33 lines
843 B
HCL
33 lines
843 B
HCL
# Local development identity. Limit normal KV v2 reads and writes to the k8s
|
|
# subtree, and exclude soft-delete, metadata deletion, permanent version
|
|
# destruction, auth administration, and privileged operations.
|
|
path "kv/data/k8s/*" {
|
|
capabilities = ["create", "read", "update"]
|
|
}
|
|
|
|
path "kv/metadata/k8s" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
|
|
path "kv/metadata/k8s/*" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
|
|
# Future destination for infrastructure secrets migrated from Ansible Vault.
|
|
path "kv/data/infra/*" {
|
|
capabilities = ["create", "read", "update"]
|
|
}
|
|
|
|
path "kv/metadata/infra" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
|
|
path "kv/metadata/infra/*" {
|
|
capabilities = ["read", "list"]
|
|
}
|
|
|
|
# Sign disposable SSH public keys for short-lived development access.
|
|
path "ssh-client-signer/sign/ai-agent" {
|
|
capabilities = ["create", "update"]
|
|
}
|