tegwick
0941d6e8f9
Introduce external-secrets-forgejo policy/role, ClusterSecretStore openbao-forgejo (forgejo namespace), and make openbao-configure-external-secrets-forgejo.
13 lines
No EOL
416 B
HCL
13 lines
No EOL
416 B
HCL
# Least-privilege policy for External Secrets Operator Forgejo mailer lane.
|
|
#
|
|
# The matching Kubernetes auth role binds only the ESO service account in the
|
|
# external-secrets namespace. ClusterSecretStore usage is separately limited to
|
|
# the forgejo namespace.
|
|
|
|
path "platform/data/workloads/forgejo/*" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/forgejo/*" {
|
|
capabilities = ["read", "list"]
|
|
} |