From a95509fbf0deaee6b2e08a394817b6f4fb61ffe9 Mon Sep 17 00:00:00 2001
From: dvirlabs <dvirlabs@gmail.com>
Date: Sun, 18 May 2025 02:24:01 +0300
Subject: [PATCH] Add the role to job

---
 manifests/vault/oidc-job.yaml | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/manifests/vault/oidc-job.yaml b/manifests/vault/oidc-job.yaml
index 25b9763..f5273cb 100644
--- a/manifests/vault/oidc-job.yaml
+++ b/manifests/vault/oidc-job.yaml
@@ -29,16 +29,9 @@ spec:
               oidc_discovery_url="https://keycloak.dvirlabs.com/realms/lab" \
               oidc_client_id="vault" \
               oidc_client_secret="8GWiUqwUZimb4xXHqFNTYCrTkKyc9hrY" \
-              default_role="default"
+              default_role="vault-admins"
 
-            echo "📜 Writing Vault policy..."
-            vault policy write oidc-ui-access - <<EOF
-            path "auth/oidc/role/default" {
-              capabilities = ["read"]
-            }
-            EOF
-
-            echo "🎯 Creating OIDC role named 'default'..."
+            echo "🎯 Creating OIDC role named 'default' (optional)..."
             vault write auth/oidc/role/default \
               bound_audiences="vault" \
               allowed_redirect_uris="https://vault.dvirlabs.com/ui/vault/auth/oidc/oidc/callback" \
@@ -48,6 +41,15 @@ spec:
               policies="default" \
               token_policies="oidc-ui-access" \
               ttl="1h"
+
+            echo "📜 Writing vault-admin policy..."
+            vault policy write vault-admin - <<EOF
+            path "*" {
+              capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+            }
+            EOF
+
+            echo "✅ All OIDC setup completed."
         volumeMounts:
         - name: vault-token
           mountPath: /vault/secrets