From 096d677129c2e980160a16b450f37f5f19701ef8 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 28 Sep 2026 22:47:51 +1000 Subject: [PATCH] Remove the vlogs one-off oauth-credentials policy (#160) The vlogs OIDC client secret moves to its own Kubernetes namespace under service account `default`, so it lands on `kv/data/kubernetes/namespace/vlogs/default/oauth-credentials`. The shared per-namespace rule already matches that path, leaving the vlogs-specific policy with nothing to grant. - Delete `policies/kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials/read.yaml`. The shared oauth-credentials policy is untouched. Reviewed-on: https://git.unkin.net/unkin/terraform-vault/pulls/160 Co-authored-by: unkin-agent Co-committed-by: unkin-agent --- .../default/vlogs-oauth-credentials/read.yaml | 14 -------------- 1 file changed, 14 deletions(-) delete mode 100644 policies/kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials/read.yaml diff --git a/policies/kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials/read.yaml b/policies/kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials/read.yaml deleted file mode 100644 index 02aba75..0000000 --- a/policies/kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials/read.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Allow the Terraform Authentik runner to read the vlogs OIDC client secret. It is -# a second OIDC client in an already-onboarded namespace, so it cannot use the -# one-per-namespace oauth-credentials path. ---- -rules: - - path: "kv/data/kubernetes/namespace/logging/default/vlogs-oauth-credentials" - capabilities: - - read - -auth: - approle: - - terraform_authentik - k8s/au/syd1: - - woodpecker_terraform_authentik