From b33053339cc8a891b3007164bcb3c3a92d6b4375 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Mon, 27 Jul 2026 22:07:16 +1000
Subject: [PATCH] policies: grant terraform-git read on the gitea config KV
 metadata path

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
---
 .../vault/au/syd1/secret_backend/gitea/config_write.yaml     | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml b/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml
index 8847abe..d325a0b 100644
--- a/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml
+++ b/policies/kv/service/vault/au/syd1/secret_backend/gitea/config_write.yaml
@@ -12,6 +12,11 @@ rules:
       - create
       - read
       - update
+  # vault_kv_secret_v2 also reads the kv-v2 metadata path on every plan/apply
+  # (403 here broke the terraform-git main apply, pipeline 107).
+  - path: "kv/metadata/service/vault/au/syd1/secret_backend/gitea/config"
+    capabilities:
+      - read
 
 auth:
   approle: