41 lines
1.3 KiB
HCL
41 lines
1.3 KiB
HCL
# Non-production metadata applier for reviewed credential changes.
|
|
#
|
|
# This policy is intended for build/test/staging OpenBao lanes after a
|
|
# non-production mount or namespace is declared. It intentionally keeps the same
|
|
# no-secret-value rule as production; generated test secrets still require a
|
|
# separately approved non-production value path.
|
|
|
|
# Workload KV read-lane policies generated from approved CCRs.
|
|
path "sys/policies/acl/workload-kv-read-*" {
|
|
capabilities = ["create", "update", "read"]
|
|
}
|
|
|
|
# Credential broker issuer policies generated from approved grant metadata.
|
|
path "sys/policies/acl/credential-broker-*-issuer" {
|
|
capabilities = ["create", "update", "read"]
|
|
}
|
|
|
|
# OIDC roles for caller-scoped workload KV lanes. The local applier
|
|
# dry-run constrains role names and bound claims per CCR.
|
|
path "auth/netkingdom/role/*" {
|
|
capabilities = ["create", "update", "read"]
|
|
}
|
|
|
|
# Kubernetes roles for in-cluster workload and provider-secret lanes.
|
|
path "auth/kubernetes/role/*" {
|
|
capabilities = ["create", "update", "read"]
|
|
}
|
|
|
|
# Token roles for approved credential-broker child-token issuers.
|
|
path "auth/token/roles/credential-broker-*" {
|
|
capabilities = ["create", "update", "read"]
|
|
}
|
|
|
|
# Self-checks and capability introspection only.
|
|
path "auth/token/lookup-self" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "sys/capabilities-self" {
|
|
capabilities = ["update"]
|
|
}
|