coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

openbao: grant platform-admin access to tenants/ mount
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
WARDEN-WP-0028 added mount tenants/ for client secrets; platform-admin
only covered platform/* and secret/*, so UI operators could not see
binky paths. Add tenants/* CRUD+list.
This commit is contained in:
tegwick 2026-07-17 00:31:09 +02:00
parent 86209fa90c
commit 7d7260ffa3
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
openbao/policies/platform-admin.hcl
View file

@ -39,3 +39,9 @@ path "cubbyhole/*" {
path "secret/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
# Client/tenant commercial secrets (WARDEN-WP-0028). Separate mount from
# platform/workloads so tenant lanes are not mixed with fleet service secrets.
path "tenants/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}