refactor(gitops): establish platform ownership boundaries

policies/vault/dev-k3s/keycloak-client-sync-dev.hcl

@@ -1,7 +0,0 @@
-path "kv/data/dev/platform/keycloak/bootstrap-admin" {
-  capabilities = ["read"]
-}
-
-path "kv/data/dev/platform/keycloak/client-auth-server" {
-  capabilities = ["read"]
-}

policies/vault/dev-k3s/keycloak-dev.hcl

@@ -1,7 +0,0 @@
-path "kv/data/dev/platform/postgres/keycloak" {
-  capabilities = ["read"]
-}
-
-path "kv/data/dev/platform/keycloak/bootstrap-admin" {
-  capabilities = ["read"]
-}

policies/vault/dev-k3s/keycloak-operator-dev.hcl

@@ -1,3 +0,0 @@
-path "kv/data/dev/platform/keycloak/bootstrap-admin" {
-  capabilities = ["read"]
-}

policies/vault/dev-k3s/platform-admin-dev.hcl

@@ -1,43 +0,0 @@
-path "kv/*" {
-  capabilities = ["create", "read", "update", "delete", "list"]
-}
-
-path "auth/kubernetes/*" {
-  capabilities = ["create", "read", "update", "delete", "list"]
-}
-
-path "sys/auth/*" {
-  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
-}
-
-path "sys/mounts/*" {
-  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
-}
-
-path "sys/policies/acl/*" {
-  capabilities = ["create", "read", "update", "delete", "list"]
-}
-
-path "database/*" {
-  capabilities = ["create", "read", "update", "delete", "list"]
-}
-
-path "transit/*" {
-  capabilities = ["create", "read", "update", "delete", "list"]
-}
-
-path "auth/token/create-orphan" {
-  capabilities = ["update"]
-}
-
-path "auth/token/lookup" {
-  capabilities = ["update"]
-}
-
-path "sys/storage/raft/snapshot" {
-  capabilities = ["read", "update", "sudo"]
-}
-
-path "sys/storage/raft/snapshot-force" {
-  capabilities = ["update", "sudo"]
-}

policies/vault/dev-k3s/platform/vault-database-automation-dev.hcl

@@ -0,0 +1,24 @@
+# Managed by vault-foundation. The database runner may reconcile only the named
+# PostgreSQL connection, dynamic role, and minimal self-service token endpoints.
+
+path "database/config/auth-system-postgres-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "database/roles/auth-db-migration-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+# no-default-policy runner tokens retain only the self-service operations used
+# for capability checks, identity verification, and explicit revocation.
+path "sys/capabilities-self" {
+  capabilities = ["update"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}

policies/vault/dev-k3s/platform/vault-workloads-automation-dev.hcl

@@ -0,0 +1,65 @@
+# Managed by vault-foundation. This trusted security runner may reconcile only
+# the named workload policies, Kubernetes auth roles, application Transit key,
+# and the minimal self-service token endpoints declared below.
+
+path "sys/policies/acl/auth-server-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "sys/policies/acl/auth-db-migration-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "sys/policies/acl/postgres-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "sys/policies/acl/keycloak-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "sys/policies/acl/keycloak-client-sync-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "auth/kubernetes/role/auth-server-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "auth/kubernetes/role/auth-db-migration-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "auth/kubernetes/role/postgres-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "auth/kubernetes/role/keycloak-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "auth/kubernetes/role/keycloak-client-sync-dev" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+path "transit/keys/project-auth-jwt" {
+  capabilities = ["create", "read", "update"]
+}
+
+path "transit/keys/project-auth-jwt/config" {
+  capabilities = ["update"]
+}
+
+# no-default-policy runner tokens retain only the self-service operations used
+# for capability checks, identity verification, and explicit revocation.
+path "sys/capabilities-self" {
+  capabilities = ["update"]
+}
+
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+
+path "auth/token/revoke-self" {
+  capabilities = ["update"]
+}

policies/vault/dev-k3s/postgres-dev.hcl

@@ -1,11 +0,0 @@
-path "kv/data/dev/platform/postgres/superuser" {
-  capabilities = ["read"]
-}
-
-path "kv/data/dev/platform/postgres/auth-server" {
-  capabilities = ["read"]
-}
-
-path "kv/data/dev/platform/postgres/keycloak" {
-  capabilities = ["read"]
-}

policies/vault/dev-k3s/postgres-operator-dev.hcl

@@ -1,3 +0,0 @@
-path "database/creds/postgres-operator-dev" {
-  capabilities = ["read"]
-}

policies/vault/dev-k3s/vault-database-automation-dev.hcl

@@ -1,14 +0,0 @@
-# Managed by vault-core. The database runner may reconcile only the named
-# PostgreSQL connection and dynamic roles owned by the vault-database state.
-
-path "database/config/platform-postgres-dev" {
-  capabilities = ["create", "read", "update", "delete"]
-}
-
-path "database/roles/auth-db-migration-dev" {
-  capabilities = ["create", "read", "update", "delete"]
-}
-
-path "database/roles/postgres-operator-dev" {
-  capabilities = ["create", "read", "update", "delete"]
-}

policies/vault/dev-k3s/workloads/auth-server-dev.hcl

@@ -1,8 +1,8 @@
-path "kv/data/dev/platform/postgres/auth-server" {
+path "kv/data/dev/systems/auth-system/postgres/auth-server" {
   capabilities = ["read"]
 }
 
-path "kv/data/dev/platform/keycloak/client-auth-server" {
+path "kv/data/dev/workloads/auth-server/keycloak-client" {
   capabilities = ["read"]
 }
 

policies/vault/dev-k3s/workloads/keycloak-client-sync-dev.hcl

@@ -0,0 +1,7 @@
+path "kv/data/dev/systems/auth-system/keycloak/bootstrap-admin" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/workloads/auth-server/keycloak-client" {
+  capabilities = ["read"]
+}

policies/vault/dev-k3s/workloads/keycloak-dev.hcl

@@ -0,0 +1,7 @@
+path "kv/data/dev/systems/auth-system/postgres/keycloak" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/systems/auth-system/keycloak/bootstrap-admin" {
+  capabilities = ["read"]
+}

policies/vault/dev-k3s/workloads/postgres-dev.hcl

@@ -0,0 +1,11 @@
+path "kv/data/dev/systems/auth-system/postgres/superuser" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/systems/auth-system/postgres/auth-server" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/systems/auth-system/postgres/keycloak" {
+  capabilities = ["read"]
+}