Add the role to job

manifests/vault/oidc-job.yaml

@@ -29,16 +29,9 @@ spec:
               oidc_discovery_url="https://keycloak.dvirlabs.com/realms/lab" \
               oidc_client_id="vault" \
               oidc_client_secret="8GWiUqwUZimb4xXHqFNTYCrTkKyc9hrY" \
-              default_role="default"
+              default_role="vault-admins"
 
-            echo "📜 Writing Vault policy..."
-            vault policy write oidc-ui-access - <<EOF
-            path "auth/oidc/role/default" {
-              capabilities = ["read"]
-            }
-            EOF
-
-            echo "🎯 Creating OIDC role named 'default'..."
+            echo "🎯 Creating OIDC role named 'default' (optional)..."
             vault write auth/oidc/role/default \
               bound_audiences="vault" \
               allowed_redirect_uris="https://vault.dvirlabs.com/ui/vault/auth/oidc/oidc/callback" \
@@ -48,6 +41,15 @@ spec:
               policies="default" \
               token_policies="oidc-ui-access" \
               ttl="1h"
+
+            echo "📜 Writing vault-admin policy..."
+            vault policy write vault-admin - <<EOF
+            path "*" {
+              capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+            }
+            EOF
+
+            echo "✅ All OIDC setup completed."
         volumeMounts:
         - name: vault-token
           mountPath: /vault/secrets