c642367d98
CCR-2026-0010, OpenBao read policies, ClusterSecretStore openbao-email-connect, and workload-kv lane documentation for EMAIL-WP-0004-T03.
13 lines
454 B
HCL
13 lines
454 B
HCL
# Least-privilege policy for the External Secrets Operator email-connect lane.
|
|
#
|
|
# The matching Kubernetes auth role binds only the ESO service account in the
|
|
# external-secrets namespace. ClusterSecretStore usage is separately limited to
|
|
# the email-connect namespace.
|
|
|
|
path "platform/data/workloads/email-connect/transactional" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/email-connect/transactional" {
|
|
capabilities = ["read"]
|
|
}
|