coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close delegated prod applier pilot

Browse source
This commit is contained in:
tegwick 2026-07-01 23:34:13 +02:00
parent 2db4d1afe1
commit 38936d8fd6
5 changed files with 79 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

5
openbao/policies/credential-change-nonprod-applier.hcl
View file

@ -15,8 +15,9 @@ path "sys/policies/acl/credential-broker-*-issuer" {
capabilities = ["create", "update", "read"]
}
# OIDC roles for caller-scoped workload KV lanes.
path "auth/netkingdom/role/*-workload-kv-read" {
# OIDC roles for caller-scoped workload KV lanes. The local applier
# dry-run constrains role names and bound claims per CCR.
path "auth/netkingdom/role/*" {
capabilities = ["create", "update", "read"]
}

5
openbao/policies/credential-change-prod-applier.hcl
View file

@ -15,8 +15,9 @@ path "sys/policies/acl/credential-broker-*-issuer" {
capabilities = ["create", "update", "read"]
}
# OIDC roles for caller-scoped workload KV lanes.
path "auth/netkingdom/role/*-workload-kv-read" {
# OIDC roles for caller-scoped workload KV lanes. The local applier
# dry-run constrains role names and bound claims per CCR.
path "auth/netkingdom/role/*" {
capabilities = ["create", "update", "read"]
}