66 lines
1.7 KiB
HCL
66 lines
1.7 KiB
HCL
# Managed by vault-foundation. This trusted security runner may reconcile only
|
|
# the named workload policies, Kubernetes auth roles, application Transit key,
|
|
# and the minimal self-service token endpoints declared below.
|
|
|
|
path "sys/policies/acl/auth-server-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
path "sys/policies/acl/auth-db-migration-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
path "sys/policies/acl/postgres-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
path "sys/policies/acl/keycloak-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
path "sys/policies/acl/keycloak-client-sync-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
path "auth/kubernetes/role/auth-server-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
path "auth/kubernetes/role/auth-db-migration-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
path "auth/kubernetes/role/postgres-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
path "auth/kubernetes/role/keycloak-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
path "auth/kubernetes/role/keycloak-client-sync-dev" {
|
|
capabilities = ["create", "read", "update", "delete"]
|
|
}
|
|
|
|
path "transit/keys/project-auth-jwt" {
|
|
capabilities = ["create", "read", "update"]
|
|
}
|
|
|
|
path "transit/keys/project-auth-jwt/config" {
|
|
capabilities = ["update"]
|
|
}
|
|
|
|
# no-default-policy runner tokens retain only the self-service operations used
|
|
# for capability checks, identity verification, and explicit revocation.
|
|
path "sys/capabilities-self" {
|
|
capabilities = ["update"]
|
|
}
|
|
|
|
path "auth/token/lookup-self" {
|
|
capabilities = ["read"]
|
|
}
|
|
|
|
path "auth/token/revoke-self" {
|
|
capabilities = ["update"]
|
|
}
|