diff --git a/config/auth_kubernetes_role/k8s/au/syd1/default.yaml b/config/auth_kubernetes_role/k8s/au/syd1/default.yaml
new file mode 100644
index 0000000..4f0b50c
--- /dev/null
+++ b/config/auth_kubernetes_role/k8s/au/syd1/default.yaml
@@ -0,0 +1,6 @@
+bound_service_account_names:
+  - default
+bound_service_account_namespaces: ['*']
+token_ttl: 600
+token_max_ttl: 600
+audience: vault
diff --git a/policies/kv/kubernetes/default.yaml b/policies/kv/kubernetes/default.yaml
new file mode 100644
index 0000000..ebb93d2
--- /dev/null
+++ b/policies/kv/kubernetes/default.yaml
@@ -0,0 +1,16 @@
+# Templated access to kv secrets for kubernetes
+#
+# kv/kubernetes/namespace/<namespace>/<service_account>
+# kv/kubernetes/cluster/<cluster>/<namespace>/<service_account>
+---
+rules:
+  - path: "kv/data/kubernetes/namespace/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_namespace}}/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_name}}/*"
+    capabilities:
+      - read
+  - path: "kv/data/kubernetes/cluster/au/syd1/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_namespace}}/{{identity.entity.aliases.auth_kubernetes_ac24966b.metadata.service_account_name}}/*"
+    capabilities:
+      - read
+
+auth:
+  k8s/au/syd1:
+    - default