From 64b1acd6c3e850c40993c7df97d4c92f42142ec8 Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Wed, 16 Sep 2026 17:06:27 +0000
Subject: [PATCH] =?UTF-8?q?=E6=8E=88=E6=9D=83=E6=9C=AC=E6=9C=BA=20SPIFFE?=
 =?UTF-8?q?=20=E8=BA=AB=E4=BB=BD=E8=AE=BF=E9=97=AE=E5=BC=80=E5=8F=91?=
 =?UTF-8?q?=E6=9C=8D=E5=8A=A1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 apps/zot/values.yaml                          | 13 ++++++++++
 .../openbao/terraform/auth-spire.tf           | 25 +++++++++++++++++++
 infrastructure/openbao/terraform/policies.tf  |  5 ++++
 .../terraform/policies/local-development.hcl  | 19 ++++++++++++++
 platform/spire/README.md                      | 11 ++++++++
 5 files changed, 73 insertions(+)
 create mode 100644 infrastructure/openbao/terraform/policies/local-development.hcl

diff --git a/apps/zot/values.yaml b/apps/zot/values.yaml
index 9aa72f4..d913d71 100644
--- a/apps/zot/values.yaml
+++ b/apps/zot/values.yaml
@@ -71,6 +71,19 @@ configFiles:
         "accessControl": {
           "repositories": {
             "**": {
+              "policies": [
+                {
+                  "users": [
+                    "spiffe://ddupan.top/dev/panxiao81"
+                  ],
+                  "actions": [
+                    "read",
+                    "create",
+                    "update",
+                    "delete"
+                  ]
+                }
+              ],
               "defaultPolicy": [
                 "read"
               ]
diff --git a/infrastructure/openbao/terraform/auth-spire.tf b/infrastructure/openbao/terraform/auth-spire.tf
index 976d8f2..4139559 100644
--- a/infrastructure/openbao/terraform/auth-spire.tf
+++ b/infrastructure/openbao/terraform/auth-spire.tf
@@ -25,3 +25,28 @@ resource "vault_jwt_auth_backend_role" "spire_poc" {
   token_ttl               = 300
   token_max_ttl           = 900
 }
+
+# Local development on the laptop. Keep the subject exact: possession of any
+# other identity in the trust domain must not grant interactive host access.
+resource "vault_jwt_auth_backend_role" "local_development" {
+  backend   = vault_jwt_auth_backend.spire.path
+  role_name = "local-development"
+  role_type = "jwt"
+
+  user_claim      = "sub"
+  bound_audiences = ["openbao"]
+  bound_claims = {
+    sub = "spiffe://ddupan.top/dev/panxiao81"
+  }
+
+  # local-development grants normal KV v2 read/write plus short-lived SSH
+  # certificate signing; spire-poc only permits lookup and revocation of the
+  # caller's own short-lived Bao token.
+  token_policies = [
+    vault_policy.local_development.name,
+    vault_policy.spire_poc.name,
+  ]
+  token_no_default_policy = true
+  token_ttl               = 300
+  token_max_ttl           = 900
+}
diff --git a/infrastructure/openbao/terraform/policies.tf b/infrastructure/openbao/terraform/policies.tf
index e057d47..9010a21 100644
--- a/infrastructure/openbao/terraform/policies.tf
+++ b/infrastructure/openbao/terraform/policies.tf
@@ -14,6 +14,11 @@ resource "vault_policy" "ai_agent_ssh" {
   policy = file("${path.module}/policies/ai-agent-ssh.hcl")
 }
 
+resource "vault_policy" "local_development" {
+  name   = "local-development"
+  policy = file("${path.module}/policies/local-development.hcl")
+}
+
 resource "vault_policy" "spire_poc" {
   name   = "spire-poc"
   policy = file("${path.module}/policies/spire-poc.hcl")
diff --git a/infrastructure/openbao/terraform/policies/local-development.hcl b/infrastructure/openbao/terraform/policies/local-development.hcl
new file mode 100644
index 0000000..7494d91
--- /dev/null
+++ b/infrastructure/openbao/terraform/policies/local-development.hcl
@@ -0,0 +1,19 @@
+# Local development identity. This policy deliberately permits normal KV v2
+# reads and writes but excludes soft-delete, metadata deletion, permanent
+# version destruction, auth administration, and privileged operations.
+path "kv/data/*" {
+  capabilities = ["create", "read", "update"]
+}
+
+path "kv/metadata" {
+  capabilities = ["read", "list"]
+}
+
+path "kv/metadata/*" {
+  capabilities = ["read", "list"]
+}
+
+# Sign disposable SSH public keys for short-lived development access.
+path "ssh-client-signer/sign/ai-agent" {
+  capabilities = ["create", "update"]
+}
diff --git a/platform/spire/README.md b/platform/spire/README.md
index 8777651..0e02e7e 100644
--- a/platform/spire/README.md
+++ b/platform/spire/README.md
@@ -66,6 +66,17 @@ export SPIFFE_ENDPOINT_SOCKET=unix:///run/spire/agent-sockets/spire-agent.sock
 进程。`ClusterStaticEntry.spec.parentID` 绑定当前 `laptop` Kubernetes node UID；若
 节点被删除后重建，需从 `spire-server agent list` 取得新 Agent ID 并同步更新该字段。
 
+下游授权仅绑定这个精确 SPIFFE ID：
+
+- OpenBao `auth/jwt-spire/role/local-development` 接受 `aud=openbao`，签发 5 分钟
+  token；允许读取和写入整个 KV v2 engine、列出 metadata、签发 `ai-agent` SSH
+  短证书，以及查询、撤销自身 token；不允许删除/永久销毁 KV 数据或管理 auth；
+- zot 接受 `aud=zot`，允许本机开发身份对所有 repository 执行
+  `read/create/update/delete`；其他 SPIFFE 身份仍保持全仓库只读。
+
+当前没有其他服务直接消费 SPIFFE 身份；Gitea runner 与 dynamic runner 是独立身份
+使用方，NATS、SeaweedFS 等服务尚未通过 SPIFFE 做认证或授权。
+
 稳定的 JWT issuer 预留为：
 
 ```text