railiance-platform/openbao/policies/workload-kv-read-platform-pg-backup-s3.hcl

12 lines
375 B
HCL
Raw Normal View History

# Least-privilege read of the Barman runtime key for platform-pg.
# ESO (or the later Kubernetes auth role) is the only in-cluster reader.
# Values never belong in Git.
path "platform/data/workloads/railiance/backup/platform-pg-backup-s3" {
capabilities = ["read"]
}
path "platform/metadata/workloads/railiance/backup/platform-pg-backup-s3" {
capabilities = ["read"]
}