+
 稳定的 JWT issuer 预留为：
 
 ```text