tegwick
25fc47e5f2
Establish proposed workload-kv-read custody for the Forgejo site-admin PAT at platform/workloads/forgejo/forgejo-admin, sibling to forgejo-mailer. OIDC workstation fetch mirrors the railiance-backup-offsite pattern.
13 lines
No EOL
468 B
HCL
13 lines
No EOL
468 B
HCL
# Least-privilege read policy for the Forgejo operator/admin API token (PAT).
|
|
#
|
|
# Grants read access to the site-admin PAT used by workstation and activity-core
|
|
# automation (package prune, org webhooks, operator bootstrap). Sibling to
|
|
# forgejo-mailer (SMTP); no cluster ESO delivery in phase 1.
|
|
|
|
path "platform/data/workloads/forgejo/forgejo-admin" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "platform/metadata/workloads/forgejo/forgejo-admin" {
|
|
capabilities = ["read"]
|
|
} |