download-identity Specification

Mon, 01 Jan 0001 00:00:00 +0000

Purpose

Provide a dedicated Vault identity for download infrastructure while keeping state, credential references, and provider permissions scoped to its needs.

Requirements

Requirement: Dedicated component authentication

Vault configuration SHALL declare src_infra_download using the existing AppRole backend and reusable identity modules. Its state permissions SHALL cover the component’s own environment and DNS state keys, not another component’s state namespace.

Scenario: Inspect component state access

WHEN the download identity’s effective state policy is evaluated
THEN it grants access to download-owned state and locks
AND it does not grant access to unrelated component state

Requirement: Required provider and SSH assignments

The identity SHALL expose the membership and identity outputs needed for Yandex folder provisioning and XCP-ng resource-set assignment. It SHALL receive the required component SSH permissions and DNS provider-secret reads for global and local records without administrative provider credentials.

Download identity on Alwaldend

download-identity Specification

Purpose

Requirements

Requirement: Dedicated component authentication

Scenario: Inspect component state access

Requirement: Required provider and SSH assignments