94b2f7cc9c
Use IAM application resource-control and policy Scoped backup access. OpenBao path is platform/workloads/railiance/backup/object-storage. rapp-postgres keeps Secret platform-pg-backup-s3 as the first projection.
11 lines
367 B
HCL
11 lines
367 B
HCL
# Least-privilege read of the resource-control backup object-store key.
|
|
# ESO (or the later Kubernetes auth role) is the only in-cluster reader.
|
|
# Values never belong in Git.
|
|
|
|
path "platform/data/workloads/railiance/backup/object-storage" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/railiance/backup/object-storage" {
|
|
capabilities = ["read"]
|
|
}
|