From 648a67979233f54e2634fbee6af3f686500a1357 Mon Sep 17 00:00:00 2001 From: Joris Wouter Jonkers Date: Tue, 27 Oct 2026 19:15:11 +0100 Subject: [PATCH] fix(deploy): grant read on the transit key auth-api's JWKS reads 0.21.1 moved auth-api onto its derived Vault role, auth-system-auth-api, whose policy granted only sign on auth-api-jwt. Its JWKS reads transit/keys/auth-api-jwt, so every new pod failed to start with 403 Forbidden on that path. deploy-kit 1.0 declares that read as the transit operation read. --- deploy/auth.project.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/deploy/auth.project.yml b/deploy/auth.project.yml index 1e06941..06035cf 100644 --- a/deploy/auth.project.yml +++ b/deploy/auth.project.yml @@ -102,13 +102,11 @@ applications: access: read delivery: env rotation: { tolerates: restart } - # Granted on the derived role, auth-system-auth-api, but not yet read through it: - # auth-api also reads transit/keys/auth-api-jwt for its JWKS, which no transit - # operation derives, so it logs in as the old path's role until deploy-kit can - # declare that read (env/auth-api/base.env, VAULT_KUBERNETES_ROLE). + # Signs its tokens, and reads the key's public part for its JWKS + # (transit/keys/auth-api-jwt), on the derived role auth-system-auth-api. - engine: transit key: auth-api-jwt - operations: [sign] + operations: [sign, read] delivery: self rotation: { tolerates: reload }