收窄本机 SPIFFE 身份的 KV 权限范围

infrastructure/openbao/terraform/policies/local-development.hcl

@@ -1,15 +1,28 @@
-# Local development identity. This policy deliberately permits normal KV v2
-# reads and writes but excludes soft-delete, metadata deletion, permanent
-# version destruction, auth administration, and privileged operations.
-path "kv/data/*" {
+# Local development identity. Limit normal KV v2 reads and writes to the k8s
+# subtree, and exclude soft-delete, metadata deletion, permanent version
+# destruction, auth administration, and privileged operations.
+path "kv/data/k8s/*" {
   capabilities = ["create", "read", "update"]
 }
 
-path "kv/metadata" {
+path "kv/metadata/k8s" {
   capabilities = ["read", "list"]
 }
 
-path "kv/metadata/*" {
+path "kv/metadata/k8s/*" {
+  capabilities = ["read", "list"]
+}
+
+# Future destination for infrastructure secrets migrated from Ansible Vault.
+path "kv/data/infra/*" {
+  capabilities = ["create", "read", "update"]
+}
+
+path "kv/metadata/infra" {
+  capabilities = ["read", "list"]
+}
+
+path "kv/metadata/infra/*" {
   capabilities = ["read", "list"]
 }