14 lines
454 B
HCL
14 lines
454 B
HCL
|
# Least-privilege policy for the External Secrets Operator email-connect lane.
|
||
|
|
#
|
||
|
|
# The matching Kubernetes auth role binds only the ESO service account in the
|
||
|
|
# external-secrets namespace. ClusterSecretStore usage is separately limited to
|
||
|
|
# the email-connect namespace.
|
||
|
|
|
||
|
|
path "platform/data/workloads/email-connect/transactional" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "platform/metadata/workloads/email-connect/transactional" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|