cac9947e3a
KV store for the sender registry only. Database leases stay on the OpenBao database engine and are consumed via VaultDynamicSecret in audit-core. Not added to the coulombcore ArgoCD kustomization.
26 lines
848 B
HCL
26 lines
848 B
HCL
# Least-privilege policy for the External Secrets Operator audit-core lane.
|
|
#
|
|
# Covers:
|
|
# - dynamic runtime PostgreSQL lease (database/creds/audit-core-runtime)
|
|
# - dynamic migration PostgreSQL lease (database/creds/audit-core-migration)
|
|
# - sender registry KV (platform/workloads/audit-core/senders)
|
|
#
|
|
# ClusterSecretStore openbao-audit-core is namespace-limited to audit-core.
|
|
# The runtime pod mounts only the runtime secret; the migrate Job mounts only
|
|
# the migration secret. This policy is the union ESO needs to vend both.
|
|
|
|
path "database/creds/audit-core-runtime" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "database/creds/audit-core-migration" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/data/workloads/audit-core/senders" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/audit-core/senders" {
|
|
capabilities = ["read"]
|
|
}
|