tegwick
ded432a63f
Postgres now reports custody_class=operational with a cited 30-day recoverable window. Join ITC-CAP operations.audit at D4, publish the interface card, and overlay user-engine tenants [*] from Git so an ExternalSecret refresh cannot shrink it.
23 lines
626 B
YAML
23 lines
626 B
YAML
# Non-secret sender scope (AUDIT-WP-0006-T05). Tokens stay in Secret
|
|
# audit-core-senders. This ConfigMap is the authority for tenants/sources
|
|
# so an ExternalSecret refresh cannot revert user-engine to a single tenant.
|
|
# Keep in lockstep with deploy/senders-scope.json.
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: audit-core-senders-scope
|
|
namespace: audit-core
|
|
labels:
|
|
app.kubernetes.io/name: audit-core
|
|
data:
|
|
senders-scope.json: |
|
|
[
|
|
{
|
|
"name": "user-engine",
|
|
"sources": ["user-engine"],
|
|
"tenants": ["*"],
|
|
"may_write": true,
|
|
"may_read": false
|
|
}
|
|
]
|