Per-client cert policies possible? about puppet-vault_lookup HOT 4 OPEN

Hi, you can have one dynamic policy using the Template variables
identity.entity.aliases.<mount accessor>.name this would be your machine hostname (where <mount accessor> is the name of the cert auth method)

But you cannot add different policy, hope it helps

from puppet-vault_lookup.

Thanks, I was hoping not to make the path itself host specific. An example would be 'host1' and 'host2' have access to /secrets/ssl_key/mysite

Anything come to mind as to this being possible? If not, I'll have to go down a different road.

from puppet-vault_lookup.

Vault 1.10 merges in PR#13348 which will populate the entity alias metadata hash with the cert extensions of the client cert.

So using cert extensions when you sign your agent cert, you should be able to set arbitrary values that you can use in vault to template with.

Though full disclosure, I haven't tried this yet since my vault instance isn't at 1.10 yet.

from puppet-vault_lookup.

I think this is possible you need access to write to the cert authenticator in vault you can then upload puppet's CA cert multiple times associating it with different policies and different sets of common names. those policies then restrict you to a particular kv path

so if you had alice_secrets and a policy puppetcert_alice_secret_access
and bob_secrets and a policy puppetcert_bob_secret _access

you then upload the puppet CA cert with vault like this:
https://www.vaultproject.io/api-docs/auth/cert

vault write auth/cert/certs/puppetcert_alice \
    display_name=alice_secrets_authenticator \
    policies=puppetcert_alice_secret_access \
    allowed_common_name=["alice_host1.mydomain.example"", "alice_host2.mydomain.example"] \
    [email protected] \
    ttl=3600

vault write auth/cert/certs/puppetcert_bob \
    display_name=bob_secrets_authenticator \
    policies=puppetcert_bob_secret_access \
    allowed_common_name=["boblhost1.mydomain.example"", "bob_host2.mydomain.example"] \
    [email protected] \
    ttl=3600

from puppet-vault_lookup.