How to allow access to all KV v2 secret mounts in a namespace with one policy?

[tchelovilar]

Hi everyone,

I’d like to define a policy in the root namespace that grants read/write access to all KV v2 secret mounts inside a specific namespace (let’s call it my-namespace).

For a single mount (e.g. my-namespace/kv2-mount/), I can write:

path "my-namespace/kv2-mount/data/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

path "my-namespace/kv2-mount/metadata/*" {
  capabilities = ["list", "read", "delete"]
}

That works fine.

What I’d like, though, is a generic rule that matches any KV v2 mount inside my-namespace. I tried something like:

path "my-namespace/+/data/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

…but this doesn’t work.

My questions are:

Is it possible to write a single policy that covers all KV v2 mounts in a namespace?

Thanks in advance!

[cipherboy]

…but this doesn’t work.

Can you expand on how this fails?

I think your only option with the existing KVv2 logic would be to do a path like:

path "my-namespace/kvv2-+/data/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

(where + is a wildcard that matches anything and you explicitly provision KVv2 mounts with a kvv2- prefix). It is not of unlimited depth though, so if you want to support my/path/to/kvv2-mount, you'd have to create more policies:

path "my-namespace/+/kvv2-+/data/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

path "my-namespace/+/+/kvv2-+/data/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

path "my-namespace/+/+/+/kvv2-+/data/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

though at some point, you risk a mismatch as the latter would match a KVv1 mount at the path:

my-namespace/kvv1-data/some/path/kvv2-data/data/this-key-should-not-be-writable.

for instance.

At any rate, CEL for ACL policies (as mentioned in https://github.com/orgs/openbao/discussions/783 by @suprjinx) would likely be the solution for this exact use case.