coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add OpenBao External Secrets lane for Forgejo mailer on railiance01
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 6s
Details

Browse source 
Introduce external-secrets-forgejo policy/role, ClusterSecretStore
openbao-forgejo (forgejo namespace), and make openbao-configure-external-secrets-forgejo.
This commit is contained in:
tegwick 2026-07-07 14:30:02 +02:00
parent 7c598c2715
commit 0941d6e8f9
5 changed files with 56 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
openbao/policies/external-secrets-forgejo.hcl Normal file
View file

@ -0,0 +1,13 @@
# Least-privilege policy for External Secrets Operator Forgejo mailer lane.
#
# The matching Kubernetes auth role binds only the ESO service account in the
# external-secrets namespace. ClusterSecretStore usage is separately limited to
# the forgejo namespace.
path "platform/data/workloads/forgejo/*" {
capabilities = ["read"]
}
path "platform/metadata/workloads/forgejo/*" {
capabilities = ["read", "list"]
}