27 lines
848 B
HCL
27 lines
848 B
HCL
|
# Least-privilege policy for the External Secrets Operator audit-core lane.
|
||
|
|
#
|
||
|
|
# Covers:
|
||
|
|
# - dynamic runtime PostgreSQL lease (database/creds/audit-core-runtime)
|
||
|
|
# - dynamic migration PostgreSQL lease (database/creds/audit-core-migration)
|
||
|
|
# - sender registry KV (platform/workloads/audit-core/senders)
|
||
|
|
#
|
||
|
|
# ClusterSecretStore openbao-audit-core is namespace-limited to audit-core.
|
||
|
|
# The runtime pod mounts only the runtime secret; the migrate Job mounts only
|
||
|
|
# the migration secret. This policy is the union ESO needs to vend both.
|
||
|
|
|
||
|
|
path "database/creds/audit-core-runtime" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "database/creds/audit-core-migration" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "platform/data/workloads/audit-core/senders" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "platform/metadata/workloads/audit-core/senders" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|