配置 SPIRE JWT-SVID 登录 OpenBao

infrastructure/openbao/terraform/auth-spire.tf

@@ -0,0 +1,27 @@
+# Workload authentication via SPIFFE JWT-SVIDs. The discovery document and
+# JWKS contain public verification material, so this backend carries no secret.
+resource "vault_jwt_auth_backend" "spire" {
+  path               = "jwt-spire"
+  description        = "SPIFFE JWT-SVID workload authentication"
+  oidc_discovery_url = "https://spire-oidc.ad.ddupan.top"
+  bound_issuer       = "https://spire-oidc.ad.ddupan.top"
+}
+
+# First end-to-end identity. Keep the subject exact: this role is deliberately
+# not a wildcard escape hatch for every workload in the trust domain.
+resource "vault_jwt_auth_backend_role" "spire_poc" {
+  backend   = vault_jwt_auth_backend.spire.path
+  role_name = "spire-poc"
+  role_type = "jwt"
+
+  user_claim      = "sub"
+  bound_audiences = ["openbao"]
+  bound_claims = {
+    sub = "spiffe://ddupan.top/ns/spire-poc/sa/spire-jwt-poc"
+  }
+
+  token_policies          = [vault_policy.spire_poc.name]
+  token_no_default_policy = true
+  token_ttl               = 300
+  token_max_ttl           = 900
+}

infrastructure/openbao/terraform/policies.tf

@@ -14,6 +14,11 @@ resource "vault_policy" "ai_agent_ssh" {
   policy = file("${path.module}/policies/ai-agent-ssh.hcl")
 }
 
+resource "vault_policy" "spire_poc" {
+  name   = "spire-poc"
+  policy = file("${path.module}/policies/spire-poc.hcl")
+}
+
 resource "vault_policy" "snapshot" {
   name   = "snapshot"
   policy = file("${path.module}/policies/snapshot.hcl")

infrastructure/openbao/terraform/policies/spire-poc.hcl

@@ -0,0 +1,10 @@
+# Intentionally grants no secret access. This policy proves that an exact
+# SPIFFE ID can exchange a JWT-SVID for a bounded OpenBao token and inspect or
+# revoke only that token.
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}

platform/spire/README.md

@@ -76,6 +76,11 @@ Agent 应通过 PSAT attestation 注册，CSI Driver 应在节点 Ready。
 首个业务验收另行增加一个专用测试 Pod 与 `ClusterSPIFFEID`，验证取得
 `aud=openbao` 的 JWT-SVID 后登录 OpenBao。PoC 完成前不修改生产认证方式。
 
+OpenBao 中对应的 Terraform 资源位于
+`../../infrastructure/openbao/terraform/auth-spire.tf`。PoC role 只接受精确 subject
+`spiffe://ddupan.top/ns/spire-poc/sa/spire-jwt-poc`，token 不包含 default policy，
+且 `spire-poc` policy 不允许读取任何业务 secret。
+
 ## 恢复边界
 
 - 恢复顺序：共享 PostgreSQL、SPIRE Server signing-key PVC、SPIRE Server、Agent；