From 87468b7a596cae40f1466887cd17edca908e0d97 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Wed, 14 Oct 2026 22:21:51 +1100
Subject: [PATCH] Add deployer policy for identity OIDC objects

---
 policies/identity/oidc/admin.yaml | 51 +++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 policies/identity/oidc/admin.yaml

diff --git a/policies/identity/oidc/admin.yaml b/policies/identity/oidc/admin.yaml
new file mode 100644
index 0000000..7feb215
--- /dev/null
+++ b/policies/identity/oidc/admin.yaml
@@ -0,0 +1,51 @@
+# Allow the deployer to manage identity OIDC objects through the vault_identity_oidc*
+# resources, which only read, write and delete by name and never list or rotate.
+---
+rules:
+  - path: "identity/oidc/config"
+    capabilities:
+      - create
+      - read
+      - update
+  - path: "identity/oidc/key/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "identity/oidc/role/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "identity/oidc/client/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "identity/oidc/scope/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "identity/oidc/assignment/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+  - path: "identity/oidc/provider/*"
+    capabilities:
+      - create
+      - read
+      - update
+      - delete
+
+auth:
+  approle:
+    - tf_vault
+  k8s/au/syd1:
+    - woodpecker_terraform_vault