refactor(gitops): establish platform ownership boundaries

policies/vault/dev-k3s/workloads/auth-db-migration-dev.hcl

@@ -0,0 +1,3 @@
+path "database/creds/auth-db-migration-dev" {
+  capabilities = ["read"]
+}

policies/vault/dev-k3s/workloads/auth-server-dev.hcl

@@ -0,0 +1,15 @@
+path "kv/data/dev/systems/auth-system/postgres/auth-server" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/workloads/auth-server/keycloak-client" {
+  capabilities = ["read"]
+}
+
+path "transit/keys/project-auth-jwt" {
+  capabilities = ["read"]
+}
+
+path "transit/sign/project-auth-jwt" {
+  capabilities = ["update"]
+}

policies/vault/dev-k3s/workloads/keycloak-client-sync-dev.hcl

@@ -0,0 +1,7 @@
+path "kv/data/dev/systems/auth-system/keycloak/bootstrap-admin" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/workloads/auth-server/keycloak-client" {
+  capabilities = ["read"]
+}

policies/vault/dev-k3s/workloads/keycloak-dev.hcl

@@ -0,0 +1,7 @@
+path "kv/data/dev/systems/auth-system/postgres/keycloak" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/systems/auth-system/keycloak/bootstrap-admin" {
+  capabilities = ["read"]
+}

policies/vault/dev-k3s/workloads/postgres-dev.hcl

@@ -0,0 +1,11 @@
+path "kv/data/dev/systems/auth-system/postgres/superuser" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/systems/auth-system/postgres/auth-server" {
+  capabilities = ["read"]
+}
+
+path "kv/data/dev/systems/auth-system/postgres/keycloak" {
+  capabilities = ["read"]
+}