tegwick
d4c95f78ff
Add workload-kv-read-agent-harness-forgejo and document the harness deploy-key + mail AppRole lanes provisioned on railiance01.
11 lines
403 B
HCL
11 lines
403 B
HCL
# Least-privilege read policy for agent-harness Forgejo deploy key.
|
|
# Private key is held on the worker host; OpenBao holds a recovery/copy.
|
|
# Exact path only — no list on parent, no sibling workload paths.
|
|
|
|
path "platform/data/workloads/agent-harness/forgejo-deploy-key" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/agent-harness/forgejo-deploy-key" {
|
|
capabilities = ["read"]
|
|
}
|