"child policies must be subset of parent" when creating a new token

[y2kbug]

It seems I have solved the issue.

Referring to this post:

Non root token that can create new tokens with newly created policy

From the link above: A list of policies for the token. This must be a subset of the policies belonging to the token making the request, unless the calling token is root or contains sudo capabilities to auth/token/create . Does the token being used to create the restricted token have the same policy linked to it? I don’t mean the same capabilities because obviously it has more capabilites, I mean the actual policy.

Policies | Vault | HashiCorp Developer

I have added sudo to the parent policy:

path "auth/token/create" {
  capabilities = ["sudo","create", "update"]
}

And using -no-default-policy -orphan in token create:

vault token create -no-default-policy -orphan -policy=${REPO_NAME} -format=json