tegwick
3a7d63e18f
VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the migration lease. Image base is digest-pinned. Namespace and NetworkPolicies are on the cluster; Deployment waits for the attended OpenBao ESO token.
20 lines
418 B
JSON
20 lines
418 B
JSON
[
|
|
{
|
|
"name": "user-engine",
|
|
"tokens": ["replace-with-write-token"],
|
|
"sources": ["user-engine"],
|
|
"tenants": ["*"],
|
|
"may_write": true,
|
|
"may_read": false,
|
|
"secret_policy": "redact"
|
|
},
|
|
{
|
|
"name": "operator",
|
|
"tokens": ["replace-with-read-token"],
|
|
"sources": ["user-engine"],
|
|
"tenants": ["*"],
|
|
"may_write": true,
|
|
"may_read": true,
|
|
"secret_policy": "redact"
|
|
}
|
|
]
|