secrets-and-pki: add real Vault evidence, expand access model

Browse Source

Access model now covers the narrowly-scoped read-only utility policies
(ansible sync roles, metrics-reader, pki-reader) alongside the
host-scoped svc-* pattern - the fuller picture confirmed live against
Vault's actual ACL policy list, not just the original narrower claim.

Added two real screenshots: the live policy list, and an actual audit
log entry showing a KV read with every secret value as hmac-sha256:...
instead of plaintext - proof for the audit-trail claim instead of just
an assertion of it.

...

This commit is contained in:

thesabear committed 2026-08-26 00:15:14 +03:00

1 parent 806f5302cd

commit fb85d9c8f5

3 files changed

+8

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

assets/vault-acl-policies.png

BIN

Binary file not shown.

Side by Side After Width:  |  Height:  |  Size: 85 KiB

assets/vault-audit-log-hashed.png

BIN

Binary file not shown.

Side by Side After Width:  |  Height:  |  Size: 72 KiB