refactor: reorganize GitOps control plane

policies/legacy/dev/README.md

@@ -0,0 +1,8 @@
+# Legacy policies
+
+These policies were used by permanent AppRole credentials and could modify
+mounts, auth backends and their own policies. They are retained only to make
+the state and credential migration auditable.
+
+No current Terraform root references files in this directory. Revoke the
+legacy AppRoles after the JWT/Kubernetes-authenticated workflow is verified.

policies/legacy/dev/vault-transit-automation-dev.hcl

@@ -0,0 +1,59 @@
+path "transit/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "kv/data/dev/workload/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "kv/metadata/dev/workload/*" {
+  capabilities = ["read", "delete", "list"]
+}
+
+path "sys/internal/ui/mounts/*" {
+  capabilities = ["read"]
+}
+
+path "sys/mounts/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+path "sys/auth/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+path "sys/policies/acl/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "auth/approle/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "auth/token/create" {
+  capabilities = ["update"]
+}
+
+path "auth/token/create-orphan" {
+  capabilities = ["update"]
+}
+
+path "auth/token/revoke" {
+  capabilities = ["update"]
+}
+
+path "auth/token/revoke-accessor" {
+  capabilities = ["update"]
+}
+
+path "auth/token/lookup" {
+  capabilities = ["update"]
+}
+
+path "auth/token/lookup-accessor" {
+  capabilities = ["update"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}

policies/legacy/dev/workload-automation-dev.hcl

@@ -0,0 +1,71 @@
+path "kv/data/dev/platform/postgres/superuser" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "kv/metadata/dev/platform/postgres/superuser" {
+  capabilities = ["read", "delete", "list"]
+}
+
+path "kv/data/dev/platform/postgres/auth-server" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "kv/metadata/dev/platform/postgres/auth-server" {
+  capabilities = ["read", "delete", "list"]
+}
+
+path "kv/data/dev/platform/postgres/keycloak" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "kv/metadata/dev/platform/postgres/keycloak" {
+  capabilities = ["read", "delete", "list"]
+}
+
+path "kv/data/dev/platform/keycloak/bootstrap-admin" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "kv/metadata/dev/platform/keycloak/bootstrap-admin" {
+  capabilities = ["read", "delete", "list"]
+}
+
+path "kv/data/dev/platform/keycloak/client-auth-server" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "kv/metadata/dev/platform/keycloak/client-auth-server" {
+  capabilities = ["read", "delete", "list"]
+}
+
+path "auth/kubernetes/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "auth/approle/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "sys/auth/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+path "sys/mounts/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+path "sys/policies/acl/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "database/config/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "database/roles/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "transit/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}

policies/vault/dev-k3s/auth-db-migration-dev.hcl

@@ -0,0 +1,3 @@
+path "database/creds/auth-db-migration-dev" {
+  capabilities = ["read"]
+}

policies/vault/dev-k3s/auth-server-dev.hcl

@@ -0,0 +1,15 @@
+path "kv/data/dev/platform/postgres/auth-server" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/platform/keycloak/client-auth-server" {
+  capabilities = ["read"]
+}
+
+path "transit/keys/project-auth-jwt" {
+  capabilities = ["read"]
+}
+
+path "transit/sign/project-auth-jwt" {
+  capabilities = ["update"]
+}

policies/vault/dev-k3s/keycloak-client-sync-dev.hcl

@@ -0,0 +1,7 @@
+path "kv/data/dev/platform/keycloak/bootstrap-admin" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/platform/keycloak/client-auth-server" {
+  capabilities = ["read"]
+}

policies/vault/dev-k3s/keycloak-dev.hcl

@@ -0,0 +1,7 @@
+path "kv/data/dev/platform/postgres/keycloak" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/platform/keycloak/bootstrap-admin" {
+  capabilities = ["read"]
+}

policies/vault/dev-k3s/keycloak-operator-dev.hcl

@@ -0,0 +1,3 @@
+path "kv/data/dev/platform/keycloak/bootstrap-admin" {
+  capabilities = ["read"]
+}

policies/vault/dev-k3s/platform-admin-dev.hcl

@@ -0,0 +1,43 @@
+path "kv/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "auth/kubernetes/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "sys/auth/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+path "sys/mounts/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+path "sys/policies/acl/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "database/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "transit/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "auth/token/create-orphan" {
+  capabilities = ["update"]
+}
+
+path "auth/token/lookup" {
+  capabilities = ["update"]
+}
+
+path "sys/storage/raft/snapshot" {
+  capabilities = ["read", "update", "sudo"]
+}
+
+path "sys/storage/raft/snapshot-force" {
+  capabilities = ["update", "sudo"]
+}

policies/vault/dev-k3s/postgres-dev.hcl

@@ -0,0 +1,11 @@
+path "kv/data/dev/platform/postgres/superuser" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/platform/postgres/auth-server" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/platform/postgres/keycloak" {
+  capabilities = ["read"]
+}

policies/vault/dev-k3s/postgres-operator-dev.hcl

@@ -0,0 +1,3 @@
+path "database/creds/postgres-operator-dev" {
+  capabilities = ["read"]
+}

policies/vault/dev-k3s/vault-database-automation-dev.hcl

@@ -0,0 +1,14 @@
+# Managed by vault-core. The database runner may reconcile only the named
+# PostgreSQL connection and dynamic roles owned by the vault-database state.
+
+path "database/config/platform-postgres-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "database/roles/auth-db-migration-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "database/roles/postgres-operator-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}