From 141dd2579817911db831b6acde8d0545e52c84f4 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Mon, 28 Sep 2026 22:44:39 +1000 Subject: [PATCH] Restore shared oauth-credentials rule to its default-SA scope --- .../namespace/+/{+ => default}/oauth-credentials/read.yaml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) rename policies/kv/kubernetes/namespace/+/{+ => default}/oauth-credentials/read.yaml (63%) diff --git a/policies/kv/kubernetes/namespace/+/+/oauth-credentials/read.yaml b/policies/kv/kubernetes/namespace/+/default/oauth-credentials/read.yaml similarity index 63% rename from policies/kv/kubernetes/namespace/+/+/oauth-credentials/read.yaml rename to policies/kv/kubernetes/namespace/+/default/oauth-credentials/read.yaml index b7afae2..e6c7451 100644 --- a/policies/kv/kubernetes/namespace/+/+/oauth-credentials/read.yaml +++ b/policies/kv/kubernetes/namespace/+/default/oauth-credentials/read.yaml @@ -1,11 +1,10 @@ # Allow the Terraform Authentik runner to read the OAuth2/OIDC client secret that # backs an authentik provider, in whichever namespace the target service lives # (the module's data.vault_kv_secret_v2). The literal + is a Vault single-segment -# wildcard: one oauth-credentials secret per service account, so a namespace can -# host several OIDC apps as long as each runs under its own service account. +# wildcard: one oauth-credentials secret per onboarded namespace. --- rules: - - path: "kv/data/kubernetes/namespace/+/+/oauth-credentials" + - path: "kv/data/kubernetes/namespace/+/default/oauth-credentials" capabilities: - read