13 lines
416 B
HCL
13 lines
416 B
HCL
|
# Least-privilege policy for External Secrets Operator Forgejo mailer lane.
|
||
|
|
#
|
||
|
|
# The matching Kubernetes auth role binds only the ESO service account in the
|
||
|
|
# external-secrets namespace. ClusterSecretStore usage is separately limited to
|
||
|
|
# the forgejo namespace.
|
||
|
|
|
||
|
|
path "platform/data/workloads/forgejo/*" {
|
||
|
|
capabilities = ["read"]
|
||
|
|
}
|
||
|
|
|
||
|
|
path "platform/metadata/workloads/forgejo/*" {
|
||
|
|
capabilities = ["read", "list"]
|
||
|
|
}
|