From 4a812d4a70fac65d3145d0020d2934585e2e3e4a Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 18 Jul 2026 14:39:17 +1000
Subject: [PATCH] chore: setup access to enable all plugins, designated to
 tf-vault user

---
 policies/sys/plugins/catalog/admin.yaml   | 16 ++++++++++++++++
 policies/sys/plugins/catalog/rancher.yaml | 19 -------------------
 2 files changed, 16 insertions(+), 19 deletions(-)
 create mode 100644 policies/sys/plugins/catalog/admin.yaml
 delete mode 100644 policies/sys/plugins/catalog/rancher.yaml

diff --git a/policies/sys/plugins/catalog/admin.yaml b/policies/sys/plugins/catalog/admin.yaml
new file mode 100644
index 0000000..3286e46
--- /dev/null
+++ b/policies/sys/plugins/catalog/admin.yaml
@@ -0,0 +1,16 @@
+# Allow the vault deployer to import (register/deregister) plugin in the catalog
+---
+rules:
+  - path: "sys/plugins/catalog/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+      - sudo
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault
diff --git a/policies/sys/plugins/catalog/rancher.yaml b/policies/sys/plugins/catalog/rancher.yaml
deleted file mode 100644
index 139a0b3..0000000
--- a/policies/sys/plugins/catalog/rancher.yaml
+++ /dev/null
@@ -1,19 +0,0 @@
-# Allow the vault deployer to import (register/deregister) the rancher secrets
-# plugin in the catalog. sys/plugins/catalog is sudo-protected, so this lives
-# under policies/sys/ where only a sys code owner can grant it — keeping the
-# rancher engine policy (policies/rancher/) scoped to rancher/* paths.
----
-rules:
-  - path: "sys/plugins/catalog/secret/vault-plugin-secrets-rancher"
-    capabilities:
-      - create
-      - read
-      - update
-      - delete
-      - sudo
-
-auth:
-  approle:
-    - tf_vault
-  k8s/au/syd1:
-    - woodpecker_terraform_vault