收窄本机 SPIFFE 身份的 KV 权限范围

2026-09-16 17:15:07 +00:00
parent 61f0f864aa
commit f3d8c38d28
3 changed files with 23 additions and 8 deletions
@@ -39,7 +39,8 @@ resource "vault_jwt_auth_backend_role" "local_development" {
    sub = "spiffe://ddupan.top/dev/panxiao81"
  }

-  # local-development grants normal KV v2 read/write plus short-lived SSH
+  # local-development grants normal KV v2 read/write under kv/k8s and kv/infra,
+  # plus short-lived SSH certificate signing.
  # certificate signing; spire-poc only permits lookup and revocation of the
  # caller's own short-lived Bao token.
  token_policies = [