收窄本机 SPIFFE 身份的 KV 权限范围

infrastructure/openbao/terraform/auth-spire.tf

@@ -39,7 +39,8 @@ resource "vault_jwt_auth_backend_role" "local_development" {
     sub = "spiffe://ddupan.top/dev/panxiao81"
   }
 
-  # local-development grants normal KV v2 read/write plus short-lived SSH
+  # local-development grants normal KV v2 read/write under kv/k8s and kv/infra,
+  # plus short-lived SSH certificate signing.
   # certificate signing; spire-poc only permits lookup and revocation of the
   # caller's own short-lived Bao token.
   token_policies = [

infrastructure/openbao/terraform/policies/local-development.hcl

@@ -1,15 +1,28 @@
-# Local development identity. This policy deliberately permits normal KV v2
+# Local development identity. Limit normal KV v2 reads and writes to the k8s
-# reads and writes but excludes soft-delete, metadata deletion, permanent
+# subtree, and exclude soft-delete, metadata deletion, permanent version
-# version destruction, auth administration, and privileged operations.
+# destruction, auth administration, and privileged operations.
-path "kv/data/*" {
+path "kv/data/k8s/*" {
   capabilities = ["create", "read", "update"]
 }
 
-path "kv/metadata" {
+path "kv/metadata/k8s" {
   capabilities = ["read", "list"]
 }
 
-path "kv/metadata/*" {
+path "kv/metadata/k8s/*" {
+  capabilities = ["read", "list"]
+}
+
+# Future destination for infrastructure secrets migrated from Ansible Vault.
+path "kv/data/infra/*" {
+  capabilities = ["create", "read", "update"]
+}
+
+path "kv/metadata/infra" {
+  capabilities = ["read", "list"]
+}
+
+path "kv/metadata/infra/*" {
   capabilities = ["read", "list"]
 }
 

platform/spire/README.md

@@ -69,7 +69,8 @@ export SPIFFE_ENDPOINT_SOCKET=unix:///run/spire/agent-sockets/spire-agent.sock
 下游授权仅绑定这个精确 SPIFFE ID：
 
 - OpenBao `auth/jwt-spire/role/local-development` 接受 `aud=openbao`，签发 5 分钟
-  token；允许读取和写入整个 KV v2 engine、列出 metadata、签发 `ai-agent` SSH
+  token；允许读取和写入 KV v2 的 `kv/k8s/*` 与 `kv/infra/*` 子树、列出对应
+  metadata、签发 `ai-agent` SSH
   短证书，以及查询、撤销自身 token；不允许删除/永久销毁 KV 数据或管理 auth；
 - zot 接受 `aud=zot`，允许本机开发身份对所有 repository 执行
   `read/create/update/delete`；其他 SPIFFE 身份仍保持全仓库只读。