init: 아르고cd, vault 기반 인프라 설계

runbooks/vault-transit/dev/policies/vault-transit-admin-dev.hcl

@@ -0,0 +1,39 @@
+path "transit/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "kv/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "sys/internal/ui/mounts/*" {
+  capabilities = ["read"]
+}
+
+path "sys/mounts/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+path "sys/auth/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+path "sys/policies/acl/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "auth/approle/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "auth/token/create-orphan" {
+  capabilities = ["update"]
+}
+
+path "auth/token/revoke" {
+  capabilities = ["update"]
+}
+
+path "auth/token/lookup" {
+  capabilities = ["update"]
+}

runbooks/vault-transit/dev/policies/vault-transit-automation-dev.hcl

@@ -0,0 +1,59 @@
+path "transit/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "kv/data/dev/workload/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "kv/metadata/dev/workload/*" {
+  capabilities = ["read", "delete", "list"]
+}
+
+path "sys/internal/ui/mounts/*" {
+  capabilities = ["read"]
+}
+
+path "sys/mounts/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+path "sys/auth/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+path "sys/policies/acl/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "auth/approle/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "auth/token/create" {
+  capabilities = ["update"]
+}
+
+path "auth/token/create-orphan" {
+  capabilities = ["update"]
+}
+
+path "auth/token/revoke" {
+  capabilities = ["update"]
+}
+
+path "auth/token/revoke-accessor" {
+  capabilities = ["update"]
+}
+
+path "auth/token/lookup" {
+  capabilities = ["update"]
+}
+
+path "auth/token/lookup-accessor" {
+  capabilities = ["update"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}

runbooks/vault-transit/dev/policies/workload-vault-transit-dev.hcl

@@ -0,0 +1,15 @@
+path "transit/encrypt/workload-vault-dev-unseal" {
+  capabilities = ["update"]
+}
+
+path "transit/decrypt/workload-vault-dev-unseal" {
+  capabilities = ["update"]
+}
+
+path "transit/rewrap/workload-vault-dev-unseal" {
+  capabilities = ["update"]
+}
+
+path "transit/keys/workload-vault-dev-unseal" {
+  capabilities = ["read"]
+}