配置 SPIRE JWT-SVID 登录 OpenBao

2026-09-13 15:56:08 +00:00
parent 9139f6f1f1
commit c9987122e6
4 changed files with 47 additions and 0 deletions
@@ -0,0 +1,10 @@
+# Intentionally grants no secret access. This policy proves that an exact
+# SPIFFE ID can exchange a JWT-SVID for a bounded OpenBao token and inspect or
+# revoke only that token.
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}