diff --git a/config/auth_approle_role/approle/agents.yaml b/config/auth_approle_role/approle/agents.yaml
new file mode 100644
index 0000000..8a23894
--- /dev/null
+++ b/config/auth_approle_role/approle/agents.yaml
@@ -0,0 +1,6 @@
+token_ttl: 3600
+token_max_ttl: 14400
+bind_secret_id: false
+token_bound_cidrs:
+  - "10.10.12.200/32"
+use_deterministic_role_id: true
diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-certs.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-certs.yaml
new file mode 100644
index 0000000..10fd4ed
--- /dev/null
+++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-certs.yaml
@@ -0,0 +1,4 @@
+allowed_kubernetes_namespaces:
+  - "cert-manager"
+kubernetes_role_type: "Role"
+extra_labels: {}
diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dhcp.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dhcp.yaml
new file mode 100644
index 0000000..c5ed8f5
--- /dev/null
+++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dhcp.yaml
@@ -0,0 +1,4 @@
+allowed_kubernetes_namespaces:
+  - "dhcp-system"
+kubernetes_role_type: "Role"
+extra_labels: {}
diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dns.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dns.yaml
new file mode 100644
index 0000000..b758647
--- /dev/null
+++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-dns.yaml
@@ -0,0 +1,4 @@
+allowed_kubernetes_namespaces:
+  - "*"
+kubernetes_role_type: "ClusterRole"
+extra_labels: {}
diff --git a/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-storage.yaml b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-storage.yaml
new file mode 100644
index 0000000..b1f1301
--- /dev/null
+++ b/config/kubernetes_secret_backend_role/kubernetes/au/syd1/agent-storage.yaml
@@ -0,0 +1,4 @@
+allowed_kubernetes_namespaces:
+  - "cephrgw-system"
+kubernetes_role_type: "Role"
+extra_labels: {}
diff --git a/policies/kubernetes/au/syd1/creds/agent-certs.yaml b/policies/kubernetes/au/syd1/creds/agent-certs.yaml
new file mode 100644
index 0000000..fcc78b7
--- /dev/null
+++ b/policies/kubernetes/au/syd1/creds/agent-certs.yaml
@@ -0,0 +1,12 @@
+# Allow access to agent-certs Kubernetes credentials
+---
+rules:
+  - path: "kubernetes/au/syd1/creds/agent-certs"
+    capabilities:
+      - update
+
+auth:
+  ldap:
+    - kubernetes_au_syd1_cluster_operator
+  approle:
+    - agents
diff --git a/policies/kubernetes/au/syd1/creds/agent-dhcp.yaml b/policies/kubernetes/au/syd1/creds/agent-dhcp.yaml
new file mode 100644
index 0000000..76e007d
--- /dev/null
+++ b/policies/kubernetes/au/syd1/creds/agent-dhcp.yaml
@@ -0,0 +1,12 @@
+# Allow access to agent-dhcp Kubernetes credentials
+---
+rules:
+  - path: "kubernetes/au/syd1/creds/agent-dhcp"
+    capabilities:
+      - update
+
+auth:
+  ldap:
+    - kubernetes_au_syd1_cluster_operator
+  approle:
+    - agents
diff --git a/policies/kubernetes/au/syd1/creds/agent-dns.yaml b/policies/kubernetes/au/syd1/creds/agent-dns.yaml
new file mode 100644
index 0000000..e61a423
--- /dev/null
+++ b/policies/kubernetes/au/syd1/creds/agent-dns.yaml
@@ -0,0 +1,12 @@
+# Allow access to agent-dns Kubernetes credentials
+---
+rules:
+  - path: "kubernetes/au/syd1/creds/agent-dns"
+    capabilities:
+      - update
+
+auth:
+  ldap:
+    - kubernetes_au_syd1_cluster_operator
+  approle:
+    - agents
diff --git a/policies/kubernetes/au/syd1/creds/agent-storage.yaml b/policies/kubernetes/au/syd1/creds/agent-storage.yaml
new file mode 100644
index 0000000..0463013
--- /dev/null
+++ b/policies/kubernetes/au/syd1/creds/agent-storage.yaml
@@ -0,0 +1,12 @@
+# Allow access to agent-storage Kubernetes credentials
+---
+rules:
+  - path: "kubernetes/au/syd1/creds/agent-storage"
+    capabilities:
+      - update
+
+auth:
+  ldap:
+    - kubernetes_au_syd1_cluster_operator
+  approle:
+    - agents
diff --git a/policies/kv/kubernetes/agents.yaml b/policies/kv/kubernetes/agents.yaml
new file mode 100644
index 0000000..ea89078
--- /dev/null
+++ b/policies/kv/kubernetes/agents.yaml
@@ -0,0 +1,17 @@
+# Allow the agents AppRole to manage the kubernetes KV subtree (no delete)
+---
+rules:
+  - path: "kv/data/kubernetes/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - list
+  - path: "kv/metadata/kubernetes/*"
+    capabilities:
+      - read
+      - list
+
+auth:
+  approle:
+    - agents
diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/agent-certs.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/agent-certs.yaml
new file mode 100644
index 0000000..995710d
--- /dev/null
+++ b/resources/secret_backend/kubernetes/au/syd1/roles/agent-certs.yaml
@@ -0,0 +1,33 @@
+---
+rules:
+  - apiGroups:
+      - "cert-manager.io"
+      - "acme.cert-manager.io"
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - "secrets"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+      - "delete"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods/log"
+    verbs:
+      - "get"
+      - "list"
diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/agent-dhcp.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/agent-dhcp.yaml
new file mode 100644
index 0000000..a425a34
--- /dev/null
+++ b/resources/secret_backend/kubernetes/au/syd1/roles/agent-dhcp.yaml
@@ -0,0 +1,26 @@
+---
+rules:
+  - apiGroups:
+      - "kea.unkin.net"
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+      - "services"
+      - "configmaps"
+      - "events"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods/log"
+    verbs:
+      - "get"
+      - "list"
diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/agent-dns.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/agent-dns.yaml
new file mode 100644
index 0000000..ba92724
--- /dev/null
+++ b/resources/secret_backend/kubernetes/au/syd1/roles/agent-dns.yaml
@@ -0,0 +1,26 @@
+---
+rules:
+  - apiGroups:
+      - "bind.unkin.net"
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+      - "services"
+      - "configmaps"
+      - "events"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods/log"
+    verbs:
+      - "get"
+      - "list"
diff --git a/resources/secret_backend/kubernetes/au/syd1/roles/agent-storage.yaml b/resources/secret_backend/kubernetes/au/syd1/roles/agent-storage.yaml
new file mode 100644
index 0000000..6c5b6d3
--- /dev/null
+++ b/resources/secret_backend/kubernetes/au/syd1/roles/agent-storage.yaml
@@ -0,0 +1,23 @@
+---
+rules:
+  - apiGroups:
+      - "ceph.unkin.net"
+    resources:
+      - "*"
+    verbs:
+      - "*"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods"
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+  - apiGroups:
+      - ""
+    resources:
+      - "pods/log"
+    verbs:
+      - "get"
+      - "list"