I am using Hashicorp Vault for managing and storing my secrets. And using Gitlab as a CI/CD pipeline to read those secrets. Using this documentation https://docs.gitlab.com/ee/ci/examples/authenticating-with-hashicorp-vault/, I am able to read the secrets using JWT. But those secrets/roles/policies I had already configured from Vault CLI
What i want to know is if there is a way to create policies and roles using directly from the pipeline. For example 1st step is to create the role like this -
$ vault write auth/jwt/role/myproject-production - <<EOF
{
"role_type": "jwt",
"policies": ["myproject-production"],
"token_explicit_max_ttl": 60,
"user_claim": "user_email",
"bound_claims_type": "glob",
"bound_claims": {
"project_id": "42",
"ref_protected": "true",
"ref_type": "tag",
"ref": "auto-deploy-*"
}
}
EOF
Here you can see I have attached a policy myproject-production to this role which will be created like this -
$ vault policy write myproject-production - <<EOF
# Policy name: myproject-production
#
# Read-only permission on 'secret/data/myproject/production/*' path
path "secret/data/myproject/production/*" {
capabilities = [ "read" ]
}
EOF
How do i perform these 2 steps from a pipeline after Authentication happens successfully from Vault.?
Right now what i am doing is when a new user comes in, I go and create policy and roles for him and the same the user uses in the pipeline to read the secrets.