tegwick
16a93b8e5c
Add cnpg-option-a-backup JSON runner, vendored static age, kubectl install helper, and ESO policy path for offsite lane so railiance01 workers can upload without workstation OIDC (RAILIANCE-WP-0016).
44 lines
No EOL
1.4 KiB
HCL
44 lines
No EOL
1.4 KiB
HCL
# External Secrets Operator policy for the activity-core namespace.
|
|
#
|
|
# Covers:
|
|
# - llm-connect provider secrets (OPENROUTER_API_KEY)
|
|
# - shared issue-core ingestion key for activity-core IssueSink emission
|
|
# - forgejo-admin PAT for weekly package prune (FORGEJO_TOKEN)
|
|
#
|
|
# Live ESO token on railiance01 currently attaches the finer-grained sibling
|
|
# policies (workload-kv-read-issue-core-runtime + workload-kv-read-forgejo-admin)
|
|
# via activity-core scripts/openbao-eso-token-apply.sh. This combined policy is
|
|
# the documented target set for the openbao-activity-core ClusterSecretStore.
|
|
|
|
path "platform/data/workloads/activity-core/llm-connect/llm-connect-provider-secrets" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/activity-core/llm-connect/llm-connect-provider-secrets" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/data/workloads/issue-core/issue-core/issue-core-runtime" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/issue-core/issue-core/issue-core-runtime" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/data/workloads/forgejo/forgejo-admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/forgejo/forgejo-admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
# Offsite backup lane (NC WebDAV + age pubkey material) for Option A uploads
|
|
path "platform/data/workloads/railiance/backup/offsite-lane" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/railiance/backup/offsite-lane" {
|
|
capabilities = ["read"]
|
|
} |