6e399bbe64
Declares target store specs, two exact-path policies and two ESO ServiceAccounts. Nothing applied; live steps wait on the founder. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
28 lines
835 B
HCL
28 lines
835 B
HCL
# RPF-WP-0045: ESO delivery for ClusterSecretStore openbao-activity-core via
|
|
# Kubernetes auth role activity-core-eso (SA activity-core/activity-core-eso).
|
|
# Exactly the four KV paths the four activity-core ExternalSecrets read; data
|
|
# read only, no metadata/list/write. ESO also needs lookup-self and revoke-self.
|
|
|
|
path "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/data/workloads/issue-core/issue-core/issue-core-runtime" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/data/workloads/forgejo/forgejo-admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/data/workloads/railiance/backup/offsite-lane" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/lookup-self" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/revoke-self" {
|
|
capabilities = ["update"]
|
|
}
|