rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add vault-service-api group for non-human Vault access

Browse Source 
Separate from homelab-admins' blanket grant - target for a future
Vault Identity Group alias scoping service/API tokens narrower than
full admin.
This commit is contained in:
Story Crater Bot
2026-08-26 19:42:12 -07:00
parent a5c7381c11
commit 7e648d2251
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/infra/iam/scripts/authentik-provision.py
+5
View File
@@ -176,6 +176,7 @@ GROUP_PERMISSIONS = {
"immich-admins": ["immich:read", "immich:write"], "immich-admins": ["immich:read", "immich:write"],
"poimen-memory-admins": ["poimen-memory:read", "poimen-memory:write"], "poimen-memory-admins": ["poimen-memory:read", "poimen-memory:write"],
"k8s-devops-admin": ["k8s:devops"], "k8s-devops-admin": ["k8s:devops"],
"vault-service-api": ["vault:read", "vault:write"],
} }
perms = set() perms = set()
for group in request.user.groups.all(): for group in request.user.groups.all():
@@ -268,6 +269,10 @@ SERVICE_ADMIN_GROUP_NAMES = [
"portainer-admins", "kmsvc-admins", "temporal-admins", "llm-admins", "portainer-admins", "kmsvc-admins", "temporal-admins", "llm-admins",
"paperless-admins", "immich-admins", "poimen-memory-admins", "paperless-admins", "immich-admins", "poimen-memory-admins",
"k8s-devops-admin", "k8s-devops-admin",
# Not a human-admin group like the others - Vault Identity Group aliasing
# target for service/API (non-browser) access to Vault, kept separate from
# homelab-admins' blanket "*" grant. See k8s/infra/iam/scripts/vault-provision.sh.
"vault-service-api",
] ]
service_admin_groups = {} service_admin_groups = {}
for group_name in SERVICE_ADMIN_GROUP_NAMES: for group_name in SERVICE_ADMIN_GROUP_NAMES: