main.yml

---
vault_configure_canary:
  path: cubbyhole/configure_basic
  value: complete  # value does not matter

vault_kv1_mount_point: kv1
vault_kv1_path: testproject
vault_kv1_api_path: '{{ vault_kv1_mount_point }}/{{ vault_kv1_path }}'

vault_kv2_mount_point: kv2
unauthorized_vault_kv2_mount_point: kv2_noauth
cas_required_vault_kv2_mount_point: kv2_cas

vault_kv2_path: testproject
vault_kv2_multi_path: testmulti
vault_kv2_versioned_path: versioned

vault_kv2_api_path: '{{ vault_kv2_mount_point }}/data/{{ vault_kv2_path }}'
vault_kv2_multi_api_path: '{{ vault_kv2_mount_point }}/data/{{ vault_kv2_multi_path }}'
vault_kv2_versioned_api_path: '{{ vault_kv2_mount_point }}/data/{{ vault_kv2_versioned_path }}'
vault_kv2_delete_api_path: '{{ vault_kv2_mount_point }}/delete/{{ vault_kv2_versioned_path }}'
vault_kv2_metadata_api_path: '{{ vault_kv2_mount_point }}/metadata/{{ vault_kv2_versioned_path }}'
vault_kv2_api_list_mount_point: '{{ vault_kv2_mount_point }}/metadata'
vault_kv2_api_list_path: '{{ vault_kv2_mount_point }}/metadata/{{ vault_kv2_path }}'

vault_policy_api_list_path: 'sys/policies/acl'

vault_kv2_api_list_inexistent_path: '{{ vault_kv2_mount_point }}/metadata/__inexistent'
vault_kv2_api_list_inexistent_mount_point: '{{ vault_kv2_mount_point }}__inexistent/metadata'
vault_kv2_api_list_inexistent_unauthorized_path: '{{ vault_kv2_mount_point }}/metadata/__inexistent_no_auth'
vault_kv2_api_list_unauthorized_path: '{{ unauthorized_vault_kv2_mount_point }}/metadata'

vault_base_policy: |
  path "{{ vault_kv1_api_path }}/secret1" {
    capabilities = ["read"]
  }
  path "{{ vault_kv1_api_path }}/secret2" {
    capabilities = ["read", "update"]
  }
  path "{{ vault_kv1_api_path }}/secret3" {
    capabilities = ["deny"]
  }
  path "{{ vault_kv1_api_path }}/non_existent_secret" {
    capabilities = ["read"]
  }

  path "{{ vault_kv2_api_path }}/secret1" {
    capabilities = ["read"]
  }
  path "{{ vault_kv2_api_path }}/secret2" {
    capabilities = ["read", "update"]
  }
  path "{{ vault_kv2_api_path }}/secret3" {
    capabilities = ["deny"]
  }
  path "{{ vault_kv2_multi_api_path }}/secrets" {
    capabilities = ["read"]
  }
  path "{{ vault_kv2_api_path }}/secret4" {
    capabilities = ["read", "update"]
  }
  # module_vault_kv2_write tests
  path "{{ vault_kv2_api_path }}/write1" {
    capabilities = ["read", "create", "update"]
  }
  # module_vault_kv2_write tests
  path "{{ vault_kv2_api_path }}/readonly" {
    capabilities = ["read"]
  }
  # module_vault_kv2_write tests
  path "{{ cas_required_vault_kv2_mount_point }}/data/write1" {
    capabilities = ["read", "create", "update"]
  }
  # module_vault_kv2_write tests
  path "{{ vault_kv2_api_path }}/deny" {
    capabilities = ["deny"]
  }
  # module_vault_kv2_write tests
  path "{{ vault_kv2_api_path }}/404" {
    capabilities = ["read", "create", "update"]
  }
  # module_vault_kv2_write tests
  path "{{ vault_kv2_api_path }}/writeonly" {
    capabilities = ["create", "update"]
  }
  path "{{ vault_kv2_mount_point }}/metadata/{{ vault_kv2_path }}/write1" {
    capabilities = ["delete"]
  }
  path "{{ vault_kv2_api_path }}/non_existent_secret" {
    capabilities = ["read"]
  }
  path "{{ vault_kv2_versioned_api_path }}/*" {
    capabilities = ["read"]
  }
  path "{{ vault_kv2_versioned_api_path }}/secret6" {
    capabilities = ["delete"]
  }
  path "{{ vault_kv2_versioned_api_path }}/non_existent_secret" {
    capabilities = ["delete"]
  }
  path "{{ vault_kv2_delete_api_path }}/secret6" {
    capabilities = ["create", "update"]
  }
  path "{{ vault_kv2_delete_api_path }}/non_existent_secret" {
    capabilities = ["create", "update"]
  }
  path "{{ vault_kv2_metadata_api_path }}/secret6" {
    capabilities = ["read"]
  }
  path "{{ vault_kv2_api_list_mount_point }}/*" {
    capabilities = ["list"]
  }
  path "{{ vault_kv2_api_list_path }}" {
    capabilities = ["list"]
  }
  path "{{ vault_policy_api_list_path }}" {
    capabilities = ["list"]
  }
  path "{{ vault_kv2_api_list_inexistent_unauthorized_path }}" {
    capabilities = ["deny"]
  }
  path "{{ vault_kv2_api_list_unauthorized_path }}" {
    capabilities = ["deny"]
  }

vault_token_creator_policy: |
  path "auth/token/create" {
    capabilities = ["create", "update"]
  }
  path "auth/token/create/*" {
    capabilities = ["create", "update"]
  }

vault_orphan_creator_policy: |
  path "auth/token/create" {
    capabilities = ["create", "update"]
  }
  path "auth/token/create/*" {
    capabilities = ["create", "update"]
  }
  path "auth/token/create-orphan" {
    capabilities = ["create", "update", "sudo"]
  }

vault_invalid_kv2_path_policy: |
  path "{{ vault_kv2_mount_point }}/{{ vault_kv2_path }}/*" {
    capabilities = ["read"]
  }

# the purpose of these policies is to catch when the plugin accepts mount_point but does not pass
# it into hvac. we set the test policy to deny access to this secret and the alt policy to read it
# the test-policy is assigned to the default mount of the auth method, while the alt policy is
# assigned to the alternate (non-default) mount
vault_test_policy: |
  {{ vault_base_policy }}
  path "{{ vault_kv2_api_path }}/secret5" {
    capabilities = ["deny"]
  }

vault_alt_policy: |
  {{ vault_base_policy }}
  path "{{ vault_kv2_api_path }}/secret5" {
    capabilities = ["read"]
  }