tegwick
b11855f64c
Extend external-secrets-activity-core policy notes with forgejo-admin paths used by activity-core actcore-forgejo-admin ExternalSecret (ACTIVITY-WP-0023-T05).
17 lines
No EOL
622 B
HCL
17 lines
No EOL
622 B
HCL
# Least-privilege read policy for the Forgejo operator/admin API token (PAT).
|
|
#
|
|
# Grants read access to the site-admin PAT used by workstation and activity-core
|
|
# automation (package prune, org webhooks, operator bootstrap). Sibling to
|
|
# forgejo-mailer (SMTP).
|
|
#
|
|
# Cluster delivery (ACTIVITY-WP-0023-T05): attached to the
|
|
# openbao-activity-core ESO token so ExternalSecret actcore-forgejo-admin can
|
|
# merge FORGEJO_TOKEN into actcore-runtime-secret.
|
|
|
|
path "platform/data/workloads/forgejo/forgejo-admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/forgejo/forgejo-admin" {
|
|
capabilities = ["read"]
|
|
} |